Generate self-signed SSL cert for local development (OS X) and add it as trusted in System keychain

gencert.sh

#!/bin/bash
#
# Generate a self-signed SSL cert for local development and (optionally)
# add it as trusted in the system keychain to prevent browser warnings.
# Files are generated in the current directory; copy them as needed
# to your /etc/apache2/...
# Tested on OS X El Capitan.
#
# Sample Usage:
#  ./gencert.sh -n example.localhost [-y]  # -y to bypass all prompts
#
# Then, in your Apache <VirtualHost *:443> config:
#
#  SSLEngine on
#  SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
#  SSLCertificateFile "/private/etc/apache2/SSL/example.localhost/example.localhost.crt"
#  SSLCertificateKeyFile "/private/etc/apache2/SSL/example.localhost/example.localhost.key"
set -e

usage() { echo 'Usage: '$'\n'"  ./"$(basename $0)" [-n common_name] [-y]" >&2; exit 1; }

confirm() {
    yorn=y
    if [ "$prompt" -eq 1 ]; then
        read -p "${1} [y/n]: " yorn
    fi
    echo "$yorn"
}

get_fqdn() {
    lfqdn=$(echo "$1" | sed -e 's/^[^a-zA-Z0-9]*//g;s/[^a-zA-Z0-9,._-]*//g')
    echo "$lfqdn"
}

fqdn=""
prompt=1
ready=0
trap "echo; echo Cancelled; exit 1;" INT

OPTIND=1
while getopts 'n:y' opt; do
    case "${opt}" in
        n) fqdn="$OPTARG"
           ;;
        y) prompt=0
           ;;
        *) usage
           ;;
    esac
done

fqdn=$(get_fqdn "$fqdn")
if [ ! -z "$fqdn" ] && [ "$prompt" -eq 0 ]; then ready=1; fi

while [ "$ready" -ne 1 ]; do
    if [ "$prompt" -eq 1 ] && [ -z "$fqdn" ]; then
        read -p "Enter domain name: " fqdn
        fqdn=$(get_fqdn "$fqdn")
    elif [ -z "$fqdn" ]; then
        usage    
    fi

    if [ ! -z "$fqdn" ]; then
        if [[ $(confirm "Generate certificate for *.${fqdn}?") =~ ^[Yy] ]]; then
            ready=1
        else
            prompt=1
            fqdn=""
        fi
    fi
done

sudo openssl genrsa -out "${fqdn}.key" 2048
sudo openssl rsa -in "${fqdn}.key" -out "${fqdn}.key.rsa"

set +e
read -r -d '' sslconf <<'EndOfInput'
[req]
default_bits = 1024
distinguished_name = req_distinguished_name
req_extensions = v3_req

[req_distinguished_name]

[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = >>>DOMAIN<<<
DNS.2 = *.>>>DOMAIN<<<
EndOfInput
set -e

echo "$sslconf" | sed "s/>>>DOMAIN<<</$fqdn/g" | sudo tee "${fqdn}.conf" >/dev/null

sudo openssl req -new -key "${fqdn}.key.rsa"\
    -subj "/C=US/ST=California/L=Orange/O=IndieWebCamp/CN=*.${fqdn}/"\
    -out "${fqdn}.csr"\
    -config "${fqdn}.conf"

sudo openssl x509 -req -extensions v3_req -days 365\
    -in "${fqdn}.csr"\
    -signkey "${fqdn}.key.rsa"\
    -out "${fqdn}.crt"\
    -extfile\
    "${fqdn}.conf"

for ext in conf crt csr key key.rsa; do
    if [ -f "${fqdn}.${ext}" ]; then
        sudo chmod 600 "${fqdn}.${ext}" 
    fi
done

echo
yorn=$(confirm "Add certificate as trusted in local system keychain?")
if [[ "$yorn" =~ ^[Yy] ]]; then
    echo "Adding trusted cert ${fqdn}.crt to system keychain"
    sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${fqdn}.crt"
    # To remove...
    # sudo security remove-trusted-cert -d "${fqdn}.crt"
fi

exit 0