CA签发工具

#!/bin/bash
#author Sun Ying
#date:2015-12-17
if [ $# -lt 1 ];then
	echo -e "\033[34mUsage: `basename $0` -h|--help for help\033[0m"
	exit 0
fi
[ -e ./CA_config ] && source ./CA_config
ERRLOG=`date +%Y%H%M`.log
PASSWORD=${PASSWORD-"1234"}
CO_S=${CN_S-"CN"}
ST_S=${ST_S-"BJ"}
LO_S=${LO_S-"BJ"}
OG_S=${OG_S-"Centos"}
OU_S=${OU_S-"Linux"}
HS_S=${HS_S-"centos.example.com"}
CO_C=${CN_C-"CN"}
ST_C=${ST_C-"LN"}
LO_C=${LO_C-"SY"}
OG_C=${OG_C-"Client1"}
OU_C=${OU_C-"Operation System"}
HS_C=${HS_C-"client1.example.com"}
DAYS=${DAYS-"365"}
P_KEY=${P_KEY-/etc/pki/CA/private/cakey.pem}
CACERT=${CACERT-/etc/pki/CA/cacert.pem}
M_SIZE=${M_SIZE-"2048"}
CSR_pem=${CSR_pem-/etc/pki/CA/newcerts/${HOSTNAME}.csr}
S_DAYS=${S_DAYS-365}
DIR_F=/etc/pki/CA
umask=077
[ ! -d /tmp/CA ] && mkdir -p /tmp/CA/
touch /tmp/CA/$ERRLOG
V_Key(){
	if [ -f $temp ]; then
		openssl rsa -noout -text -in $temp
	else
		echo -e "\033[32mYou must assign a private Key with parameter -v|--verify\033[0m"
		exit 3
	fi
}
V_Cert(){
	if [ -f $temp ]; then
		openssl x509 -noout -text -in $temp
	else
		echo -e "\033[32mYou must assign a cert file with parameter -k|--check\033[0m"
		exit 3
	fi
}
V_Csr(){
	if [ -f $temp ]; then
		openssl req -noout -text -in $temp
	else
		echo -e "\033[32mYou must assign a CSR file with parameter -i|--identify\033[0m"
		exit 3
	fi
}
genPriKey(){
	[ -e $P_KEY ] && rm -f $P_KEY
        openssl genrsa -des3 -passout pass:$PASSWORD -out $P_KEY $M_SIZE >>/tmp/CA/$ERRLOG 2>&1
        if [ $? -eq 0 ];then
                echo -e "Create private key in $P_KEY \033[033msuccess\033[0m"
        else
                echo "please check the error log under /tmp/CA/$ERRLOG"
		exit 1
        fi
}
selfSign(){
        [ -e $CACERT ] && rm -f $CACERT
	if [ ! -e $P_KEY ] ;then
		echo "Please create the private key first"
		exit 1
	fi
	openssl req -new -x509 -passin pass:$PASSWORD -key $P_KEY -out $CACERT -days $DAYS -subj "/C=${CO_S}/ST=${ST_S}/L=${LO_S}/O=${OG_S}/OU=${OU_S} Department/CN=$HS_S" >>/tmp/CA/$ERRLOG 2>&1
        if [ $? -eq 0 ];then
                echo -e "Self Sign ROOT CA in $CACERT \033[033msuccess\033[0m"
        else
                echo "please check the error og under /tmp/CA/$ERRLOG"
		exit 2
	fi
}
CSR_P(){
	[ -e $CSR_pem ] && rm -f $CSR_pem
	openssl req -new -passin pass:$PASSWORD -key $P_KEY -out $CSR_pem  -subj "/C=${CO_C}/ST=${ST_C}/L=${LO_C}/O=${OG_C}/OU=${OU_C} Department/CN=${HS_C}" >>/tmp/CA/$ERRLOG 2>&1
	if [ $? -eq 0 ];then
		echo -e "Create the CSR under $CSR_pem \033[033msuccess\033[0m"
	else
		echo "please check the error log under /tmp/CA/$ERRLOG"
		exit 3
	fi
}
Cat_CA(){
	[ -e /root/ca.config ] && rm -f /root/ca.config
	cat > /root/ca.config <<EOF
[ ca ]
default_ca = CA_own
[ CA_own ]
dir = /etc/pki/CA
certs = \$dir/certs
new_certs_dir = \$dir/newcerts
database = \$dir/index.txt
serial = \$dir/serial
RANDFILE = \$dir/private/.rand
certificate = \$dir/cacert.pem
private_key = \$dir/private/cakey.pem
default_days = 3650
default_crl_days = 30
default_md = md5
preserve = no
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[req]
x509_extensions	=v3_ca
[v3_ca]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
EOF

