mirror of
https://github.com/tips-of-mine/gestion-certificats2.git
synced 2025-06-28 10:28:42 +02:00
Update create_intermediate_cert.sh
This commit is contained in:
tips-of-mine
@ -33,86 +33,21 @@ echo "Démarrage de la création du certificat Intermédiaire pour '$FUNCTIONAL_
|
||||
mkdir -p "$INTERMEDIATE_CA_DIR/certs" "$INTERMEDIATE_CA_DIR/crl" "$INTERMEDIATE_CA_DIR/newcerts" "$INTERMEDIATE_CA_DIR/private" "$INTERMEDIATE_CA_DIR/csr"
|
||||
|
||||
# Initialiser les fichiers requis par OpenSSL pour une CA intermédiaire
|
||||
chmod 700 "$INTERMEDIATE_CA_DIR/private"
|
||||
touch "$INTERMEDIATE_CA_DIR/index.txt"
|
||||
|
||||
#
|
||||
echo 1000 > "$INTERMEDIATE_CA_DIR/serial"
|
||||
echo 1000 > "$INTERMEDIATE_CA_DIR/crlnumber"
|
||||
|
||||
# Créer le fichier openssl.cnf pour le CA Intermédiaire
|
||||
cat <<EOF > "$INTERMEDIATE_CNF"
|
||||
[ ca ]
|
||||
default_ca = CA_default
|
||||
|
||||
[ CA_default ]
|
||||
dir = $INTERMEDIATE_CA_DIR
|
||||
certs = \$dir/certs
|
||||
crl_dir = \$dir/crl
|
||||
database = \$dir/index.txt
|
||||
new_certs_dir = \$dir/newcerts
|
||||
|
||||
certificate = \$dir/certs/intermediate.cert.pem
|
||||
serial = \$dir/serial
|
||||
crlnumber = \$dir/crlnumber
|
||||
crl = \$dir/crl.pem
|
||||
private_key = \$dir/private/intermediate.key.pem
|
||||
RANDFILE = \$dir/private/.rand
|
||||
|
||||
x509_extensions = usr_cert
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
default_days = 1825 # Durée de validité par défaut (5 ans)
|
||||
default_crl_days = 30
|
||||
default_md = sha256
|
||||
preserve = no
|
||||
|
||||
policy = policy_loose # Politique plus souple pour les CA intermédiaires
|
||||
|
||||
[ policy_strict ]
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ policy_loose ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ usr_cert ]
|
||||
# Extensions pour les certificats d'entité finale (signés par cette CA intermédiaire)
|
||||
basicConstraints = CA:FALSE
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
subjectAltName = @alt_names
|
||||
extendedKeyUsage = clientAuth,serverAuth
|
||||
# Ajout de l'URL OCSP
|
||||
authorityInfoAccess = OCSP;URI:http://ocsp.cert-gestion.local/ # TODO: Remplacez par votre vrai nom de domaine OCSP
|
||||
|
||||
[ v3_intermediate_ca ]
|
||||
# Extensions pour le certificat CA intermédiaire lui-même
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer
|
||||
basicConstraints = critical, CA:true, pathlen:0 # pathlen:0 signifie qu'elle ne peut signer que des certificats finaux
|
||||
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
|
||||
|
||||
[ alt_names ]
|
||||
# Exemple d'alt_names, à adapter si nécessaire
|
||||
DNS.1 = *.${FUNCTIONAL_PERIMETER_NAME}.local
|
||||
DNS.2 = ${FUNCTIONAL_PERIMETER_NAME}.local
|
||||
|
||||
EOF
|
||||
#
|
||||
touch "$INTERMEDIATE_CA_DIR/certs.db"
|
||||
|
||||
# Générer la clé privée de l'Intermédiaire CA (avec ou sans passphrase)
|
||||
if [ -n "$INTERMEDIATE_KEY_PASSPHRASE" ]; then
|
||||
openssl genrsa -aes256 -passout pass:"$INTERMEDIATE_KEY_PASSPHRASE" -out "$INTERMEDIATE_KEY" 2048
|
||||
openssl genrsa -aes256 -passout pass:"$INTERMEDIATE_KEY_PASSPHRASE" -out "$INTERMEDIATE_KEY" 4096
|
||||
else
|
||||
openssl genrsa -out "$INTERMEDIATE_KEY" 2048
|
||||
openssl genrsa -out "$INTERMEDIATE_KEY" 4096
|
||||
fi
|
||||
chmod 400 "$INTERMEDIATE_KEY"
|
||||
|
||||
@ -120,11 +55,11 @@ chmod 400 "$INTERMEDIATE_KEY"
|
||||
openssl req -new -sha256 \
|
||||
-key "$INTERMEDIATE_KEY" $([ -n "$INTERMEDIATE_KEY_PASSPHRASE" ] && echo "-passin pass:\"$INTERMEDIATE_KEY_PASSPHRASE\"") \
|
||||
-out "$INTERMEDIATE_CSR" \
|
||||
-subj "/C=FR/ST=Hauts-de-France/L=Roubaix/O=GestionCertif/OU=$FUNCTIONAL_PERIMETER_NAME/CN=GestionCertif $FUNCTIONAL_PERIMETER_NAME Intermediate CA" \
|
||||
-subj "/C=FR/ST=NORD/L=ROUBAIX/O=IT/OU=IT/emailAddress=sec@tips-mine.com/CN=intermediate-cert.$ROOT_DOMAIN/" \
|
||||
-config "$INTERMEDIATE_CNF" # Utilise le CNF de l'intermédiaire pour la création de la CSR
|
||||
|
||||
# Signer la CSR de l'Intermédiaire avec le Root CA
|
||||
openssl ca -batch -config "$ROOT_CNF" -extensions v3_intermediate_ca -days 1825 -notext -md sha256 \
|
||||
openssl ca -batch -config "$ROOT_CNF" -extensions v3_intermediate_ca -days 3650 -notext -md sha256 \
|
||||
-in "$INTERMEDIATE_CSR" \
|
||||
-out "$INTERMEDIATE_CERT"
|
||||
|
||||
@ -132,5 +67,19 @@ chmod 444 "$INTERMEDIATE_CERT"
|
||||
|
||||
# Créer le fichier de chaîne de certificats (Intermediate + Root)
|
||||
cat "$INTERMEDIATE_CERT" "$ROOT_CERT" > "$INTERMEDIATE_CHAIN"
|
||||
chmod 444 "$INTERMEDIATE_CHAIN"
|
||||
|
||||
# Create a Certificate revocation list of the intermediate CA
|
||||
openssl ca -config "$INTERMEDIATE_CNF" -gencrl -out "$INTERMEDIATE_CNF/crl/intermediate.crl.pem"
|
||||
|
||||
# Create OSCP key pair
|
||||
openssl genrsa -out "$INTERMEDIATE_CNF/private/ocsp.key.pem" 4096
|
||||
|
||||
# Create the OSCP CSR
|
||||
openssl req -new -sha256 \
|
||||
-key "$INTERMEDIATE_CA_DIR/private/ocsp.key.pem" \
|
||||
-out "$INTERMEDIATE_CNF/crl/intermediate.crl.pem" -nodes \
|
||||
-subj "/C=FR/ST=NORD/L=ROUBAIX/O=IT/OU=IT/emailAddress=sec@tips-mine.com/CN=ocsp-cert.$ROOT_DOMAIN/"\
|
||||
-config "$INTERMEDIATE_CNF"
|
||||
|
||||
echo "Certificat Intermédiaire CA pour '$FUNCTIONAL_PERIMETER_NAME' créé : $INTERMEDIATE_CERT"
|
||||
|
||||
Reference in New Issue
Block a user