WebSVN – ALCASAR – Diff – /scripts/alcasar-CA.sh


#!/bin/sh
# $Id: alcasar-CA.sh 3201 2024-05-28 17:21:34Z rexy $
 
# alcasar-CA.sh
# by Franck BOUIJOUX (3abtux), Pascal LEVANT and Richard REY (Rexy)
# This script is distributed under the Gnu General Public License (GPL)
#
# Some ideas from "nessus-mkcert" script written by Renaud Deraison <deraison@cvs.nessus.org>
# and Michel Arboi <arboi@alussinan.org>
#
DIR_TMP=${TMPDIR-/tmp}/alcasar-mkcert.$$
DIR_PKI=/etc/pki
DIR_CERT=$DIR_PKI/tls
DIR_WEB=/var/www/html
CACERT=$DIR_PKI/CA/alcasar-ca.crt
CAKEY=$DIR_PKI/CA/private/alcasar-ca.key
SRVREQ=$DIR_CERT/alcasar.req
SRVKEY=$DIR_CERT/private/alcasar.key
SRVCERT=$DIR_CERT/certs/alcasar.crt
SRVPEM=$DIR_CERT/private/alcasar.pem
SRVCHAIN=$DIR_CERT/certs/server-chain.pem
CONF_FILE="/usr/local/etc/alcasar.conf"
hostname=`grep ^HOSTNAME= $CONF_FILE|cut -d"=" -f2`
domain=`grep ^DOMAIN= $CONF_FILE|cut -d"=" -f2`
domain=${domain:=localdomain}
fqdn_hostname="$hostname.$domain"
# The value for organizationalUnitName must be 64 chars or less;
#   thus, hostname must be 36 chars or less. If it's too big,
#   try removing domain (merci REXY ;-) ).
hostname_len=`echo $fqdn_hostname| wc -c`
if [ $hostname_len -gt 36 ];
then
	fqdn_hostname=$hostname
fi
private_ip=`grep ^PRIVATE_IP= $CONF_FILE|cut -d"=" -f2|cut -d"/" -f1`
 
CACERT_LIFETIME="1460"
SRVCERT_LIFETIME="1460"
COUNTRY="FR"
PROVINCE="none"
LOCATION="Paris"
ORGANIZATION="ALCASAR-Team"
 
mkdir $DIR_TMP || exit 1
[ -d $DIR_PKI/CA/private ] || mkdir -p $DIR_PKI/CA/private ; chown -R root:root $DIR_PKI/CA ; chmod -R 750 $DIR_PKI/CA
# dynamic conf file for openssl
cat <<EOF >$DIR_TMP/ssl.conf
RANDFILE		= $HOME/.rnd
#
[ca]
default_ca = AlcasarCA
 
[AlcasarCA]
dir		= $DIR_TMP		# Where everything is kept
certs		= \$dir			# Where the issued certs are kept
crl_dir		= \$dir			# Where the issued crl are kept
database	= \$dir/index.txt	# database index file.
new_certs_dir	= \$dir			# default place for new certs.
certificate	= $CACERT	 	# The CA certificate
serial		= \$dir/serial 		# The current serial number
crl		= \$dir/crl.pem 	# The current CRL
private_key	= $CAKEY		# The private key
x509_extensions	= usr_cert		# The extentions to add to the cert
crl_extensions	= crl_ext
default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= sha256		# which message digest to use.
preserve	= no			# keep passed DN ordering
policy		= policy_anything
 
[policy_anything]
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional
 
[req]
default_bits		= 2048
distinguished_name	= req_distinguished_name
# attributes		= req_attributes
x509_extensions		= v3_ca		# The extentions to add to the self signed cert
 
[ v3_ca ]
subjectKeyIdentifier	= hash
authorityKeyIdentifier	= keyid:always,issuer:always
basicConstraints	= critical,CA:true
keyUsage		= cRLSign, keyCertSign
nsCertType		= sslCA
 
