Generate self-signed wildcard SSL certificate for development environment

generate-wildcard-certificate.sh

#!/usr/bin/env bash

# print usage
DOMAIN=$1
if [ -z "$1" ]; then
  echo "USAGE: $0 tld"
  echo ""
  echo "This will generate a non-secure self-signed wildcard certificate for "
  echo "a given development tld."
  echo "This should only be used in a development environment."
  exit
fi

# Add wildcard
WILDCARD="*.$DOMAIN"

CERT_DAYS=36500
# REGION & COMPANY
DN_countryName=US                  # Country Code (e.g., US)
DN_stateOrProvinceName=California  # State/Province name (e.g., California)
DN_localityName="San Francisco"    # City (e.g., San Francisco)
DN_organizationName=$DOMAIN        # Organization Name (eg, company)
DN_organizationalUnitName=IT       # Organization Unit (eg, IT)
DN_commonName=$WILDCARD            # Common Name (e.g. server FQDN or YOUR name)
DN_emailAddress=$(git config user.email)

# Set our variables
cat <<EOF >$DOMAIN.req.cnf
[ req ]
# The size of the keys in bits:
default_bits=2048
default_md=sha256
distinguished_name  = subject
req_extensions      = req_ext
x509_extensions     = x509_ext
string_mask         = utf8only
prompt = no

# The Subject DN can be formed using X501 or RFC 4514 (see RFC 4519 for a description).
#   Its sort of a mashup. For example, RFC 4514 does not provide emailAddress.
[ subject ]

countryName         = $DN_countryName
#countryName_default     = US

stateOrProvinceName     = $DN_stateOrProvinceName
#stateOrProvinceName_default = NY

localityName            = $DN_localityName
#localityName_default        = New York

organizationName         = $DN_organizationName
#organizationName_default    = Example, LLC

organizationalUnitName         = $DN_organizationalUnitName
#organizationalUnitName_default    = IT

# Use a friendly name here because it's presented to the user. The server's DNS
#   names are placed in Subject Alternate Names. Plus, DNS names here is deprecated
#   by both IETF and CA/Browser Forums. If you place a DNS name here, then you
#   must include the DNS name in the SAN too (otherwise, Chrome and others that
#   strictly follow the CA/Browser Baseline Requirements will fail).
commonName                = $DN_commonName
#commonName_default        = Example Company

emailAddress              = $DN_emailAddress
#emailAddress_default      = [email protected]

# Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
[ x509_ext ]

subjectKeyIdentifier      = hash
authorityKeyIdentifier    = keyid,issuer

# You only need digitalSignature below. *If* you don't allow
#   RSA Key transport (i.e., you use ephemeral cipher suites), then
#   omit keyEncipherment because that's key transport.
# keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
basicConstraints          = CA:FALSE
keyUsage                  = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName            = @alternate_names
nsComment                 = "OpenSSL Generated Certificate"

# RFC 5280, Section 4.2.1.12 makes EKU optional
#   CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused
#   In either case, you probably only need serverAuth.
# extendedKeyUsage  = critical, serverAuth, clientAuth
# extendedKeyUsage  = serverAuth, clientAuth, codeSigning, emailProtection

# Section req_ext is used when generating a certificate signing request. I.e., openssl req ...
[ req_ext ]

subjectKeyIdentifier      = hash

basicConstraints          = CA:FALSE
#keyUsage                  = digitalSignature, keyEncipherment
keyUsage                  = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName            = @alternate_names
nsComment                 = "OpenSSL Generated Certificate"

# RFC 5280, Section 4.2.1.12 makes EKU optional
#   CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused
#   In either case, you probably only need serverAuth.
# extendedKeyUsage         = serverAuth, clientAuth, codeSigning, emailProtection

[ alternate_names ]
DNS.1                     = $DOMAIN
DNS.2                     = *.$DOMAIN

# Add these if you need them. But usually you don't want them or
#   need them in production. You may need them for development.
# DNS.3                   = localhost
# DNS.4                   = localhost.localdomain
# DNS.5                   = 127.0.0.1
# IPv6 localhost
# DNS.6                   = ::1
EOF

# Generate our Private Key, and Certificate directly
openssl req -x509 -nodes -new -days $CERT_DAYS \
  -config $DOMAIN.req.cnf \
  -keyout "$DOMAIN.key" \
  -out "$DOMAIN.crt" &>/dev/null

# sed -i 's/-----BEGIN CERTIFICATE-----/-----BEGIN TRUSTED CERTIFICATE-----/g' "./$DOMAIN.crt"
# sed -i 's/-----END CERTIFICATE-----/-----END TRUSTED CERTIFICATE-----/g' "./$DOMAIN.crt"

# Convert PEM to DER
openssl x509 -in $DOMAIN.crt -outform der -out $DOMAIN.der

# Convert PEM to PKCS12
openssl pkcs12 -inkey $DOMAIN.key -in $DOMAIN.crt -export -out $DOMAIN.pfx

# openssl dhparam -out $DOMAIN.dhparam.pem 4096

#openssl x509 -text -inform PEM -in $DOMAIN.crt
#openssl x509 -text -inform DER -in $DOMAIN.crt

openssl x509 -noout -text -in $DOMAIN.crt

rm $DOMAIN.req.cnf

echo ""
echo "Next manual steps:"
echo "- Use $DOMAIN.crt and $DOMAIN.key to configure Apache/nginx"
echo "- Import $DOMAIN.crt into Chrome settings: chrome://settings/certificates > tab 'Authorities'"