create-root-ca

#!/usr/bin/env bash
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

# Derek Moore <derek.moore@gmail.com>
# Christian Göttsche <cgzones@googlemail.com>

set -eu

umask 0077
set -o pipefail

BIN_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
source "${BIN_DIR}/functions"
source "${BIN_DIR}/defaults.conf"

usage() {
    echo "Usage: $0 [-l] -d CA_DIR"
    echo "Initializes a new root CA in the directory CA_DIR"
    echo
    echo "Options:"
    echo "    -d CA_DIR  Target directory to be created and initialized"
    echo "               Must not exist yet"
    echo "    -l         Symlink toolchain (designed for development)"
    echo
}

CA_DIR=
SYMLINK=0

while getopts "d:hl" FLAG; do
    case $FLAG in
        d) CA_DIR=${OPTARG} ;;
        h) echo -e -n "$SUCC " && usage && exit 0;;
        l) SYMLINK=1 ;;
        *) echo -e -n "$ERR " && usage && exit 2;;
    esac
done

if [ $OPTIND -le $# ]; then
    echo -e -n "$ERR " && usage && exit 2
elif [[ "${CA_DIR}" = "" ]]; then
    echo -e -n "$SUCC " && usage && exit 1
fi

CA_NAME="$( basename "${CA_DIR}" )"
export CA_NAME

echo -e "$NOTE Creating root CA in dir '${CA_DIR}'"

init_ca_home "${CA_DIR}"
trap 'rm -Rf "${CA_DIR}"' 0
generate_conf "${CA_DIR}/bin/defaults.conf"
source "${CA_DIR}/bin/defaults.conf"

CA_CERT_CN="${CA_CERT_O} Certificate Authority"
CA_CERT_CN=`ask "$INPUT Common Name for CA certificate [${CA_CERT_CN}]: " CA_ROOT_CN_DEFAULT "${CA_CERT_CN}"`

if [[ -n $CA_ENABLE_ENGINE ]]; then
    init_engine
    # Slot 9c requires PIN entry on every operation.
    # No need to ask for the PIN for re-use.
    export CA_PASS="$(ask_pass_once "Enter PIN for signing root key:" CA_ROOT_PASS_DEFAULT  "${ROOT_PASS:-""}")"
    init_slot 9c "${CA_DIR}/ca/ca.pub" "pkcs11:object=SIGN%20key"
else
    export CA_PASS="$(ask_pass_twice_verify "Enter passphrase for encrypting signing root CA key:" CA_ROOT_PASS_DEFAULT "${ROOT_PASS:-""}")"
fi

CA_PATH="${CA_PATH:-$( fullpath "${CA_DIR}")}"
export CA_PATH

pushd "${CA_DIR}" > /dev/null

# Generate the root CA openssl config
template "${BIN_DIR}/templates/root.tpl" "ca/ca.conf"
# Generate the root CA openssh config
mkdir -p ca/ssh
echo $( od -vAn -N2 -tu2 < /dev/urandom )00 > ca/ssh/serial

# Create the signing CA key
if [[ -z $CA_ENABLE_ENGINE ]]; then
    generate_key ca/private/ca.key
    ln -s ../private/ca.key ca/ssh/ca.ssh
    generate_pubkey ca/private/ca.key ca/ca.pub
else
    generate_pubkey_pkcs11 pkcs11:object=SIGN%20key ca/ca.pub
fi
generate_pubkey_ssh ca/ca.pub ca/ssh/ca.ssh.pub ${CA_DIR}

echo -e "$NOTE Creating the root CA csr" >&2

openssl_engine_cmd="\
    -engine pkcs11 \
    -keyform engine \
    -key pkcs11:object=SIGN%20key"

openssl req -new -batch \
    ${CA_ENABLE_ENGINE:+$openssl_engine_cmd} \
    $( [ -z $CA_ENABLE_ENGINE ] && echo "-key ca/private/ca.key") \
    -config ca/ca.conf \
    -out ca/ca.csr \
    -passin env:CA_PASS

echo >&2
echo -e "$NOTE Creating the root CA certificate" >&2

openssl_engine_cmd="\
    -engine pkcs11 \
    -keyform engine \
    -keyfile pkcs11:object=SIGN%20key"

openssl ca \
   ${CA_ENABLE_ENGINE:+$openssl_engine_cmd} \
   -selfsign -batch -notext \
   -config ca/ca.conf \
   -in ca/ca.csr \
   -out ca/ca.crt \
   -extensions root_ca_ext \
   -passin env:CA_PASS

ln -s ca.crt ca/chain.pem
ln -s ca.crt ca/root.crt

echo
if [[ -n "$CA_ENABLE_ENGINE" ]]; then
    replace_crt 9c ca/ca.crt
fi

echo
echo -e "$NOTE Creating the root CA CRL" >&2

openssl ca -gencrl -batch \
           ${CA_ENABLE_ENGINE:+$openssl_engine_cmd} \
           -config ca/ca.conf \
           -out ca/ca.crl \
           -passin env:CA_PASS

echo
if [ $SYMLINK -eq 1 ]; then
    echo -e "$NOTE Symlinking toolchain (dev mode)" >&2
    CP_CMD='ln -s'
else
    echo -e "$NOTE Copying toolchain" >&2
    CP_CMD='cp'
fi
$CP_CMD "${BIN_DIR}/README.md" README.md
for BIN in ${BINARIES_ROOT}; do
    $CP_CMD "${BIN_DIR}/${BIN}" bin/
done
mkdir bin/templates/
for TPL in ${TEMPLATES_ROOT}; do
    $CP_CMD "${BIN_DIR}/templates/${TPL}" bin/templates/
done


popd > /dev/null

unset CA_PASS

trap 0

echo -e "$SUCC Root CA initialized." >&2