create-root-ca

#!/usr/bin/env bash
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

# Derek Moore <derek.moore@gmail.com>
# Christian Göttsche <cgzones@googlemail.com>

set -eu

umask 0077
set -o pipefail

BIN_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
source "${BIN_DIR}/functions"
source "${BIN_DIR}/defaults.conf"

usage() {
    echo "Usage: $0 [-l] -d CA_DIR"
    echo "Initializes a new root CA in the directory CA_DIR"
    echo
    echo "Options:"
    echo "    -d CA_DIR  Target directory to be created and initialized"
    echo "               Must not exist yet"
    echo "    -l         Symlink toolchain (designed for development)"
    echo
}

CA_DIR=
SYMLINK=0

while getopts "d:hl" FLAG; do
    case $FLAG in
        d) CA_DIR=${OPTARG} ;;
        h) echo -e -n "$SUCC " && usage && exit 0;;
        l) SYMLINK=1 ;;
        *) echo -e -n "$ERR " && usage && exit 2;;
    esac
done

if [ $OPTIND -le $# ]; then
    echo -e -n "$ERR " && usage && exit 2
elif [[ "${CA_DIR}" = "" ]]; then
    echo -e -n "$SUCC " && usage && exit 1
fi

CA_NAME="$( basename "${CA_DIR}" )"
export CA_NAME

echo -e "$NOTE Creating root CA in dir '${CA_DIR}'"

init_ca_home "${CA_DIR}"
trap 'rm -Rf "${CA_DIR}"' 0
generate_conf "${CA_DIR}/bin/defaults.conf"
source "${CA_DIR}/bin/defaults.conf"

CA_CERT_CN="${CA_CERT_O} Certificate Authority"
CA_CERT_CN=`ask "$INPUT Common Name for CA certificate [${CA_CERT_CN}]: " CA_ROOT_CN_DEFAULT "${CA_CERT_CN}"`

if [[ -n $CA_ENABLE_ENGINE ]]; then
    init_engine
    init_slot 9c "${CA_DIR}/ca/ca.pub"
    # Slot 9c requires PIN entry on every operation.
    # No need to ask for the PIN for re-use.
    echo -e -n "$INPUT Enter PIN for signing root CA key: " >&2
    read -r -s PASS1
    echo
    if [[ ${#PASS1} -lt 4 ]]; then
        echo -e "$ERR Passphrase is too short, please use at least 4 characters!" >&2
        exit 1
    fi
else
    echo >&2
    PASS1=`ask -s "$INPUT Enter passphrase for encrypting root CA key: " CA_ROOT_PASS_DEFAULT "${ROOT_PASS:-""}"`
    echo >&2
    if [[ "${#PASS1}" -lt 4 ]]; then
        echo -e "$ERR Passphrase is too short, please use at least 4 characters!" >&2
        exit 1
    fi
    PASS2=`ask -s "$INPUT Verifying - Enter passphrase for encrypting root CA key: " CA_ROOT_PASS_DEFAULT "${ROOT_PASS:-""}"`
    echo >&2
    if [[ "${PASS1}" != "${PASS2}" ]]; then
        echo -e "$ERR Passphrases did not match, exiting." >&2
        exit 1
    fi
fi

export CA_PASS="${PASS1}"
export SAN=""

CA_PATH="${CA_PATH:-$( fullpath "${CA_DIR}")}"
export CA_PATH

pushd "${CA_DIR}" > /dev/null

# Generate the root CA openssl config
template "${BIN_DIR}/templates/root.tpl" "ca/ca.conf"
# Generate the root CA openssh config
mkdir -p ca/ssh
echo $( od -vAn -N2 -tu2 < /dev/urandom )00 > ca/ssh/serial

# Create the signing CA key
if [[ -z $CA_ENABLE_ENGINE ]]; then
    generate_key ca/private/ca.key
    ln -s ../private/ca.key ca/ssh/ca.ssh
    generate_pubkey ca/private/ca.key ca/ca.pub
else
    generate_pubkey_pkcs11 pkcs11:object=SIGN%20key ca/ca.pub
fi
generate_pubkey_ssh ca/ca.pub ca/ssh/ca.ssh.pub ${CA_DIR}

echo -e "$NOTE Creating the root CA csr" >&2

openssl_engine_cmd="\
    -engine pkcs11 \
    -keyform engine \
    -key pkcs11:object=SIGN%20key"

openssl req -new -batch \
    ${CA_ENABLE_ENGINE:+$openssl_engine_cmd} \
    $( [ -z $CA_ENABLE_ENGINE ] && echo "-key ca/private/ca.key") \
    -config ca/ca.conf \
    -out ca/ca.csr \
    -passin env:CA_PASS

echo >&2
echo -e "$NOTE Creating the root CA certificate" >&2

openssl_engine_cmd="\
    -engine pkcs11 \
    -keyform engine \
    -keyfile pkcs11:object=SIGN%20key"

openssl ca \
   ${CA_ENABLE_ENGINE:+$openssl_engine_cmd} \
   -selfsign -batch -notext \
   -config ca/ca.conf \
   -in ca/ca.csr \
   -out ca/ca.crt \
   -extensions root_ca_ext \
   -passin env:CA_PASS

ln -s ca.crt ca/chain.pem
ln -s ca.crt ca/root.crt

echo
if [[ -n "$CA_ENABLE_ENGINE" ]]; then
    replace_crt 9c ca/ca.crt
fi

echo
echo -e "$NOTE Creating the root CA CRL" >&2

openssl ca -gencrl -batch \
           ${CA_ENABLE_ENGINE:+$openssl_engine_cmd} \
           -config ca/ca.conf \
           -out ca/ca.crl \
           -passin env:CA_PASS

echo
if [ $SYMLINK -eq 1 ]; then
    echo -e "$NOTE Symlinking toolchain (dev mode)" >&2
    CP_CMD='ln -s'
else
    echo -e "$NOTE Copying toolchain" >&2
    CP_CMD='cp'
fi
$CP_CMD "${BIN_DIR}/README.md" README.md
for BIN in ${BINARIES_ROOT}; do
    $CP_CMD "${BIN_DIR}/${BIN}" bin/
done
mkdir bin/templates/
for TPL in ${TEMPLATES_ROOT}; do
    $CP_CMD "${BIN_DIR}/templates/${TPL}" bin/templates/
done


popd > /dev/null

unset CA_PASS

trap 0

echo -e "$SUCC Root CA initialized." >&2