Generate Self Signed Certs Simple

.gitignore

certificates*

README.md

Notes

Parameters you can pass to the generate command below:

These have to be in order

BASE_DIRECTORY=${1:-"certificates"}
CERT_IP=${2:-"127.0.0.1"}
CERT_HOSTNAME=${3:-"localhost"}
CA_SUBJECT=${4:-"/C=US/ST=Virgina/L=Alexandria/O=MDD-RFed/OU=Engineering/CN=ca"}
SERVER_SUBJECT=${5:-"/C=US/ST=Virgina/L=Alexandria/O=MDD-RFed/OU=Engineering/CN=server"}

Run it

Make a directory to mount to container

mkdir certificates

Run the container, pass in the generate script

docker run -it --rm \
-v $(pwd)/certificates:/mnt \
-w /mnt centos:8 \
/bin/bash -c \
"yum install -y openssl && curl -sfL https://gist.githubusercontent.com/mddamato/be6f88a7dc8cec325fb80b11dea95611/raw/generate.sh | bash -s \
certificates \
10.10.10.10 \
myHostname \
\"/C=US/ST=Virgina/L=Alexandria/O=MDD-RFed/OU=Engineering/CN=ca\" \
\"/C=US/ST=Virgina/L=Alexandria/O=MDD-RFed/OU=Engineering/CN=server\"\
"

You can add additional certs trusted by the same CA by re-running with different parameters

docker run -it --rm \
-v $(pwd)/certificates:/mnt \
-w /mnt centos:8 \
/bin/bash -c \
"yum install -y openssl && curl -sfL https://gist.githubusercontent.com/mddamato/be6f88a7dc8cec325fb80b11dea95611/raw/generate.sh | bash -s certificates 10.10.10.10 myHostname"

Generate v2

docker run -it --rm
-v $(pwd)/certificates:/mnt
-w /mnt centos:8
/bin/bash

generate.sh

#!/bin/bash

set -e

BASE_DIRECTORY=${1:-"certificates"}
CERT_IP=${2:-"127.0.0.1"}
CERT_HOSTNAME=${3:-"localhost"}

CA_SUBJECT=${4:-"/C=US/ST=Virgina/L=Alexandria/O=MDD-RFed/OU=Engineering/CN=ca"}
SERVER_SUBJECT=${5:-"/C=US/ST=Virgina/L=Alexandria/O=MDD-RFed/OU=Engineering/CN=server"}

rm -rf $BASE_DIRECTORY/certs/$CERT_HOSTNAME

mkdir -p $BASE_DIRECTORY/certs/$CERT_HOSTNAME


if [ ! -d "$BASE_DIRECTORY/ca" ] 
then
  mkdir -p $BASE_DIRECTORY/ca
  openssl genrsa -out $BASE_DIRECTORY/ca/ca.key 2048
  openssl req -x509 -new -nodes \
  -key $BASE_DIRECTORY/ca/ca.key \
  -sha256 -days 1095 \
  -out $BASE_DIRECTORY/ca/ca.pem \
  -subj $CA_SUBJECT
fi

openssl genrsa -out $BASE_DIRECTORY/certs/$CERT_HOSTNAME/server.key 2048

openssl req -new \
-key $BASE_DIRECTORY/certs/$CERT_HOSTNAME/server.key \
-out $BASE_DIRECTORY/certs/$CERT_HOSTNAME/server.csr \
-subj $SERVER_SUBJECT

cat > $BASE_DIRECTORY/certs/$CERT_HOSTNAME/server.ext << EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
IP.1 = $CERT_IP
DNS.1 = $CERT_HOSTNAME
EOF

openssl x509 -req \
-in $BASE_DIRECTORY/certs/$CERT_HOSTNAME/server.csr \
-CA $BASE_DIRECTORY/ca/ca.pem \
-CAkey $BASE_DIRECTORY/ca/ca.key \
-CAcreateserial \
-out $BASE_DIRECTORY/certs/$CERT_HOSTNAME/server.crt \
-days 1095 -sha256 \
-extfile $BASE_DIRECTORY/certs/$CERT_HOSTNAME/server.ext

generate_v2.sh

openssl_csr_san.cnf

[ req ]
default_bits       = 2048
distinguished_name = req_distinguished_name
req_extensions     = req_ext

[ req_distinguished_name ]
countryName                = Country Name (2 letter code)
stateOrProvinceName        = State or Province Name (full name)
localityName               = Locality Name (eg, city)
organizationName           = Organization Name (eg, company)
commonName                 = Common Name (e.g. server FQDN or YOUR name)

# Optionally, specify some defaults.
#countryName_default             = [2 letter country code]
#stateOrProvinceName_default     = [State or Province]
#localityName_default            = [City or Town]
#0.organizationName_default      = [Organization]
#organizationalUnitName_default  = [Fully Qualified Domain Name]
#emailAddress_default            = [your email address]

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
DNS.1	= [Fully Qualified Domain Name]
DNS.2	= [Any variation of FQDN]
DNS.3	= [Any variation of FQDN]

openssl_intermediate.cnf

# OpenSSL intermediate CA configuration file.
# Copy to `/root/ca/intermediate/openssl.cnf`.

[ ca ]
# `man ca`
default_ca = CA_default

[ CA_default ]
# Directory and file locations.
dir               = /root/ca/intermediate
certs             = $dir/certs
crl_dir           = $dir/crl
new_certs_dir     = $dir/newcerts
database          = $dir/index.txt
serial            = $dir/serial
RANDFILE          = $dir/private/.rand

