easycert

#!/bin/sh
# easycert (part of ossobv/vcutil) // wdoekes/2012-2022 // Public Domain
#
# Wrapper around openssl to create basic KEY+CSR pairs for submittal to
# a certificate authority.
#
# Also features a small test mode. And usable as CGI script.
#
# (BEWARE: Mac/BSD users: it requires gnu-getopt)
#
# Usage:
#
#     # Create two files:
#     # -rw-rw-r-- my_example_com-2014.csr
#     # -rw------- my_example_com-2014.key
#     easycert -c UK -l London -s London -o MyCompany -e my@example.com \
#         my.example.com
#
#     # Or, an alternate notation:
#     # -rw-rw-r-- STAR_example_com-2014.csr
#     # -rw------- STAR_example_com-2014.key
#     easycert '*.example.com' \
#         '/C=UK/L=London/ST=State/O=MyCompany/CN=*.example.com/'
#
#     # Test if the certificate chain is in the right order:
#     #  0 s:/OU=Domain .../OU=PositiveSSL Wildcard/CN=*.osso.nl
#     #    i:/C=GB/ST=Greater .../L=Salford/O=COMODO/CN=PositiveSSL CA 2
#     #  1 s:/C=GB/ST=Greater .../L=Salford/O=COMODO/CN=PositiveSSL CA 2
#          i:/C=SE/O=AddTrust AB/OU=AddTrust .../CN=AddTrust External CA Root
#     easycert -T www.osso.nl 443
#
#     # Test if the certificate chain of a PEM file is in the right order:
#     easycert -T /path/to/chain.pem
#
# When run as CGI service, it displays input boxes for the options
# and writes the output to CERTHOME.
#

# defaults
country=NL
city=Groningen
state=Groningen
organisation="OSSO B.V."
email="info@osso.nl"

# cgi config
CERTHOME=/srv/easycert

openssl_connect() {
    host="$1"; shift
    port="$1"; shift
    openssl s_client -connect "$host:$port" -servername "$host" "$@"
}

run_help() {
    cat <<EOF
Usage: $0 -c NL -l Groningen -o OSSO\\ B.V. -e info@osso.nl osso.nl
Usage: $0 osso.nl "/C=NL/L=Groningen/ST=Groningen/O=OSSO B.V./CN=osso.nl/"
Usage: $0 -T www.osso.nl 443"
Usage: $0 -T /path/to/chain.pem

When showing -T (test) output, the list of certificates should be logically
ordered. Locally, you want to have the last certificate as a symlink similar
to /etc/ssl/certs/2e5ac55d.0 (based on the certificate hash).
EOF
}

run_test() {
#     cat <<EOF
# The list below should be logically ordered, and end with a self-signed root
# certificate. (Although the last one is optional and only echo "overhead.)
# EOF
    if test $# -eq 1; then
        input=$(cat "$1")
        if test "$(echo "$input" | head -n1)" \
                = "-----BEGIN RSA PRIVATE KEY-----"; then
            echo "(skipped private key)" >&2
            echo >&2
            input=$(echo "$input" | sed -e '
  /-----BEGIN RSA PRIVATE KEY-----/,/-----END RSA PRIVATE KEY-----/d')
        elif test "$(echo "$input" | head -n1)" \
                = "-----BEGIN PRIVATE KEY-----"; then
            echo "(skipped private key)" >&2
            echo >&2
            input=$(echo "$input" | sed -e '
  /-----BEGIN PRIVATE KEY-----/,/-----END PRIVATE KEY-----/d')
        fi
        echo "$input" | show_certchain || exit $?
        echo "Expires in $(cat "$1" | get_expiry_days) days"
    else
        host="$1"
        port="$2"
        input=$(openssl_connect "$host" "$port" -showcerts </dev/null 2>&0)
        echo "$input" | show_remote_certchain "$@" || exit $?
        echo "Expires in $(echo "$input" | get_expiry_days) days"
        echo "$input" | get_subject_match "$@" || exit $?
    fi
}