[req_distinguished_name]
countryName			= Country Name (2 letter code)
countryName_default		= FR
countryName_min			= 2
countryName_max			= 2
stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= Some-State
localityName			= Locality Name (eg, city)
localityName_default		= Lyon
0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= your organization name
organizationalUnitName		= Organizational Unit Name (eg, section)
commonName			= Common Name (eg, your name or your server\'s hostname)
commonName_max			= 255
emailAddress			= Email Address
emailAddress_max		= 255
 
[usr_cert]
nsCertType			= server
subjectKeyIdentifier		= hash
authorityKeyIdentifier		= keyid,issuer
basicConstraints		= CA:FALSE
keyUsage			= digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
issuerAltName			= issuer:copy
subjectAltName			= @alt_names
 
[alt_names]
DNS.1				= $fqdn_hostname
IP.1				= $private_ip
EOF
 
CAMAIL=
SRVMAIL=
echo `date +%s` > $DIR_TMP/serial
touch $DIR_TMP/index.txt
 
# CA key
rm -f $CAKEY
echo "*********CAKEY*********" > $DIR_TMP/openssl-log
openssl genrsa -out $CAKEY 2048 2>> $DIR_TMP/openssl-log
 
# CA certificate
rm -f $CACERT
echo >> $DIR_TMP/openssl-log
echo "*********CACERT*********" >> $DIR_TMP/openssl-log
echo "$COUNTRY
$PROVINCE
$LOCATION
$ORGANIZATION
Certification Authority for $fqdn_hostname
$fqdn_hostname-local-CA
$CAMAIL" | 
openssl req -config $DIR_TMP/ssl.conf -new -x509 -sha256 -days $CACERT_LIFETIME -key $CAKEY -out $CACERT 2>> $DIR_TMP/openssl-log
 
# Server key
rm -f $SRVKEY	
echo >> $DIR_TMP/openssl-log
echo "*********SRVKEY*********" >> $DIR_TMP/openssl-log
openssl genrsa -out $SRVKEY 2048 2>> $DIR_TMP/openssl-log
 
# Server certificate "request"
echo >> $DIR_TMP/openssl-log
echo "*********SRVRQST*********" >> $DIR_TMP/openssl-log
echo "$COUNTRY
$PROVINCE
$LOCATION
$ORGANIZATION
Server certificate for $fqdn_hostname
$fqdn_hostname
$SRVMAIL" | 
openssl req -config $DIR_TMP/ssl.conf -new -key $SRVKEY -out $SRVREQ 2>> $DIR_TMP/openssl-log
 
# Sign the server certificate "request" to create server certificate
rm -f $SRVCERT
echo >> $DIR_TMP/openssl-log
echo "*********SRVCERT*********" >> $DIR_TMP/openssl-log
openssl ca -config $DIR_TMP/ssl.conf -name AlcasarCA -batch -days $SRVCERT_LIFETIME -in $SRVREQ -out $SRVCERT 2>> $DIR_TMP/openssl-log
rm -f $SRVREQ
 
(cat $SRVKEY; echo; cat $SRVCERT) > $SRVPEM
cp -f $CACERT $SRVCHAIN
 
# Limit rights
chown -R root:root $SRVKEY $CAKEY
chmod -R 0600 $SRVKEY $CAKEY
 
# Link certs in ALCASAR Control Center
if [ -s "$CACERT" -a -s "$CAKEY" -a -s "$SRVCERT" -a -s "$SRVKEY" ];
	then
	[ -d $DIR_WEB/certs ] || mkdir -p $DIR_WEB/certs
	rm -f $DIR_WEB/certs/*
	ln -s $CACERT $DIR_WEB/certs/certificat_alcasar_ca.crt
	ln -s $SRVCERT $DIR_WEB/certs/certificat_alcasar.crt
	rm -rf $DIR_TMP
	exit 0
else
	echo "An error occured when generating security certificates (see : $DIR_TMP/openssl-log)" 
	exit 1
fi
 

