These scripts and configuration were got from [here] (https://jamielinux.com/docs/openssl-certificate-authority/index.html). They are fairly complete including certificate revocation lists and intermediate CA setup.
Set the PREFIX
environment variable to where the CA tree lives.
PREFIX=/srv/docker-mgmt/.CA ./setup-ca-certs.sh
Set the PREFIX
environment variable to where the CA tree lives.
Then pass the client network login name to the client setup script.
PREFIX=/srv/docker-mgmt/.CA ./setup-client-cert.sh `whoami`
The script outputs the three files you need to pass to the user and also give them the password you used to setup the script.
If the user is comfortable wanting to make the password themselves,
take a look at the script. The first two openssl
commands in the
setup-client-cert.sh
script should be run by the user and the
signed CSR needs to be sent to you to run the last openssl
command.
The user should be given a copy of the intermediate/openssl.cnf
file and the answers to the CSR questions. These are Country Name
,
State or Province Name
, Locality Name
, Organization Name
,
Organizational Unit Name
and Common Name
. Alternatively, you can
preset those for the user by setting the _default
options in the
openssl.cnf
before you send it to the user.
The certs generated by the scripts will expire after 365 days. When updating them all that's needed is to remove the cert file and the cert entry in the intermediate index. Then regenerate the cert by running the client setup command again.
PREFIX=/srv/docker-mgmt/.CA
rm -f $PREFIX/intermediate/certs/`whoami`.cert.pem
sed -i '/'`whoami`'/ D' $PREFIX/intermediate/index.txt
./setup-client-cert.sh `whoami`