show_certchain() {
    n=0
    res=$(
    sed -e '/^-----BEGIN CERTIFICATE/,/-----END CERTIFICATE/{s/$/|/g}' |
        tr -d '\r\n' | sed -e 's/-----END CERTIFICATE-----|/&\n/g' |
    while read cert; do
        out=$(echo "$cert" | tr '|' '\n' |
            openssl x509 -noout -subject -issuer -subject_hash -issuer_hash \
              -ext subjectKeyIdentifier,authorityKeyIdentifier)  # ) vimfix
        if test $? -ne 0; then
            echo 'Read failure' >&2
            exit 1
        fi
        subj=$(echo "$out" | sed -e '1!d;s/^subject= *//')
        issuer=$(echo "$out" | sed -e '2!d;s/^issuer= *//')
        # The subject-hash and issuer-hash are nothing more than a hash of the
        # certificate subject. This is not unique enough.
        shash=$(echo "$out" | sed -ne3p)  # just a hash of the CN
        ihash=$(echo "$out" | sed -ne4p)  # just a hash of the issuer CN
        # The Subject and Authority key identifiers are unique enough,
        # but that's an extension, so it's not necessarily provided.
        # When creating a CSR, you want the subjectKeyIdentifier[=hash]
        # and authorityKeyIdentifier[=keyid:always].
        # For ansible 'openssl_csr' you'd add both (without [=...])
        # to the extended_key_usage list.
        sid=$(echo "$out" | grep '^X509v3 Subject Key Identifier' -A1 |
              sed -ne '2s/ *\(.*\)/\1/p')
        # In openssl 1.x the authorityKeyIdentifier was prefixed by "keyid:".
        # In openssl 3.x it's gone.
        iid=$(echo "$out" | grep '^X509v3 Authority Key Identifier' -A1 |
              sed -ne '2s/ *\(keyid:\)\?\(.*\)/\2/p')
        test $n -eq 0 && echo 'Certificate chain'
        echo " $n s: {${sid:-x509v3-subject-key-not-provided}} [$shash] $subj"
        echo "   i: {${iid:-x509v3-issuer-key--not-provided}} [$ihash] $issuer"
        n=$((n+1))
    done
    )
    test -z "$res" && exit 1
    echo "$res"
    echo '---'
}

show_remote_certchain() {
    host="$1"
    port="$2"
    input=$(cat)
    output=$(echo "$input" | sed -e '/^-----BEGIN/,/^-----END/!d' |
        show_certchain)
    if test -z "$output"; then
        openssl_connect "$host" "$port" </dev/null
        exit $?
    fi
    echo "$output"
}

get_expiry_days() {
    date=$(openssl x509 -dates -noout | sed -e '/^notAfter=/!d;s/^[^=]*=//')
    echo $(( ( $(date -d "$date" +%s) - $(date +%s) ) / 86400 ))  # days
}

get_subject_match() {
    host="$1"
    port="$2"
    certinfo=$(openssl x509 -text)
    sigalgo=$(echo "$certinfo" |
              sed -n 's/^ *Signature Algorithm: \([^ ]*\).*/\1/p' | head -n1)
    if test "$sigalgo" = "sha1WithRSAEncryption"; then
        echo "WARNING: Uses old SHA-1 hash" >&2
    fi
    cn=$(echo "$certinfo" |
         sed -e '/Subject.*CN *= */!d;s/.*CN *= *\([^/]*\).*/\1/')
    altnames=$(echo "$certinfo" |
               grep '^[[:blank:]]*X509v3 Subject Alternative Name:' -A1 |
               tail -n1)
    date=$(echo "$certinfo" | sed -e '/^ *Not After :/!d;s/^[^:]*: *//')
    if test "$host" = "$cn"; then
        :
    elif test "*.$host" = "$cn"; then
        :
    elif test "$host" = "www.$cn"; then
        :
    elif echo "$host" |
         grep -q "$(echo "$cn" | sed -e 's/\./\\./g;s/*/.*/;s/^/^/;s/$/$/')"; then
        :
    elif echo "$altnames" | grep -qE "[[:blank:]]DNS:$host(, | *\$)"; then
        :
    else
        echo "($host NOT IN ("$cn $altnames")) "
    fi
}

run_generate() {
    cn="$1"
    subject="$2"
    dst="$(echo "$cn" | tr . _ | sed -e 's/\*/STAR/g')-$(date +%Y)"

    if test -f "$dst.key" -o \
            -f "$dst.csr" -o \
            -f "$dst.crt"; then
        echo "Files starting with $dst.* exist already:" >&2
        ls "$dst."* | sed -e 's/^/  /' >&2
        exit 1
    fi

    if test -t 0; then
        echo "Subject: $subject"
        echo -n 'Enter to proceed (or ^C to abort to change parameters)...'
        read yes
    fi

    # Generate new private key.
    old_umask=$(umask)
    umask 0077
    openssl genrsa -out "$dst.key" 4096 >&2
    umask $old_umask