Rev 2924	Rev 3201
1	`#!/bin/sh`	1	`#!/bin/sh`
2	`# $Id: alcasar-CA.sh 2924 2021-02-23 21:42:48Z rexy $`	2	`# $Id: alcasar-CA.sh 3201 2024-05-28 17:21:34Z rexy $`
3		3
4	`# alcasar-CA.sh`	4	`# alcasar-CA.sh`
5	`# by Franck BOUIJOUX (3abtux), Pascal LEVANT and Richard REY (Rexy)`	5	`# by Franck BOUIJOUX (3abtux), Pascal LEVANT and Richard REY (Rexy)`
6	`# This script is distributed under the Gnu General Public License (GPL)`	6	`# This script is distributed under the Gnu General Public License (GPL)`
7	`#`	7	`#`
8	`# Some ideas from "nessus-mkcert" script written by Renaud Deraison <deraison@cvs.nessus.org>`	8	`# Some ideas from "nessus-mkcert" script written by Renaud Deraison <deraison@cvs.nessus.org>`
9	`# and Michel Arboi <arboi@alussinan.org>`	9	`# and Michel Arboi <arboi@alussinan.org>`
10	`#`	10	`#`
11	`DIR_TMP=${TMPDIR-/tmp}/alcasar-mkcert.$$`	11	`DIR_TMP=${TMPDIR-/tmp}/alcasar-mkcert.$$`
12	`DIR_PKI=/etc/pki`	12	`DIR_PKI=/etc/pki`
13	`DIR_CERT=$DIR_PKI/tls`	13	`DIR_CERT=$DIR_PKI/tls`
14	`DIR_WEB=/var/www/html`	14	`DIR_WEB=/var/www/html`
15	`CACERT=$DIR_PKI/CA/alcasar-ca.crt`	15	`CACERT=$DIR_PKI/CA/alcasar-ca.crt`
16	`CAKEY=$DIR_PKI/CA/private/alcasar-ca.key`	16	`CAKEY=$DIR_PKI/CA/private/alcasar-ca.key`
17	`SRVREQ=$DIR_CERT/alcasar.req`	17	`SRVREQ=$DIR_CERT/alcasar.req`
18	`SRVKEY=$DIR_CERT/private/alcasar.key`	18	`SRVKEY=$DIR_CERT/private/alcasar.key`
19	`SRVCERT=$DIR_CERT/certs/alcasar.crt`	19	`SRVCERT=$DIR_CERT/certs/alcasar.crt`
20	`SRVPEM=$DIR_CERT/private/alcasar.pem`	20	`SRVPEM=$DIR_CERT/private/alcasar.pem`
21	`SRVCHAIN=$DIR_CERT/certs/server-chain.pem`	21	`SRVCHAIN=$DIR_CERT/certs/server-chain.pem`
22	`CONF_FILE="/usr/local/etc/alcasar.conf"`	22	`CONF_FILE="/usr/local/etc/alcasar.conf"`
23	hostname=`grep ^HOSTNAME= $CONF_FILE\|cut -d"=" -f2`	23	hostname=`grep ^HOSTNAME= $CONF_FILE\|cut -d"=" -f2`
24	domain=`grep ^DOMAIN= $CONF_FILE\|cut -d"=" -f2`	24	domain=`grep ^DOMAIN= $CONF_FILE\|cut -d"=" -f2`
25	`domain=${domain:=localdomain}`	25	`domain=${domain:=localdomain}`
26	`fqdn_hostname="$hostname.$domain"`	26	`fqdn_hostname="$hostname.$domain"`
27	`# The value for organizationalUnitName must be 64 chars or less;`	27	`# The value for organizationalUnitName must be 64 chars or less;`
28	`# thus, hostname must be 36 chars or less. If it's too big,`	28	`# thus, hostname must be 36 chars or less. If it's too big,`
29	`# try removing domain (merci REXY ;-) ).`	29	`# try removing domain (merci REXY ;-) ).`
30	hostname_len=`echo $fqdn_hostname\| wc -c`	30	hostname_len=`echo $fqdn_hostname\| wc -c`
31	`if [ $hostname_len -gt 36 ];`	31	`if [ $hostname_len -gt 36 ];`
32	`then`	32	`then`
33	`fqdn_hostname=$hostname`	33	`fqdn_hostname=$hostname`
34	`fi`	34	`fi`
