mirror of
https://github.com/tips-of-mine/gestion-certificats2.git
synced 2025-06-28 11:38:42 +02:00
fc3a86a839
This commit addresses several issues related to the creation of leaf certificates signed by functional scope intermediate CAs:
1. **Providing environment variables to `create_cert.sh`:**
* `CertificateController.php` was modified to extract the `ROOT_DOMAIN` from the Root CA certificate.
* The `SAN` (Subject Alternative Name) environment variable is now built dynamically (e.g., `DNS:cert_name.scope_name.root_domain`).
* The `OCSP_URL` (from the application configuration) and `SAN` environment variables are passed to the execution environment of the `create_cert.sh` script. This resolves "variable has no value" errors in OpenSSL when using the intermediate CA configuration file that references `$ENV::OCSP_URL` and `$ENV::SAN`.
2. **Explicit use of `v3_leaf` extensions:**
* The `scripts/create_cert.sh` script was modified to explicitly use `-reqexts v3_leaf` (for the CSR) and `-extensions v3_leaf` (for CA signing). This ensures that the `[v3_leaf]` section of the OpenSSL configuration file (containing SAN and OCSP directives) is correctly applied to leaf certificates.
3. **Correction of success detection in `CertificateController.php`:**
* The string searched for by `strpos` to detect a success message from `create_cert.sh` has been made more precise, ensuring that the PHP controller correctly interprets the script's result.
These changes ensure that leaf certificates are created with the correct extensions and that their creation is properly recognized by the application.
55 lines
2.3 KiB
Bash
55 lines
2.3 KiB
Bash
#!/bin/bash
|
|
|
|
# Ce script crée un certificat simple (d'entité finale) signé par le CA intermédiaire
|
|
# du périmètre fonctionnel spécifié.
|
|
# Il est appelé par l'application PHP.
|
|
|
|
# Arguments :
|
|
# $1: Nom du sous-domaine (ex: www, api) ou nom commun
|
|
# $2: Nom du périmètre fonctionnel (pour identifier le CA intermédiaire à utiliser)
|
|
|
|
SUBDOMAIN_OR_CN_NAME="$1"
|
|
FUNCTIONAL_PERIMETER_NAME="$2"
|
|
|
|
if [ -z "$SUBDOMAIN_OR_CN_NAME" ] || [ -z "$FUNCTIONAL_PERIMETER_NAME" ]; then
|
|
echo "Usage: $0 <subdomain_or_cn_name> <functional_perimeter_name>"
|
|
exit 1
|
|
fi
|
|
|
|
INTERMEDIATE_CA_DIR="/opt/tls/intermediate/$FUNCTIONAL_PERIMETER_NAME"
|
|
INTERMEDIATE_CNF="$INTERMEDIATE_CA_DIR/openssl.cnf"
|
|
|
|
# Vérifier si le CA intermédiaire existe
|
|
if [ ! -f "$INTERMEDIATE_CA_DIR/certs/intermediate.cert.pem" ]; then
|
|
echo "Erreur: Le certificat intermédiaire pour le périmètre '$FUNCTIONAL_PERIMETER_NAME' n'existe pas."
|
|
exit 1
|
|
fi
|
|
|
|
# Nom de fichier pour le nouveau certificat et sa clé
|
|
# Le nom du certificat sera au format: <subdomain_or_cn_name>.<functional_perimeter_name>.cert.pem
|
|
CERT_BASE_NAME="${SUBDOMAIN_OR_CN_NAME}.${FUNCTIONAL_PERIMETER_NAME}"
|
|
KEY_FILE="$INTERMEDIATE_CA_DIR/private/${CERT_BASE_NAME}.key.pem"
|
|
CSR_FILE="$INTERMEDIATE_CA_DIR/csr/${CERT_BASE_NAME}.csr.pem"
|
|
CERT_FILE="$INTERMEDIATE_CA_DIR/certs/${CERT_BASE_NAME}.cert.pem"
|
|
|
|
echo "Démarrage de la création du certificat '$SUBDOMAIN_OR_CN_NAME' pour le périmètre '$FUNCTIONAL_PERIMETER_NAME'..."
|
|
|
|
# Générer la clé privée pour le certificat (2048 bits, sans passphrase)
|
|
openssl genrsa -out "$KEY_FILE" 2048
|
|
chmod 400 "$KEY_FILE" # Permissions strictes
|
|
|
|
# Générer la CSR (Certificate Signing Request) pour le certificat
|
|
# Le Common Name (CN) est important pour les certificats SSL/TLS
|
|
openssl req -new -sha256 -key "$KEY_FILE" -out "$CSR_FILE" \
|
|
-subj "/C=FR/ST=Hauts-de-France/L=Roubaix/O=GestionCertif/OU=${FUNCTIONAL_PERIMETER_NAME}/CN=${SUBDOMAIN_OR_CN_NAME}.cert-gestion.local" \
|
|
-reqexts v3_leaf -config "$INTERMEDIATE_CNF" # Utilise le CNF de l'intermédiaire et ses extensions v3_leaf
|
|
|
|
# Signer la CSR avec le CA intermédiaire
|
|
openssl ca -batch -config "$INTERMEDIATE_CNF" -extensions v3_leaf -days 365 -notext -md sha256 \
|
|
-in "$CSR_FILE" \
|
|
-out "$CERT_FILE"
|
|
|
|
chmod 444 "$CERT_FILE" # Permissions en lecture seule
|
|
|
|
echo "Certificat '$CERT_BASE_NAME' créé avec succès : $CERT_FILE"
|