55 lines
1.9 KiB
Bash
55 lines
1.9 KiB
Bash
#!/bin/sh
|
|
# certs/create-client.sh — Generate Client Certificate for Sawa Control Panel
|
|
|
|
# Exit on error
|
|
set -e
|
|
|
|
if [ -z "$1" ]; then
|
|
echo "Usage: $0 <device-name>"
|
|
echo "Example: $0 my-phone"
|
|
exit 1
|
|
fi
|
|
|
|
DEVICE_NAME=$1
|
|
CERT_DIR=$(dirname "$0")
|
|
CA_KEY="$CERT_DIR/ca.key"
|
|
CA_CRT="$CERT_DIR/ca.crt"
|
|
CLIENT_KEY="$CERT_DIR/$DEVICE_NAME.key"
|
|
CLIENT_CSR="$CERT_DIR/$DEVICE_NAME.csr"
|
|
CLIENT_CRT="$CERT_DIR/$DEVICE_NAME.crt"
|
|
CLIENT_P12="$CERT_DIR/$DEVICE_NAME.p12"
|
|
|
|
# Validation
|
|
if [ ! -f "$CA_KEY" ] || [ ! -f "$CA_CRT" ]; then
|
|
echo "Error: Root CA not found. Please run create-ca.sh first."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Step 1: Generating 2048-bit RSA private key for $DEVICE_NAME..."
|
|
openssl genrsa -out "$CLIENT_KEY" 2048
|
|
|
|
echo "Step 2: Generating Certificate Signing Request (CSR)..."
|
|
openssl req -new -key "$CLIENT_KEY" -out "$CLIENT_CSR" -subj "/CN=$DEVICE_NAME/O=Sawa/C=XX"
|
|
|
|
echo "Step 3: Signing the client certificate with Root CA (valid for 2 years)..."
|
|
printf "extendedKeyUsage=clientAuth\nkeyUsage=digitalSignature" > "$CERT_DIR/client_ext.cnf"
|
|
openssl x509 -req -in "$CLIENT_CSR" -CA "$CA_CRT" -CAkey "$CA_KEY" \
|
|
-CAcreateserial -out "$CLIENT_CRT" -days 730 -sha256 \
|
|
-extfile "$CERT_DIR/client_ext.cnf"
|
|
rm "$CERT_DIR/client_ext.cnf"
|
|
|
|
echo "Step 4: Exporting to PKCS12 (.p12) for mobile/browser installation..."
|
|
echo "IMPORTANT: iOS requires a non-empty password. You will be prompted for one now:"
|
|
openssl pkcs12 -export -out "$CLIENT_P12" -inkey "$CLIENT_KEY" -in "$CLIENT_CRT" -certfile "$CA_CRT"
|
|
|
|
# Cleanup temporary CSR
|
|
rm "$CLIENT_CSR"
|
|
|
|
echo ""
|
|
echo "--------------------------------------------------------"
|
|
echo "CLIENT CERTIFICATE SUCCESSFUL for: $DEVICE_NAME"
|
|
echo "--------------------------------------------------------"
|
|
echo "PEM Key: $CLIENT_KEY"
|
|
echo "PEM Cert: $CLIENT_CRT"
|
|
echo "PKCS12: $CLIENT_P12 (Use this for phone/browser)"
|
|
echo "--------------------------------------------------------"
|