35	private_ip=`grep ^PRIVATE_IP= $CONF_FILE\|cut -d"=" -f2\|cut -d"/" -f1`	35	private_ip=`grep ^PRIVATE_IP= $CONF_FILE\|cut -d"=" -f2\|cut -d"/" -f1`
36		36
37	`CACERT_LIFETIME="1460"`	37	`CACERT_LIFETIME="1460"`
38	`SRVCERT_LIFETIME="1460"`	38	`SRVCERT_LIFETIME="1460"`
39	`COUNTRY="FR"`	39	`COUNTRY="FR"`
40	`PROVINCE="none"`	40	`PROVINCE="none"`
41	`LOCATION="Paris"`	41	`LOCATION="Paris"`
42	`ORGANIZATION="ALCASAR-Team"`	42	`ORGANIZATION="ALCASAR-Team"`
43		43
44	`mkdir $DIR_TMP \|\| exit 1`	44	`mkdir $DIR_TMP \|\| exit 1`
45	`[ -d $DIR_PKI/CA/private ] \|\| mkdir -p $DIR_PKI/CA/private ; chown -R root:root $DIR_PKI/CA ; chmod -R 750 $DIR_PKI/CA`	45	`[ -d $DIR_PKI/CA/private ] \|\| mkdir -p $DIR_PKI/CA/private ; chown -R root:root $DIR_PKI/CA ; chmod -R 750 $DIR_PKI/CA`
46	`# dynamic conf file for openssl`	46	`# dynamic conf file for openssl`
47	`cat <<EOF >$DIR_TMP/ssl.conf`	47	`cat <<EOF >$DIR_TMP/ssl.conf`
48	`RANDFILE = $HOME/.rnd`	48	`RANDFILE = $HOME/.rnd`
49	`#`	49	`#`
50	`[ca]`	50	`[ca]`
51	`default_ca = AlcasarCA`	51	`default_ca = AlcasarCA`
52		52
53	`[AlcasarCA]`	53	`[AlcasarCA]`
54	`dir = $DIR_TMP # Where everything is kept`	54	`dir = $DIR_TMP # Where everything is kept`
55	`certs = \$dir # Where the issued certs are kept`	55	`certs = \$dir # Where the issued certs are kept`
56	`crl_dir = \$dir # Where the issued crl are kept`	56	`crl_dir = \$dir # Where the issued crl are kept`
57	`database = \$dir/index.txt # database index file.`	57	`database = \$dir/index.txt # database index file.`
58	`new_certs_dir = \$dir # default place for new certs.`	58	`new_certs_dir = \$dir # default place for new certs.`
59	`certificate = $CACERT # The CA certificate`	59	`certificate = $CACERT # The CA certificate`
60	`serial = \$dir/serial # The current serial number`	60	`serial = \$dir/serial # The current serial number`
61	`crl = \$dir/crl.pem # The current CRL`	61	`crl = \$dir/crl.pem # The current CRL`
62	`private_key = $CAKEY # The private key`	62	`private_key = $CAKEY # The private key`
63	`x509_extensions = usr_cert # The extentions to add to the cert`	63	`x509_extensions = usr_cert # The extentions to add to the cert`
64	`crl_extensions = crl_ext`	64	`crl_extensions = crl_ext`
65	`default_days = 365 # how long to certify for`	65	`default_days = 365 # how long to certify for`
66	`default_crl_days= 30 # how long before next CRL`	66	`default_crl_days= 30 # how long before next CRL`
67	`default_md = sha256 # which message digest to use.`	67	`default_md = sha256 # which message digest to use.`
68	`preserve = no # keep passed DN ordering`	68	`preserve = no # keep passed DN ordering`
69	`policy = policy_anything`	69	`policy = policy_anything`
70		70
71	`[policy_anything]`	71	`[policy_anything]`
