gen

#!/bin/bash

set -x
rm -f *.pem
rm -f *.csr
rm -f *.srl
rm -rf cert

export CAPATH=.
export SERVERPATH=.
export CLIENTPATH=.

export PHRASEPASS=123456
export COUNTRY=CN
export STATE=BeiJing
export CITY=BeiJing
export COMPANY=OpenSource
export COMPANY_UNIT=RMD
export CAEMAIL="rmd@intel.com"

export SERVERCN=$HOSTNAME
export CLIENTCN=Admin
export COMMON_NAME=$HOSTNAME
export SAN_DNS=`cat "/etc/resolv.conf" | grep search | sed -e "s/search /DNS:/g"`
echo "get SAN_DNS: $SAN_DNS"

echo "Config CA"
# ./cmd/gen_ca

{
/usr/bin/expect << EOF
spawn openssl genrsa -aes256 -out $CAPATH/ca-key.pem 4096
expect {
 "*pass phrase*:" { send "$PHRASEPASS\r" }
}
expect {
 "*Verifying*pass phrase *:" { send "$PHRASEPASS\r" }
}
expect eof
EOF
}
# remove key password.
# openssl rsa -in ca-key.pem -out ca-key.pem

{
/usr/bin/expect << EOF
spawn openssl rsa -noout -text -in $CAPATH/ca-key.pem
expect {
 "*Enter pass phrase for*" { send "$PHRASEPASS\r" }
}
expect eof
EOF
}

{
/usr/bin/expect << EOF
spawn openssl req -new -x509 -days 365 -key $CAPATH/ca-key.pem -sha256 -out $CAPATH/ca.pem
expect "*pass phrase*:"
send "$PHRASEPASS\r"
expect "*Country Name*:"
send "$COUNTRY\r"
expect "*State or Province Name*:"
send "$STATE\r"
expect "*Locality Name*:"
send "$CITY\r"
expect "*Organization Name*:"
send "$COMPANY\r"
expect "*Organizational Unit Name*:"
send "$COMPANY_UNIT\r"
expect "*Common Name*:"
send "$COMMON_NAME\r"
expect "*Email Address*"
send "$CAEMAIL\r\n"
expect eof
EOF
}
openssl x509 -noout -text -in $CAPATH/ca.pem

echo "Config Server"
openssl genrsa -out $SERVERPATH/rmd-key.pem 4096
echo "generate Server CSR"
openssl req -subj "/CN=$SERVERCN" -sha256 -new -key $SERVERPATH/rmd-key.pem -out $SERVERPATH/rmd.csr
openssl req -noout -text -in $SERVERPATH/rmd.csr

echo "generate Server Cert"
echo "subjectAltName = $SAN_DNS,IP:127.0.0.1" > $SERVERPATH/extfile.cnf
echo extendedKeyUsage = serverAuth >> extfile.cnf
{
/usr/bin/expect << EOF
spawn openssl x509 -req -days 365 -sha256 -in rmd.csr -CA $CAPATH/ca.pem -CAkey $CAPATH/ca-key.pem \
                   -CAcreateserial -out $SERVERPATH/rmd-cert.pem -extfile $SERVERPATH/extfile.cnf
expect "*pass phrase*"
send "$PHRASEPASS\r"
expect eof
EOF
}
openssl x509 -noout -text -in $SERVERPATH/rmd-cert.pem
openssl verify -CAfile $CAPATH/ca.pem $SERVERPATH/rmd-cert.pem

# client
echo "Config Client"
openssl genrsa -out key.pem 4096
openssl req -subj "/CN=$CLIENTCN" -new -key key.pem -out client.csr
openssl req -noout -text -in client.csr
echo "extendedKeyUsage = clientAuth" > extfile.cnf

{
/usr/bin/expect << EOF
spawn openssl x509 -req -days 365 -sha256 -in client.csr -CA $CAPATH/ca.pem -CAkey $CAPATH/ca-key.pem \
                  -CAcreateserial -out $CLIENTPATH/cert.pem -extfile $CLIENTPATH/extfile.cnf
expect "*pass phrase*"
send "$PHRASEPASS\r"
expect eof
EOF
}
openssl x509 -noout -text -in $CLIENTPATH/cert.pem
openssl verify -CAfile $CAPATH/ca.pem $CLIENTPATH/cert.pem

# other
rm -v client.csr rmd.csr
chmod -v 0400 ca-key.pem key.pem rmd-key.pem
chmod -v 0444 ca.pem rmd-cert.pem cert.pem

CAPATH=cert/ca
SERVERPATH=cert/server
CLIENTPATH=cert/client
mkdir -p $CAPATH
mkdir -p $SERVERPATH
mkdir -p $CLIENTPATH

mv rmd-cert.pem rmd-key.pem $SERVERPATH
cp ca.pem $SERVERPATH
mv cert.pem key.pem $CLIENTPATH
cp ca.pem $CLIENTPATH
mv ca-key.pem ca.pem $CAPATH

# Set a unused random port
CHECK="do while"

while [[ ! -z $CHECK ]]; do
    PORT=$(( ( RANDOM % 60000 )  + 1025 ))
    CHECK=$(sudo netstat -ap | grep $PORT)
done

sudo openssl s_server -debug -msg -Verify 2 -accept $PORT -CAfile $CAPATH/ca.pem -cert $SERVERPATH/rmd-cert.pem -key $SERVERPATH/rmd-key.pem -www &
sleep 1
openssl s_client -CAfile $CAPATH/ca.pem -cert $CLIENTPATH/cert.pem -key $CLIENTPATH/key.pem -connect localhost:$PORT </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > server-cert.pem
openssl x509 -noout -text -in server-cert.pem
rm server-cert.pem

echo "*************************************************************"
echo "handshake_failure should error"
openssl s_client -CAfile $CAPATH/ca.pem -cert cert.crt -key private.key -connect localhost:$PORT </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > server-cert.pem
# openssl s_client -CAfile $CAPATH/ca.pem -connect localhost:$PORT </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > server-cert.pem

which go
if [ $? -eq 0 ]; then
    echo "--------------------------------------------------"
    echo "Support Golang env."
    go run cmd/verify_cert.go -ca $CAPATH/ca.pem -cert $CLIENTPATH/cert.pem  -dns $CLIENTCN
    go run cmd/verify_cert.go -ca $CAPATH/ca.pem -cert $SERVERPATH/rmd-cert.pem  -dns ${SAN_DNS#DNS:}
fi