32 lines
1.0 KiB
Bash
32 lines
1.0 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
SSL_DIR="${SSL_DIR:-/ssl}"
|
|
cd "$SSL_DIR"
|
|
|
|
openssl genrsa -out ca.key 4096
|
|
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
|
|
-subj "/CN=PMI Test CA" -out ca.crt
|
|
|
|
openssl genrsa -out server.key 2048
|
|
openssl req -new -key server.key -subj "/CN=nginx-test" -out server.csr
|
|
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
|
|
-out server.crt -days 825 -sha256
|
|
|
|
openssl genrsa -out client.key 2048
|
|
openssl req -new -key client.key -subj "/CN=trusted-client" -out client.csr
|
|
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
|
|
-out client.crt -days 825 -sha256
|
|
|
|
openssl genrsa -out untrusted.key 2048
|
|
openssl req -x509 -new -nodes -key untrusted.key -sha256 -days 365 \
|
|
-subj "/CN=untrusted-client" -out untrusted.crt
|
|
|
|
chmod 600 ca.key server.key client.key untrusted.key
|
|
chmod 644 ca.crt server.crt client.crt untrusted.crt
|
|
cat server.crt ca.crt > fullchain.crt
|
|
chmod 644 fullchain.crt
|
|
rm -f server.csr client.csr ca.srl
|
|
|
|
echo "Certificates generated in $SSL_DIR"
|