mirror of
https://github.com/tips-of-mine/gestion-certificats2.git
synced 2025-06-28 01:18:42 +02:00
d4516e87ae
1. **`intermediate_cert_name` unique constraint violation**:
When creating a perimeter, the intermediate certificate name (`intermediate_cert_name`) stored in the `functional_perimeters` table was always `"intermediate.cert.pem"`. This caused a duplicate error if a unique constraint existed on this column.
* Fixed in `PerimeterController.php` by using `$perimeterName . "_intermediate.cert.pem"` as the value for `intermediate_cert_name`, ensuring uniqueness. The physical file name remains `intermediate.cert.pem` in the perimeter's subdirectory.
2. **`Undefined variable $userRole` warning**:
On the page listing perimeters (`app/src/Views/perimeters/index.php`), the `$userRole` variable was not defined by the controller.
* Fixed in `PerimeterController.php` (method `index()`) by initializing `$userRole = $this->authService->getUserRole();`.
3. **SQL error `Unknown column 'common_name'` during initialization**:
During the application initialization process (if no user or root certificate exists), an attempt to insert into the `certificates` table included a `common_name` column that does not exist.
* Fixed in `app/public/index.php` by removing the `common_name` column and its value from the insert query for the root certificate.
These corrections improve the robustness of perimeter creation and make the application initialization process more reliable.
54 lines
2.0 KiB
Bash
54 lines
2.0 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
# Ce script crée le certificat Root CA (Certificate Authority) auto-signé.
|
|
# Il est destiné à être exécuté une seule fois, au premier lancement de l'application.
|
|
|
|
# Récupérer le domaine racine depuis le premier argument
|
|
ROOT_DOMAIN=$1
|
|
|
|
# Vérifier si ROOT_DOMAIN est fourni
|
|
if [ -z "$ROOT_DOMAIN" ]; then
|
|
echo "Erreur: Le domaine racine (ROOT_DOMAIN) doit être fourni en argument."
|
|
echo "Usage: $0 <votredomaine.com>"
|
|
exit 1
|
|
fi
|
|
|
|
ROOT_CA_DIR="/opt/tls/root"
|
|
ROOT_KEY="$ROOT_CA_DIR/private/ca.key.pem"
|
|
ROOT_CERT="$ROOT_CA_DIR/certs/ca.cert.pem"
|
|
ROOT_CNF="$ROOT_CA_DIR/openssl.cnf"
|
|
|
|
echo "Démarrage de la création du certificat Root CA dans $ROOT_CA_DIR..."
|
|
|
|
# Créer les dossiers nécessaires pour la PKI Root
|
|
mkdir -p "$ROOT_CA_DIR/certs" "$ROOT_CA_DIR/crl" "$ROOT_CA_DIR/newcerts" "$ROOT_CA_DIR/private" "$ROOT_CA_DIR/csr"
|
|
|
|
chmod 777 "$ROOT_CA_DIR/certs" "$ROOT_CA_DIR/crl" "$ROOT_CA_DIR/newcerts" "$ROOT_CA_DIR/private" "$ROOT_CA_DIR/csr"
|
|
|
|
# Copier le fichier de configuration OpenSSL pour la CA Racine
|
|
cp /opt/scripts/configs/root-openssl.conf "$ROOT_CNF"
|
|
|
|
# Initialiser les fichiers requis par OpenSSL pour une CA
|
|
touch "$ROOT_CA_DIR/index.txt"
|
|
chmod 666 "$ROOT_CA_DIR/index.txt"
|
|
|
|
echo 1000 > "$ROOT_CA_DIR/serial" # Numéro de série initial pour les certificats
|
|
chmod 666 "$ROOT_CA_DIR/serial"
|
|
echo 1000 > "$ROOT_CA_DIR/crlnumber" # Numéro de série initial pour la CRL
|
|
|
|
# Générer la clé privée du Root CA (2048 bits, sans passphrase pour la simplicité)
|
|
openssl genrsa -out "$ROOT_KEY" 4096
|
|
|
|
#
|
|
chmod 400 "$ROOT_KEY" # Permissions strictes pour la clé privée
|
|
|
|
# Générer le certificat Root CA auto-signé
|
|
openssl req -x509 -new -nodes -key "$ROOT_KEY" -sha256 -days 3650 -out "$ROOT_CERT" \
|
|
-subj "/C=FR/ST=NORD/L=ROUBAIX/O=IT/OU=IT/emailAddress=sec@tips-mine.com/CN=ca.$ROOT_DOMAIN/" \
|
|
-config "$ROOT_CNF" -extensions v3_ca
|
|
|
|
chmod 444 "$ROOT_CERT" # Permissions en lecture seule pour le certificat
|
|
|
|
echo "Certificat Root CA créé avec succès : $ROOT_CERT"
|