    # Generate new csr. No need to pass -sha256 here (during the move
    # from sha1 in 2014). The CSR is signed with sha256 by default
    # anyway (openssl 1.0.1f). And it usually doesn't have any effect on
    # the CA's signing of the CRT.
    openssl req -new -key "$dst.key" -out "$dst.csr" -subj "$subject" \
                -batch >&2

    echo "$dst.csr"
}

cgi_get() {
    cat <<__EOF__
    <form method="POST" action="$0">
        <input name="cn" value="Domain without www..."/>
          Common Name (domain.tld or *.domain.tld for wildcard)<br/>
        <input name="organisation" value="$organisation"/> Company<br/>
        <input name="email" value="$email"/> E-mail<br/>
        <input name="city" value="$city"/> City<br/>
        <input name="state" value="$state"/> State<br/>
        <input name="country" value="$country"/> Country<br/>
        <input type="submit"/>
    </form>
__EOF__
}

cgi_post() {
    eval "$(cat | python -c 'import urlparse
for k,v in urlparse.parse_qs(raw_input()).items():
    if k in ("cn","organisation","email","city","state","country"):
        print "%s='\''%s'\''" % (k,v[0].replace("\\"","").replace("/","")
                                   .replace(",",";").replace("'\''",""))')"
    if test -n "$cn" -o -n "$organisation" -o -n "$email" -o \
            -n "$city" -o -n "$state" -o -n "$country"; then
        echo "Invalid arguments...<br/>"
        exit 0
    fi
    echo "Generating in ${CERTHOME}...<br/>"
    if ! test -d "$CERTHOME"; then
        echo "Cannot chdir to ${CERTHOME}...<br/>"
        exit 0
    fi
    cd "$CERTHOME"
    subject="/C=$country/L=$city/ST=$state/O=$organisation/CN=$cn/\
emailAddress=$email"
    file="$(run_generate "$cn" "$subject" </dev/null 2>&0)"
    if test $? != 0; then
        echo "Failure...<br/>"
        exit 0
    fi
    echo "Generated: $file<br/><pre>"
    cat "$file"
    echo "</pre>"
}

# If we're called as CGI script, do CGI stuff.
if test -n "$GATEWAY_INTERFACE"; then
    printf "Content-Type: text/html; charset=UTF-8\r\n\r\n"
    if test "$REQUEST_METHOD" = "POST"; then
        cgi_post
    else
        cgi_get
    fi
    exit 0
fi

# Default CLI action is generate.
action=generate

# Trick: we use getopt(1) to reposition the arguments, because the
# builtin getopts plays POSIXLY_CORRECT and refuses to do so. We then
# use builtin getopts (plural!) that handles quoted arguments.
options=Thc:l:s:o:e:
temp=$(getopt -o $options -- "$@")
has_flag=0
test $? != 0 && exit 1
eval set -- "$temp"
while getopts $options opt; do
    case $opt in
    c)
        country="$OPTARG"
        has_flag=1
        ;;
    l)
        city="$OPTARG"
        has_flag=1
        ;;
    s)
        state="$OPTARG"
        has_flag=1
        ;;
    o)
        organisation="$OPTARG"
        has_flag=1
        ;;
    e)
        email="$OPTARG"
        has_flag=1
        ;;
    T)
        action=test
        has_flag=1
        ;;
    h)
        action=help
        has_flag=1
        ;;
    *)
        exit 1
    esac
done
shift $((OPTIND-1))

case $action in
help)
    run_help
    ;;
test)
    if test $# -ge 1 && test $# -le 2; then
        run_test "$@"
    else
        echo "Action 'test' requires either host+port or a local file!" >&2
        exit 1
    fi
    ;;
generate)
    case $has_flag-$# in
    *-0)
        echo "Missing argument. See $0 -h for help." >&2
        exit 1
        ;;
    0-1)
        echo "Did you forget -T to test?" >&2
        exit 1
        ;;
    1-1|*-2)
        ;;
    *)
        echo "Action generate takes at most two arguments!" >&2
        exit 1
    esac
    cn="$1"
    test -n "$2" && subject="$2"
    test -z "$2" && subject="/C=$country/L=$city/ST=$state/O=$organisation/\
CN=$cn/emailAddress=$email"
    if ! echo "$subject" | grep -q ^/; then
        echo "Subject does not start with '/'." >&2
        exit 1
    fi
    run_generate "$cn" "$subject"
    ;;
esac

# vim: set ts=8 sw=4 sts=4 et ai: