Self-Signed ECC X.509 Certificates (Server/Client/Mail) with OpenSSL - Linux

self-signed-ecc-cert-generator.sh

#!/bin/bash
# Original Source:
# https://gist.github.com/ggrandes/4cf69a924ccbfcb1253c
#
# Generate Self-Signed certificates (not for production)
# Default Password por PKCS12 file is "changeit"
# Default Expire 5 years
EXPIRE_DAYS=${EXPIRE_DAYS:-$[365 * 5 + 1]}
usage () {
  echo "$0 <client|server> <CN> <outputname>"
  echo "usage:"
  echo "$0 client coyote coyote"
  echo "$0 server '*.acme.com' acme"
  exit 0;
}
case "$1" in
  client);;
  server);;
  *) usage;;
esac
if [ "$3" = "" ]; then
  usage;
fi
TYPE="$1"
CN="$2"
NAME="${TYPE}-$3"
cat >/tmp/.tmp.openssl.cnf <<END
RANDFILE = \$ENV::HOME/.rnd
[ req ]
x509_extensions = v3_ca # The extentions to add to the self signed cert
string_mask = nombstr
distinguished_name = req_distinguished_name
prompt = no
encrypt_key = no
default_md = sha512
[ req_distinguished_name ]
#C = ES
#O = ACME
CN = ${CN}
#emailAddress = Email Address
[ v3_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
#subjectAltName=email:[email protected],DNS:*.acme.com
basicConstraints = critical, CA:TRUE, pathlen:0
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, keyCertSign
extendedKeyUsage = ${TYPE}Auth, emailProtection
nsCertType = ${TYPE}, email, sslCA, emailCA
nsComment="Self-signed certificate"
[ crl_ext ]
authorityKeyIdentifier=keyid:always,issuer:always
[ engine ]
default = openssl
END
#
(
export OPENSSL_CONF="/tmp/.tmp.openssl.cnf"
openssl ecparam -name secp521r1 -genkey -out ${NAME}.key
chmod 600 ${NAME}.key
echo;echo Generating x509;echo
serial="-set_serial $(date +%s)"
case "$(openssl version)" in *0.9.6*) serial="";; esac
openssl req -new -x509 $serial -days $EXPIRE_DAYS -key ${NAME}.key > ${NAME}.crt
(cat ${NAME}.key; echo; cat ${NAME}.crt; echo;) > ${NAME}.pem
chmod 600 ${NAME}.pem
echo;echo Generating PKCS12;echo; sync
openssl pkcs12 -export -in ${NAME}.pem -inkey ${NAME}.key -out ${NAME}.p12 -name "private" -descert -passout pass:changeit
ls -al ${NAME}.*
)
#
#ln -s ${NAME}.pem `openssl x509 -noout -hash < ${NAME}.pem`.0
#