-
Notifications
You must be signed in to change notification settings - Fork 4
/
Copy pathcert-authority-manager.sh
121 lines (95 loc) · 4.8 KB
/
cert-authority-manager.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
#!/bin/bash
# ++ +++ +++++++ # ++++++++ +++++++ # ++++++ +++++++++ # ++++++++++ # ++++++ +++++++ ++ #
# ++ --- ------- # -------- ------- # ------ --------- # ---------- # ------ ------- ++ #
# ++ ++ #
# ++ Set up both an on-premises (root) and an AWS Certificate Manager (subordinate) ++ #
# ++ certificate authority. The former signs the CSR of the latter and the new plus ++ #
# ++ chain certificates are imported thus activating the AWS subordinate CA. ++ #
# ++ ++ #
# ++ --- ------- # -------- ------- # ------ --------- # ---------- # ------ ------- ++ #
# ++ +++ +++++++ # ++++++++ +++++++ # ++++++ +++++++++ # ++++++++++ # ++++++ +++++++ ++ #
echo "" ; echo "" ;
echo "### ################################################# ###"
echo "### Config JSON for Creating an AWS CM Subordinate CA ###"
echo "### ################################################# ###"
echo ""
while read line
do
fileline=`eval echo "$line"`
echo "$fileline" >> "subordinate-ca-config.json"
done < "subordinate-ca-template.json"
jq '.' subordinate-ca-config.json
echo ""
echo "### ####################################################### ###"
echo "### Create AWS Cert Manager Subordinate CA and Download CSR ###"
echo "### ####################################################### ###"
echo ""
SUBORDINATE_CA_ARN=`aws acm-pca create-certificate-authority \
--certificate-authority-configuration file://$PWD/subordinate-ca-config.json \
--certificate-authority-type "SUBORDINATE" \
--idempotency-token $(date +"%y%j%H%M") | jq -r '.CertificateAuthorityArn'`
echo ""
echo "AWS Certificate Manager Subordinate CA created."
echo "Subordinate CA Name => $SUBORDINATE_CA_CN"
echo "Subordinate CA ARN => $SUBORDINATE_CA_ARN"
echo ""
echo ""
echo "### ######################################################### ###"
echo "### Download the Certificate Signing Request when it is ready ###"
echo "### ######################################################### ###"
echo ""
aws acm-pca wait certificate-authority-csr-created \
--certificate-authority-arn $SUBORDINATE_CA_ARN
aws acm-pca describe-certificate-authority \
--certificate-authority-arn $SUBORDINATE_CA_ARN
aws acm-pca get-certificate-authority-csr \
--certificate-authority-arn $SUBORDINATE_CA_ARN \
--output text \
> /root/cert.directory/$SUBORDINATE_CA_CN-subordinate-ca-csr.pem
echo ""
echo "### #####################################################b################# ###"
echo "### Create On-Premises Root CA, Sign CSR of Subordinate CA and Import Certs ###"
echo "### #####################################################b################# ###"
echo ""
openssl genrsa -out /root/cert.directory/$ON_PREMISES_CA_CN-on-premises-ca-key.pem 8192
chmod 400 /root/cert.directory/$ON_PREMISES_CA_CN-on-premises-ca-key.pem
openssl req \
-key /root/cert.directory/$ON_PREMISES_CA_CN-on-premises-ca-key.pem \
-out /root/cert.directory/$ON_PREMISES_CA_CN-on-premises-ca-cert.pem \
-new \
-x509 \
-days 7300 \
-sha256 \
-extensions v3_ca \
-config openssl-directives.cnf \
-subj "/C=$COUNTRY_CODE/ST=$PROVINCE/L=$LOCALITY/O=$ORG_NAME/OU=$ORG_UNIT/CN=$ON_PREMISES_CA_CN" ;
chmod 444 /root/cert.directory/$ON_PREMISES_CA_CN-on-premises-ca-cert.pem
echo "openssl x509 -noout -text -in $ON_PREMISES_CA_CN-on-premises-ca-cert.pem"
openssl ca \
-config openssl-directives.cnf \
-extensions v3_intermediate_ca \
-outdir /root/cert.directory \
-days 3650 \
-notext \
-batch \
-md sha256 \
-keyfile /root/cert.directory/$ON_PREMISES_CA_CN-on-premises-ca-key.pem \
-cert /root/cert.directory/$ON_PREMISES_CA_CN-on-premises-ca-cert.pem \
-in /root/cert.directory/$SUBORDINATE_CA_CN-subordinate-ca-csr.pem \
-out /root/cert.directory/$SUBORDINATE_CA_CN-subordinate-ca-cert.pem \
2>/dev/null ;
echo "openssl x509 -noout -text -in $SUBORDINATE_CA_CN-subordinate-ca-cert.pem"
openssl verify \
-CAfile /root/cert.directory/$ON_PREMISES_CA_CN-on-premises-ca-cert.pem \
/root/cert.directory/$SUBORDINATE_CA_CN-subordinate-ca-cert.pem
aws acm-pca import-certificate-authority-certificate \
--certificate-authority-arn $SUBORDINATE_CA_ARN \
--certificate file:///root/cert.directory/$SUBORDINATE_CA_CN-subordinate-ca-cert.pem \
--certificate-chain file:///root/cert.directory/$ON_PREMISES_CA_CN-on-premises-ca-cert.pem
echo ""
echo "### ############################################# ###"
echo "### SSL PEM Certificates and Key Collateral Files ###"
echo "### ############################################# ###"
echo ""
ls -lah; echo ""; ls -lah /root/cert.directory ; echo "" ;
exit 0