#!/bin/bash -e # This is a mockup of a script to produce a snakeoil cert # The aim is to have a debconfisable ssl-certificate script # shellcheck source=/dev/null disable=SC1091 . /usr/share/debconf/confmodule db_version 2.0 db_capb backup progname=$(basename "${0}") usage() { cat <<EOF Usage: ${progname} [options] <template> <output> ${progname} [options] generate-default-snakeoil Options: -h,--help This usage text -f,--force-overwrite Overwrite existing .pem and .key files -n,--no-overwrite Never overwrite existing snakeoil .pem and .key files, even if algorithms are out of date -x,--expiration-days <N> Override default expiration time EOF exit "${1}"; } ask_via_debconf() { RET="" if db_settitle make-ssl-cert/title ; then : # OK else echo "Debconf failed with error code $? $RET" >&2 echo "Maybe your debconf database is corrupt." >&2 echo "Try re-installing ssl-cert." >&2 fi RET="" while [ "x$RET" = "x" ]; do db_fset make-ssl-cert/hostname seen false db_input high make-ssl-cert/hostname || true db_go db_get make-ssl-cert/hostname done db_get make-ssl-cert/hostname HostName="$RET" db_fset make-ssl-cert/hostname seen false db_fset make-ssl-cert/altname seen false db_input high make-ssl-cert/altname || true db_go db_get make-ssl-cert/altname AddAltName="$RET" db_fset make-ssl-cert/altname seen false SubjectAltName="DNS:$HostName" [ -z "$AddAltName" ] || SubjectAltName="$SubjectAltName,$AddAltName" } make_snakeoil() { if ! HostName="$(hostname -f)" ; then HostName="$(hostname)" echo "make-ssl-cert: Could not get FQDN, using '$HostName'". echo "make-ssl-cert: You may want to fix your /etc/hosts and/or DNS setup and run" echo "make-ssl-cert: 'make-ssl-cert generate-default-snakeoil --force-overwrite'" echo "make-ssl-cert: again." fi SubjectAltName="DNS:$HostName" if [ ${#HostName} -gt 64 ] ; then # The certificate's common name cannot be longer than 64 chars. # Use the short name instead. HostName="$(hostname)" fi } create_temporary_cnf() { sed -e s#@HostName@#"$HostName"# -e s#@SubjectAltName@#"$SubjectAltName"# "${template}" > "${TMPFILE}" } create_hash_link() { local file="$1" local cryptfile filename i filename=$(basename "$file") cryptfile=$(dirname "$file")/$(openssl x509 -hash -noout -in "$file") i=0 while [ -L "${cryptfile}.$i" ] ; do if [ "$(readlink "${cryptfile}.$i")" = "$filename" ] ; then return 0 fi i=$(( i + 1 )) done ln -sf "$filename" "${cryptfile}.$i" } check_min_algo() { local file="$1" local bits if ! openssl x509 -text -in "$file" | grep -q 'Signature Algorithm:.*sha256' ; then echo "Signature algorithm of $file is not sha256. Recreating." >&2 return 1 fi bits=$(openssl x509 -text -in "$file" |grep -o "RSA Public-Key:.*") # value: "RSA Public-Key: (2048 bit)" bits="${bits##*\(}" bits="${bits% bit\)}" case "$bits" in [0-9][0-9][0-9][0-9]) ;; *) echo "WARNING: Cannot determine RSA key length" >&2 return 0 ;; esac if [ "$bits" -lt 2048 ] ; then echo "RSA key length of $file is $bits. Recreating with 2048 bits" >&2 return 1 fi return 0 } # Process arguments subcommand= template= opt_force_overwrite="false" opt_no_overwrite="false" opt_expiration_days="3650" # Transform long options to short ones newargs=() for arg in "${@}"; do case "${arg}" in --help) newargs+=(-h) ;; --force-overwrite) # Move to front so that we accept --force-overwrite at the end, for # compatibility with 1.0.x. newargs=("-f" "${newargs[@]}") ;; --no-overwrite) newargs+=(-n) ;; --expiration-days) newargs+=(-x) ;; --*) printf "Unrecognized option %s\n\n" "${arg}" usage 1 ;; *) newargs+=("$arg") ;; esac done set -- "${newargs[@]}" # Parse short options while getopts "hfnx:" opt "${@}"; do case "${opt}" in h) usage 0 ;; f) opt_force_overwrite="true" ;; n) opt_no_overwrite="true" ;; x) opt_expiration_days="${OPTIND}" ;; *) printf "Unrecognized option %s\n\n" "-${opt}" usage 1 ;; esac done shift "$((OPTIND - 1))" if $opt_force_overwrite && $opt_no_overwrite ; then usage 1 fi # Parse subcommand if [ "${1}" = "generate-default-snakeoil" ]; then subcommand="${1}" else subcommand="manual" template="${1}" fi # Takes two arguments, the base layout and the output cert. if [ "${subcommand}" = "manual" ]; then output="${2}" [ -n "${template}" ] || usage 1 [ -n "${output}" ] || usage 1 # be anal in manual mode. if [ ! -f "${template}" ]; then printf "Could not open template file: %s!\n" "${template}"; exit 1; fi if [ -f "${output}" ] && [ "${opt_force_overwrite}" != "true" ]; then printf "%s file already exists!\n" "${output}"; exit 1; fi ask_via_debconf elif [ "${subcommand}" = "generate-default-snakeoil" ]; then template="/usr/share/ssl-cert/ssleay.cnf" if [ -f "/etc/ssl/certs/ssl-cert-snakeoil.pem" ] && [ -f "/etc/ssl/private/ssl-cert-snakeoil.key" ]; then if "${opt_no_overwrite}" ; then exit 0 fi if ! "${opt_force_overwrite}" ; then if check_min_algo "/etc/ssl/certs/ssl-cert-snakeoil.pem" ; then exit 0 fi fi fi make_snakeoil else usage 1 fi # # should be a less common char # problem is that openssl virtually accepts everything and we need to # sacrifice one char. TMPFILE="$(mktemp)" || exit 1 TMPOUT="$(mktemp)" || exit 1 trap 'rm -f ${TMPFILE} ${TMPOUT}' EXIT create_temporary_cnf # create the certificate. umask 077 if [ "${subcommand}" = "manual" ]; then if ! openssl req -config "${TMPFILE}" -new -x509 -days "${opt_expiration_days}" -nodes -sha256 \ -out "${output}" -keyout "${output}" > "${TMPOUT}" 2>&1 then echo "Could not create certificate. Openssl output was:" >&2 cat "${TMPOUT}" >&2 exit 1 fi chmod 600 "${output}" create_hash_link "${output}" elif [ "${subcommand}" = "generate-default-snakeoil" ]; then if ! openssl req -config "${TMPFILE}" -new -x509 -days "${opt_expiration_days}" -nodes -sha256 \ -out /etc/ssl/certs/ssl-cert-snakeoil.pem \ -keyout /etc/ssl/private/ssl-cert-snakeoil.key > "${TMPOUT}" 2>&1 then echo "Could not create certificate. Openssl output was:" >&2 cat "${TMPOUT}" >&2 exit 1 fi chmod 644 /etc/ssl/certs/ssl-cert-snakeoil.pem chmod 640 /etc/ssl/private/ssl-cert-snakeoil.key chown root:ssl-cert /etc/ssl/private/ssl-cert-snakeoil.key create_hash_link /etc/ssl/certs/ssl-cert-snakeoil.pem else usage 1 fi