rsa-user-csr

#!/bin/bash
## Takes one parameter for the name of the certificate and creates 
## a private certificate and an certification signing request both in PEM
## format

usage () {
    >&2 echo "usage:"
    >&2 echo "      $0 <key-name> <C> <ST> <L> <O> <OU> <CN> <mail>"
    >&2 echo "or"
    >&2 echo "      $0 <key-name> <config-file> <CN> <mail>"
    >&2 echo "with:"
    >&2 echo "  <key-name>        The name of the key to be created."
    >&2 echo "  <config-file>     A configuration file which must exists, which defines <C> <ST> <L> <O> <OU>"
    >&2 echo "  <C>               The two letter country code where the client is located."
    >&2 echo "  <ST>              The state where the client is located."
    >&2 echo "  <L>               The locality, where the client is located."
    >&2 echo "  <O>               The organisation, where the client belongs to."
    >&2 echo "  <OU>              The organisation unit the client belongs to."
    >&2 echo "  <CN>              The common name to identify the client e.g. personal id."
    >&2 echo "  <mail>            The e-mail address of the client."
    exit 1
}

debug () {
    now=$(date +"%T")
    echo "[$now] Key: $KEY_FILE | CSR: $CSR_FILE"
    echo "[$now] /C=$CSR_C/ST=$CSR_ST/L=$CSR_L/O=$CSR_O/OU=$CSR_OU/CN=$CSR_CN/emailAddress=$CSR_MAIL"
}

if [ ! -f CA/key.pem ]; then
    >&2 echo "The CA is not initialized!"
    exit 1
fi

# Check if a name was provided.
if [ -z "$1" ]; then
    usage
    exit 2
fi

# Declare the variables, if config file was provided, read it from there.
if [ -f "$2" ]; then
    source $2
    CSR_CN="$3"
    CSR_MAIL="$4"
else
    CSR_C="$2"
    CSR_ST="$3"
    CSR_L="$4"
    CSR_O="$5"
    CSR_OU="$6"
    CSR_CN="$7"
    CSR_MAIL="$8"
fi

KEY_FILE="./$1.key.pem"
CSR_FILE="./$1.csr.pem"

# debug

# Create the private key, which is stored AES256 encrypted.
openssl genrsa -aes256 -out "$KEY_FILE" 4096

retVal=$?
if [ $retVal -eq 0 ]; then
    now=$(date +"%T")
    echo "[$now] RSA key '$KEY_FILE' created."
fi

# Create the CSR, using the just created private key
# FIXME: The content of the ext config seems to be not part of the CSR!
openssl req -new -sha256 \
    -subj "/C=$CSR_C/ST=$CSR_ST/L=$CSR_L/O=$CSR_O/OU=$CSR_OU/CN=$CSR_CN/emailAddress=$CSR_MAIL" \
    -key "$KEY_FILE" -out "$CSR_FILE" \
    -extensions SAN \
    -config <(cat <<EOF
[req]
prompt=no
distinguished_name=req_distinguished_name
[req_distinguished_name]
O=bogo-p384
[SAN]
subjectAltName=email:$CSR_MAIL
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage=digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
EOF
)

retVal=$?
if [ $retVal -eq 0 ]; then
    now=$(date +"%T")
    echo "[$now] CSR '$1.csr.pem' created."
fi