# The root key and root certificate.
private_key       = $dir/private/int.DOMAIN.key.pem
certificate       = $dir/certs/int.DOMAIN.crt.pem

# For certificate revocation lists.
crlnumber         = $dir/crlnumber
crl               = $dir/crl/int.DOMAIN.crl.pem
crl_extensions    = crl_ext
default_crl_days  = 30

# SHA-1 is deprecated, so use SHA-2 instead.
default_md        = sha512

name_opt          = ca_default
cert_opt          = ca_default
default_days      = 3650
preserve          = no
policy            = policy_loose

#Ensure that the extensione in the CSR make it to the signed certificate (like subjectAltNames)
copy_extensions   = copy

[ policy_strict ]
# The root CA should only sign intermediate certificates that match.
# See the POLICY FORMAT section of `man ca`.
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ policy_loose ]
# Allow the intermediate CA to sign a more diverse range of certificates.
# See the POLICY FORMAT section of the `ca` man page.
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
# Options for the `req` tool (`man req`).
default_bits        = 4096
distinguished_name  = req_distinguished_name
string_mask         = utf8only

# SHA-1 is deprecated, so use SHA-2 instead.
default_md          = sha512

# Extension to add when the -x509 option is used.
x509_extensions     = v3_ca

[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
stateOrProvinceName             = State or Province Name
localityName                    = Locality Name
0.organizationName              = Organization Name
organizationalUnitName          = Organizational Unit Name
commonName                      = Common Name
emailAddress                    = Email Address

# Optionally, specify some defaults.
#countryName_default             = [2 letter code]
#stateOrProvinceName_default     = [State or Province]
#localityName_default            = [City or Town]
#0.organizationName_default      = [Organization]
#organizationalUnitName_default  = [Unit]
#emailAddress_default            = [Your email address]

[ v3_ca ]
# Extensions for a typical CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ v3_intermediate_ca ]
# Extensions for a typical intermediate CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ usr_cert ]
# Extensions for client certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, emailProtection

[ server_cert ]
# Extensions for server certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth

[ crl_ext ]
# Extension for CRLs (`man x509v3_config`).
authorityKeyIdentifier=keyid:always

[ ocsp ]
# Extension for OCSP signing certificates (`man ocsp`).
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, OCSPSigning

openssl_root.cnf

# OpenSSL root CA configuration file.
# Copy to `/root/ca/openssl.cnf`.

[ ca ]
# `man ca`
default_ca = CA_default

[ CA_default ]
# Directory and file locations.
dir               = /root/ca
certs             = $dir/certs
crl_dir           = $dir/crl
new_certs_dir     = $dir/newcerts
database          = $dir/index.txt
serial            = $dir/serial
RANDFILE          = $dir/private/.rand

# The root key and root certificate.
private_key       = $dir/private/ca.DOMAINNAME.key.pem
certificate       = $dir/certs/ca.DOMAINNAME.crt.pem

# For certificate revocation lists.
crlnumber         = $dir/crlnumber
crl               = $dir/crl/ca.DOMAINNAME.crl.pem
crl_extensions    = crl_ext
default_crl_days  = 30

# SHA-1 is deprecated, so use SHA-2 instead.
default_md        = sha512

name_opt          = ca_default
cert_opt          = ca_default
default_days      = 375
preserve          = no
policy            = policy_strict

[ policy_strict ]
# The root CA should only sign intermediate certificates that match.
# See the POLICY FORMAT section of `man ca`.
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ policy_loose ]
# Allow the intermediate CA to sign a more diverse range of certificates.
# See the POLICY FORMAT section of the `ca` man page.
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
# Options for the `req` tool (`man req`).
default_bits        = 4096
distinguished_name  = req_distinguished_name
string_mask         = utf8only

# SHA-1 is deprecated, so use SHA-2 instead.
default_md          = sha512

# Extension to add when the -x509 option is used.
x509_extensions     = v3_ca

[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
stateOrProvinceName             = State or Province Name
localityName                    = Locality Name
0.organizationName              = Organization Name
organizationalUnitName          = Organizational Unit Name
commonName                      = Common Name
emailAddress                    = Email Address

# Optionally, specify some defaults.
#countryName_default             = [2 letter contry code]
#stateOrProvinceName_default     = [State or Province]
#localityName_default            = [City or Town]
#0.organizationName_default      = [Name of the organization]
#organizationalUnitName_default  = [Unit]
#emailAddress_default            = [your email address]

[ v3_ca ]
# Extensions for a typical CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ v3_intermediate_ca ]
# Extensions for a typical intermediate CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ usr_cert ]
# Extensions for client certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, emailProtection

[ server_cert ]
# Extensions for server certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth

[ crl_ext ]
# Extension for CRLs (`man x509v3_config`).
authorityKeyIdentifier=keyid:always

[ ocsp ]
# Extension for OCSP signing certificates (`man ocsp`).
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, OCSPSigning