72	`countryName = optional`	72	`countryName = optional`
73	`stateOrProvinceName = optional`	73	`stateOrProvinceName = optional`
74	`localityName = optional`	74	`localityName = optional`
75	`organizationName = optional`	75	`organizationName = optional`
76	`organizationalUnitName = optional`	76	`organizationalUnitName = optional`
77	`commonName = supplied`	77	`commonName = supplied`
78	`emailAddress = optional`	78	`emailAddress = optional`
79		79
80	`[req]`	80	`[req]`
81	`default_bits = 2048`	81	`default_bits = 2048`
82	`distinguished_name = req_distinguished_name`	82	`distinguished_name = req_distinguished_name`
83	`# attributes = req_attributes`	83	`# attributes = req_attributes`
84	`x509_extensions = v3_ca # The extentions to add to the self signed cert`	84	`x509_extensions = v3_ca # The extentions to add to the self signed cert`
85		85
86	`[ v3_ca ]`	86	`[ v3_ca ]`
87	`subjectKeyIdentifier = hash`	87	`subjectKeyIdentifier = hash`
88	`authorityKeyIdentifier = keyid:always,issuer:always`	88	`authorityKeyIdentifier = keyid:always,issuer:always`
89	`basicConstraints = critical,CA:true`	89	`basicConstraints = critical,CA:true`
90	`keyUsage = cRLSign, keyCertSign`	90	`keyUsage = cRLSign, keyCertSign`
91	`nsCertType = sslCA`	91	`nsCertType = sslCA`
92		92
93	`[req_distinguished_name]`	93	`[req_distinguished_name]`
94	`countryName = Country Name (2 letter code)`	94	`countryName = Country Name (2 letter code)`
95	`countryName_default = FR`	95	`countryName_default = FR`
96	`countryName_min = 2`	96	`countryName_min = 2`
97	`countryName_max = 2`	97	`countryName_max = 2`
98	`stateOrProvinceName = State or Province Name (full name)`	98	`stateOrProvinceName = State or Province Name (full name)`
99	`stateOrProvinceName_default = Some-State`	99	`stateOrProvinceName_default = Some-State`
100	`localityName = Locality Name (eg, city)`	100	`localityName = Locality Name (eg, city)`
101	`localityName_default = Lyon`	101	`localityName_default = Lyon`
102	`0.organizationName = Organization Name (eg, company)`	102	`0.organizationName = Organization Name (eg, company)`
103	`0.organizationName_default = your organization name`	103	`0.organizationName_default = your organization name`
104	`organizationalUnitName = Organizational Unit Name (eg, section)`	104	`organizationalUnitName = Organizational Unit Name (eg, section)`
105	`commonName = Common Name (eg, your name or your server\'s hostname)`	105	`commonName = Common Name (eg, your name or your server\'s hostname)`
106	`commonName_max = 255`	106	`commonName_max = 255`
107	`emailAddress = Email Address`	107	`emailAddress = Email Address`
108	`emailAddress_max = 255`	108	`emailAddress_max = 255`
109		109
110	`[usr_cert]`	110	`[usr_cert]`
111	`nsCertType = server`	111	`nsCertType = server`