	if [ $? -eq 0 ]; then
		echo -e "Create configuration file on /root/ca.config \033[033msuccess\033[0m"
	else
		echo -e "Create configuration file on /root/ca.config \033[031failed\033[0m"
	fi
}
Sign_v3(){
	openssl req -in $temp -noout -text >> /tmp/CA/$ERRLOG 2>&1
	if [ $? -eq 0 ] ;then
		Cat_CA
		[ ! -f $DIR_F/index.txt ] && touch $DIR_F/index.txt
		if [ ! -f $DIR_F/serial ];then
			touch $DIR_F/serial
			echo 01 > $DIR_F/serial
		fi
		openssl ca -extensions v3_ca -passin pass:$PASSWORD -in $temp -config /root/ca.config -days $S_DAYS -out ${temp}_V3.crt  -batch  >>/tmp/CA/$ERRLOG 2>&1
		if [ $? -eq 0 ];then
			echo -e "Create the cert file on ${temp}_V3.crt \033[033msuccess\033[0m"
		else
			echo -e "Cannot Create the Cert file. Please check the error under /tmp/CA/$ERRLOG"
			exit 4
		fi
	else
		echo -e "\033[32mYou must assign a CSR file with parameter -s3|--sign3\033[0m"
		exit 5
	fi
}
Trans_key(){
	openssl rsa -passin pass:$PASSWORD -noout -text -in $temp > /dev/null 2>/tmp/CA/$ERRLOG
	if [ $? -eq 0 ];then
		openssl rsa -passin pass:$PASSWORD -in $temp -out ${temp}.key
		echo -e "Create the ${temp}.key \033[033msuccess\033[0m"
	else
		echo -e "\033[32mYou must assign a CSR file with parameter -t|--trans\033[0m"
		exit 5
	fi

}
Sign_CSR(){
	openssl req -in $temp -noout -text >> /tmp/CA/$ERRLOG 2>&1
	if [ $? -eq 0 ]; then
                [ ! -f $DIR_F/index.txt ] && touch $DIR_F/index.txt
                if [ ! -f $DIR_F/serial ];then
                        touch $DIR_F/serial
                        echo 01 > $DIR_F/serial
                fi
		openssl x509 -req -in $temp -CA $CACERT -CAkey $P_KEY -CAcreateserial -passin pass:$PASSWORD -out $temp.crt >>/tmp/CA/$ERRLOG 2>&1
		if [ $? -eq 0 ];then
                        echo -e "Create the cert file on $temp.crt \033[033msucess\033[0m"
                else
                        echo -e "Cannot Create the Cert file. Please check the error under /tmp/CA/$ERRLOG"
                        exit 4
		fi
	else
		echo -e "\033[32mYou must assign a CSR file with parameter -s|--sign\033[0m"
		exit 6
	fi

}
Revoke_cert (){
	if [ -f $temp ];then
		openssl ca -revoke $temp >>/tmp/CA/$ERRLOG 2>&1
		if [ $? -eq 0 ];then
			echo -e "Revoke the cert file $temp \033[033msucess\033[0m"
		else
			echo -e "Cannot Revoke the cert file,please check the /tmp/CA/$ERRLOG"
			exit 4
		fi
	else
		echo -e "\033[32mYou must assign a Cert file with parameter -e|--revoke\033[0m"
		exit 6
	fi
}

help_P(){
        echo -e "\033[34mUsage: `basename $0`\033[031m [option] [file]\033[0m"
        echo -e "	\033[32m-h|--help : usage for help page\033[0m"
        echo -e "	\033[32m-c|--ca: usage to sign self root CA certification\033[0m"
	echo -e "	\033[32m-p|--private: usage to generate a private key\033[0m"
	echo -e "	\033[32m-r|--request: usage to create a CSR request\033[0m"
	echo -e "	\033[32m-s|--sign: usage to sign a Certification\033[0m"
	echo -e "	\033[32m-s3|--sign3: usage to sign v3 Certification\033[0m"
	echo -e "	\033[32m-v|--verify: usage to verify a private key\033[0m"
	echo -e "	\033[32m-i|--identify: usage to verify a CSR file\033[0m"
	echo -e "	\033[32m-k|--check: usage to verify a Certication file\033[0m"
	echo -e "	\033[32m-t|--trans: usage to trans a private key with pass to no pass\033[0m"
	exit 0
}
while [ $# -ge 1 ]; do
case $1 in
	-p|--private)
			genPriKey
			shift
		;;
	-c|--ca)
			selfSign
			shift
		;;
	-r|--request)
			CSR_P
			shift
		;;
	-s3|--sign3)
			temp=$2
			Sign_v3
			rm /root/ca.config
			shift 2
		;;
	-s|--sign)
			temp=$2
			Sign_CSR
			shift 2
		;;
	-v|--verfiy)
			temp=$2
			temp=${temp:-null}
			V_Key
			shift 2
		;;
	-i|--identify)
			temp=$2
			temp=${temp:-null}
			V_Csr
			shift 2
		;;
	-k|--check)
			temp=$2
			temp=${temp:-null}
			V_Cert
			shift 2
		;;
	-e|--revoke)
			temp=$2
			Revoke_cert
			shift 2
		;;
	-h|--help)
			help_P
			shift
		;;
	-t|--trans)
			temp=$2
			Trans_key
			shift 2
		;;
	*)
			echo -e "\033[34mUsage: `basename $0` -h|--help for help\033[0m"
			exit 0
		;;
esac
done

[ -e /tmp/CA/$ERRLOG ] && rm /tmp/CA/$ERRLOG

　　默认配置

############configuration for the server side###########
##define private Key password
PASSWORD=1234
##define the valid days
DAYS=3650
##define the DN info
CO_S=CN
ST_S=BJ
LO_S=BJ
OG_S=Centos
OU_S=Linux
HS_S=centos.example.com
##define the Private Key Path
P_Key=/etc/pki/CA/private/cakey.pem
##define the CA Path
CACERT=/etc/pki/CA/cacert.pem

############configuration for the request CSR############
##define the DN info########
CO_C=CN
ST_C=LN
LO_C=DL
OG_C=server
OU_C="Operation System"
HS_C=server.example.com