dmlb2000 / ca-scripts

Bash scripts for creating and managing SSL certificates.

OpenSSL Local CA

These scripts and configuration were got from [here] (https://jamielinux.com/docs/openssl-certificate-authority/index.html). They are fairly complete including certificate revocation lists and intermediate CA setup.

The Setup

Set the PREFIX environment variable to where the CA tree lives.

PREFIX=/srv/docker-mgmt/.CA ./setup-ca-certs.sh

The Client Setup

Set the PREFIX environment variable to where the CA tree lives.

Then pass the client network login name to the client setup script.

PREFIX=/srv/docker-mgmt/.CA ./setup-client-cert.sh `whoami`

The script outputs the three files you need to pass to the user and also give them the password you used to setup the script.

Alternative Setup

If the user is comfortable wanting to make the password themselves, take a look at the script. The first two openssl commands in the setup-client-cert.sh script should be run by the user and the signed CSR needs to be sent to you to run the last openssl command. The user should be given a copy of the intermediate/openssl.cnf file and the answers to the CSR questions. These are Country Name, State or Province Name, Locality Name, Organization Name, Organizational Unit Name and Common Name. Alternatively, you can preset those for the user by setting the _default options in the openssl.cnf before you send it to the user.

Update an expired Cert

The certs generated by the scripts will expire after 365 days. When updating them all that's needed is to remove the cert file and the cert entry in the intermediate index. Then regenerate the cert by running the client setup command again.

PREFIX=/srv/docker-mgmt/.CA
rm -f $PREFIX/intermediate/certs/`whoami`.cert.pem
sed -i '/'`whoami`'/ D' $PREFIX/intermediate/index.txt
./setup-client-cert.sh `whoami`