112	`subjectKeyIdentifier = hash`	112	`subjectKeyIdentifier = hash`
113	`authorityKeyIdentifier = keyid,issuer`	113	`authorityKeyIdentifier = keyid,issuer`
114	`basicConstraints = CA:FALSE`	114	`basicConstraints = CA:FALSE`
115	`keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment`	115	`keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment`
116	`issuerAltName = issuer:copy`	116	`issuerAltName = issuer:copy`
117	`subjectAltName = @alt_names`	117	`subjectAltName = @alt_names`
118		118
119	`[alt_names]`	119	`[alt_names]`
120	`DNS.1 = $fqdn_hostname`	120	`DNS.1 = $fqdn_hostname`
121	`IP.1 = $private_ip`	121	`IP.1 = $private_ip`
122	`EOF`	122	`EOF`
123		123
124	`CAMAIL=`	124	`CAMAIL=`
125	`SRVMAIL=`	125	`SRVMAIL=`
126	`echo 01 > $DIR_TMP/serial`	126	echo `date +%s` > $DIR_TMP/serial
127	`touch $DIR_TMP/index.txt`	127	`touch $DIR_TMP/index.txt`
128		128
129	`# CA key`	129	`# CA key`
130	`rm -f $CAKEY`	130	`rm -f $CAKEY`
131	`echo "*******CAKEY*******" > $DIR_TMP/openssl-log`	131	`echo "*******CAKEY*******" > $DIR_TMP/openssl-log`
132	`openssl genrsa -out $CAKEY 2048 2>> $DIR_TMP/openssl-log`	132	`openssl genrsa -out $CAKEY 2048 2>> $DIR_TMP/openssl-log`
133		133
134	`# CA certificate`	134	`# CA certificate`
135	`rm -f $CACERT`	135	`rm -f $CACERT`
136	`echo >> $DIR_TMP/openssl-log`	136	`echo >> $DIR_TMP/openssl-log`
137	`echo "*******CACERT*******" >> $DIR_TMP/openssl-log`	137	`echo "*******CACERT*******" >> $DIR_TMP/openssl-log`
138	`echo "$COUNTRY`	138	`echo "$COUNTRY`
139	`$PROVINCE`	139	`$PROVINCE`
140	`$LOCATION`	140	`$LOCATION`
141	`$ORGANIZATION`	141	`$ORGANIZATION`
142	`Certification Authority for $fqdn_hostname`	142	`Certification Authority for $fqdn_hostname`
143	`$fqdn_hostname-local-CA`	143	`$fqdn_hostname-local-CA`
144	`$CAMAIL" \|`	144	`$CAMAIL" \|`
145	`openssl req -config $DIR_TMP/ssl.conf -new -x509 -sha256 -days $CACERT_LIFETIME -key $CAKEY -out $CACERT 2>> $DIR_TMP/openssl-log`	145	`openssl req -config $DIR_TMP/ssl.conf -new -x509 -sha256 -days $CACERT_LIFETIME -key $CAKEY -out $CACERT 2>> $DIR_TMP/openssl-log`
146		146
147	`# Server key`	147	`# Server key`
148	`rm -f $SRVKEY`	148	`rm -f $SRVKEY`
149	`echo >> $DIR_TMP/openssl-log`	149	`echo >> $DIR_TMP/openssl-log`
150	`echo "*******SRVKEY*******" >> $DIR_TMP/openssl-log`	150	`echo "*******SRVKEY*******" >> $DIR_TMP/openssl-log`
151	`openssl genrsa -out $SRVKEY 2048 2>> $DIR_TMP/openssl-log`	151	`openssl genrsa -out $SRVKEY 2048 2>> $DIR_TMP/openssl-log`
152		152
153	`# Server certificate "request"`	153	`# Server certificate "request"`
154	`echo >> $DIR_TMP/openssl-log`	154	`echo >> $DIR_TMP/openssl-log`
155	`echo "*******SRVRQST*******" >> $DIR_TMP/openssl-log`	155	`echo "*******SRVRQST*******" >> $DIR_TMP/openssl-log`
