Create Certificate Authority

create-ca.sh

#!/bin/bash

# generate root CA key
echo "Generating root CA key"
openssl genrsa -aes256 -out rootca.key 2048

# generate root CA certificate (20 years)
echo "Generating root CA certificate"
openssl req -new -x509 -key rootca.key -days 7304 -sha256

echo "Finished."

generate-signed-cert.sh

#!/bin/bash

DOMAIN="$1"

# create client key
echo "Generating client key ${DOMAIN}.key"
openssl genrsa -aes256 -out "${DOMAIN}.key" 2048

# use key to generate certificate signing request
echo "Generating certificate signing request ${DOMAIN}.req"
openssl req -new -key "${DOMAIN}.key" -out "${DOMAIN}.req"

# sign the request with the CA key/cert to generate a signed certificate
echo "Generating signed certificate ${DOMAIN}.cer"
CASERIAL=rootca.srl
if [ -f $CASERIAL ]; then
  openssl x509 -req -in "${DOMAIN}.req" -out "${DOMAIN}.cer" -CA rootca.cer -CAkey rootca.key
else
  openssl x509 -req -in "${DOMAIN}.req" -out "${DOMAIN}.cer" -CA rootca.cer -CAkey rootca.key -CAcreateserial
fi

echo "Finished."