Generate self signed TLS SSL certificate with RSA bash for Chrome Firefox Safari

tls-rsa.sh

#!/bin/bash

# Define variables
SUBJECT_ROOT="/C=US/O=Saud Iqbal/CN=Saud Iqbal Root RSA CA"
DAYS_VALID=3650
CONFIG_FILE="leaf_ext.cfg"
SUBJECT_LEAF="/"

RD=$(echo "\033[01;31m")
YW=$(echo "\033[33m")
GN=$(echo "\033[1;92m")
CL=$(echo "\033[m")
BFR="\\r\\033[K"
HOLD="${YW}+${CL}"
CM="${GN}✓${CL}"
CROSS="${RD}✗${CL}"

msg_ok() {
local msg="$1"
echo -e "${BFR} ${CM} ${GN}${msg}${CL}"
}
msg_error() {
local msg="$1"
echo -e "${BFR} ${CROSS} ${RD}${msg}${CL}"
}
msg_info() {
local msg="$1"
echo -e " ${HOLD} ${YW}${msg}${CL}"
}

msg_info "-------------------------------------------"
msg_info "-- Self Signed RSA Certificate Generator --"
msg_info "-------------------------------------------"

# Root CA
function GenerateRootPair() {
mkdir -p root/{certs,private}
echo -e "\033[0;41m Generate the Root Pair \033[m"
# 1. Generate Root CA Private Key
openssl genrsa -out root/private/rootCA.key 4096
# 2. Create the Self-Signed Root CA Certificate
openssl req -x509 -new -nodes -key root/private/rootCA.key -sha256 -days "$DAYS_VALID" -out root/certs/rootCA.crt -subj "$SUBJECT_ROOT"
msg_ok "Root pair setup done!"
sleep 1
}

# Leaf Certificate
function GenerateLeafPair() {
mkdir -p leaf/{newcerts,private,csr}

echo -e "\033[0;41m Generate Leaf Certificate \033[m"
echo -n "Enter hostname for creating new leaf certificate: "
read DOMAIN
if [[ -n $DOMAIN ]]; then
# 1. Generate Leaf Private Key
openssl genrsa -out leaf/private/${DOMAIN}.leaf.key.pem 2048
# 2. Create Certificate Signing Request (CSR) for the Leaf
openssl req -new -key leaf/private/${DOMAIN}.leaf.key.pem -out leaf/csr/${DOMAIN}.leaf.csr -subj "/C=US/ST=Ohio/O=Saud Iqbal/OU=LAN/CN=saudiqbal.com"

# Create a temporary config file to handle Subject Alternative Names (SAN)
# 1. Create a temporary extensions file
cat > "$CONFIG_FILE" <<EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage=digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
subjectAltName=critical,@alt_names

[alt_names]
DNS.1 = $DOMAIN
#DNS.2 = *.example.com
#IP.1 = 127.0.0.1
EOF
# 2. Sign the Leaf Certificate using the Root CA
rootexpirationdate=$(( ( $(date -d "$(openssl x509 -in root/certs/rootCA.crt -noout -enddate | cut -d= -f2-)" +%s) - $(date +%s) ) / 86400 ))
rootexpirationdate=$((rootexpirationdate - 1))
openssl x509 -req -in leaf/csr/${DOMAIN}.leaf.csr -CA root/certs/rootCA.crt -CAkey root/private/rootCA.key -CAcreateserial -out leaf/newcerts/${DOMAIN}.leaf.crt -days "$rootexpirationdate" -sha256 -extfile $CONFIG_FILE
msg_ok "Leaf CA setup done!"
# Clean up the configuration file
rm "$CONFIG_FILE"
else
msg_error "No response received!"
fi
sleep 1
}

if [ -d "root" ]; then
msg_error "Root CA already generated, skipping!"
else
printf 'Generate the Root Pair [y/N]? '
read answer
if [ "$answer" != "${answer#[Yy]}" ] ;then
GenerateRootPair
fi
fi
printf 'Generate New Leaf Certificate [y/N]? '
read answer
if [ "$answer" != "${answer#[Yy]}" ] ;then
GenerateLeafPair
fi

msg_info "--------------------------------------------"
msg_info "-- Self Signed RSA Certificate Setup Done --"
msg_info "--------------------------------------------"
exit 0

Save the bash script as tls-rsa.sh, change the names and and run it.

Your newly generated certificate for hostname should be in leaf/newcerts/ and private key in leaf/private/

Import the newly generated /root/certs/rootCA.crt into your browser