156	`echo "$COUNTRY`	156	`echo "$COUNTRY`
157	`$PROVINCE`	157	`$PROVINCE`
158	`$LOCATION`	158	`$LOCATION`
159	`$ORGANIZATION`	159	`$ORGANIZATION`
160	`Server certificate for $fqdn_hostname`	160	`Server certificate for $fqdn_hostname`
161	`$fqdn_hostname`	161	`$fqdn_hostname`
162	`$SRVMAIL" \|`	162	`$SRVMAIL" \|`
163	`openssl req -config $DIR_TMP/ssl.conf -new -key $SRVKEY -out $SRVREQ 2>> $DIR_TMP/openssl-log`	163	`openssl req -config $DIR_TMP/ssl.conf -new -key $SRVKEY -out $SRVREQ 2>> $DIR_TMP/openssl-log`
164		164
165	`# Sign the server certificate "request" to create server certificate`	165	`# Sign the server certificate "request" to create server certificate`
166	`rm -f $SRVCERT`	166	`rm -f $SRVCERT`
167	`echo >> $DIR_TMP/openssl-log`	167	`echo >> $DIR_TMP/openssl-log`
168	`echo "*******SRVCERT*******" >> $DIR_TMP/openssl-log`	168	`echo "*******SRVCERT*******" >> $DIR_TMP/openssl-log`
169	`openssl ca -config $DIR_TMP/ssl.conf -name AlcasarCA -batch -days $SRVCERT_LIFETIME -in $SRVREQ -out $SRVCERT 2>> $DIR_TMP/openssl-log`	169	`openssl ca -config $DIR_TMP/ssl.conf -name AlcasarCA -batch -days $SRVCERT_LIFETIME -in $SRVREQ -out $SRVCERT 2>> $DIR_TMP/openssl-log`
170	`rm -f $SRVREQ`	170	`rm -f $SRVREQ`
171		171
172	`(cat $SRVKEY; echo; cat $SRVCERT) > $SRVPEM`	172	`(cat $SRVKEY; echo; cat $SRVCERT) > $SRVPEM`
173	`cp -f $CACERT $SRVCHAIN`	173	`cp -f $CACERT $SRVCHAIN`
174		174
175	`# Limit rights`	175	`# Limit rights`
176	`chown -R root:root $SRVKEY $CAKEY`	176	`chown -R root:root $SRVKEY $CAKEY`
177	`chmod -R 0600 $SRVKEY $CAKEY`	177	`chmod -R 0600 $SRVKEY $CAKEY`
178		178
179	`# Link certs in ALCASAR Control Center`	179	`# Link certs in ALCASAR Control Center`
180	`if [ -s "$CACERT" -a -s "$CAKEY" -a -s "$SRVCERT" -a -s "$SRVKEY" ];`	180	`if [ -s "$CACERT" -a -s "$CAKEY" -a -s "$SRVCERT" -a -s "$SRVKEY" ];`
181	`then`	181	`then`
182	`[ -d $DIR_WEB/certs ] \|\| mkdir -p $DIR_WEB/certs`	182	`[ -d $DIR_WEB/certs ] \|\| mkdir -p $DIR_WEB/certs`
183	`rm -f $DIR_WEB/certs/*`	183	`rm -f $DIR_WEB/certs/*`
184	`ln -s $CACERT $DIR_WEB/certs/certificat_alcasar_ca.crt`	184	`ln -s $CACERT $DIR_WEB/certs/certificat_alcasar_ca.crt`
185	`ln -s $SRVCERT $DIR_WEB/certs/certificat_alcasar.crt`	185	`ln -s $SRVCERT $DIR_WEB/certs/certificat_alcasar.crt`
186	`rm -rf $DIR_TMP`	186	`rm -rf $DIR_TMP`
187	`exit 0`	187	`exit 0`
188	`else`	188	`else`
189	`echo "An error occured when generating security certificates (see : $DIR_TMP/openssl-log)"`	189	`echo "An error occured when generating security certificates (see : $DIR_TMP/openssl-log)"`
190	`exit 1`	190	`exit 1`
191	`fi`	191	`fi`
192		192

Subversion Repositories ALCASAR

(root)/scripts/alcasar-CA.sh @ 843 – Rev 2924 → 3201