picoCA

#! /bin/sh

##############################################################################
# Introduction
##############################################################################

# picoCA - a minimal certificate authority
#   - simplicity is the main goal, not generality

# License: GPL 3.0 or later (https://www.gnu.org/licenses/gpl-3.0.en.html)
# Author: Jo Totland

_picoCA_usage() {
    cat << EOF
picoCA - a minimal certificate authority

Creates certificates for client, server and CA in the current directory.
A CA will be automatically created when you create first certificate.

Usage:
    picoCA create_server_cert CN [SAN]
    picoCA create_client_cert CN [SAN]
        CN = is the common name of the certificate
        SAN = comma-separated list of subject alternate names (can be omitted)
    picoCA inspect_key filename
    picoCA inspect_cert filename
    picoCA inspect_cert_bundle filename

Environment variables:
    picoCA_SUBJ: other parts of DN than CN
    picoCA_CA: name of the ca
    picoCA_DAYS: lifetime of certificate, default 100 years
(see source code for details)
EOF
}

##############################################################################
# Configuration
##############################################################################

# Change the name of the CA, if you care for it
if test -z "$picoCA_CA"; then
    picoCA_CA=picoCA
fi

# Change here, or define in shell if you want a different lifetime than 100 years
if test -z "$picoCA_DAYS"; then
    picoCA_DAYS=36500
fi

# Change here (or define in shell) if subject/DN should contain more than just CN
#picoCA_SUBJ="/O=Acme/OU=Widgets/C=no/L=Oslo/emailAddress=support@acme.com/DC=acme/DC=com"

pkey_algorithm=RSA
# pkey_options=rsa_keygen_bits:4096

##############################################################################
# End of intro
##############################################################################

make_temp_filename="mktemp -u"

# client_extensions_file=picoCA.client.ext
# server_extensions_file=picoCA.server.ext

echo_do() {
    echo "$@" 2>&1
    "$@"
}

create_server_cert() {
    if test $# -lt 1 -o $# -gt 2; then
        echo "Usage: create_server_cert CN [SAN]"
        echo "  -- where CN is the common name of your desired server certificate"
        echo "  -- and [SAN] is a comma-separated list of subject alternate names"
        return 1
    else
	create_server_extensions_file "$1.ext"
        _create_cert "$1.ext" "$@"
    fi
}

create_client_cert() {
    if test $# -lt 1 -o $# -gt 2; then
        echo "Usage: create_server_cert CN [SAN]"
        echo "  -- where CN is the common name of your desired client certificate"
        echo "  -- and [SAN] is a comma-separated list of subject alternate names"
        return 1
    else
	create_client_extensions_file "$1.ext"
        _create_cert "$1.ext" "$@"
    fi
}

_to_pkcs12() {
    if test $# -ne 1; then
        echo "Usage: _to_pkcs12 CN"
        return 1
    fi
    echo_do openssl pkcs12 -export -out "$1.pfx" -keypbe NONE -certpbe NONE -nomaciter -passout pass: -inkey "$1.key.pem" -in "$1.crt.pem" -certfile "$picoCA_CA.crt.pem"
}

_to_pkcs7() {
    if test $# -ne 1; then
        echo "Usage: _to_pkcs7 CN"
        return 1
    fi
    echo_do openssl crl2pkcs7 -nocrl -out "$1.p7b" -certfile "$1.crt.pem"
}

inspect_key() {
    if test $# -ne 1; then
        echo "Usage: inspect_key [private-key-filename]"
        return 1
    elif test -f "$1"; then
        echo_do openssl pkey -in "$1" -text -noout
    elif test -f "$1.key.pem"; then
        echo_do openssl pkey -in "$1.key.pem" -text -noout
    else
        echo "Failed to open '$1'"
        return 1
    fi
}

inspect_cert() {
    if test $# -ne 1; then
        echo "Usage: inspect_cert [certificate-filename]"
        return 1
    elif test -f "$1"; then
        echo_do openssl x509 -in "$1" -text -noout
    elif test -f "$1.crt.pem"; then
        echo_do openssl x509 -in "$1.crt.pem" -text -noout
    else
        echo "Failed to open '$1'"
        return 1
    fi
}

inspect_cert_bundle() {
    if test $# -ne 1; then
        echo "Usage: inspect_cert_bundle [cert-bundle-filename]"
        return 1
    elif test -f "$1"; then
        echo_do openssl crl2pkcs7 -nocrl -certfile "$1" \
            | echo_do openssl pkcs7 -print_certs -text -noout
    elif test -f "$1.certbundle"; then
        echo_do openssl crl2pkcs7 -nocrl -certfile "$1.certbundle" \
            | echo_do openssl pkcs7 -print_certs -text -noout
    else
        echo "Failed to open '$1'"
        return 1
    fi
}

_create_cert() {
    if test $# -lt 2 -o $# -gt 3; then
        echo "Usage: _create_cert extfile CN [SAN]"
        return 1
    else
        local extfile="$1"; shift
        local cn="$1"; shift
        if test $# -ge 1; then
            sync
            echo "subjectAltName = $1" >> $extfile
        fi
        printf "%s\n" "cat << EOF > $extfile" 1>&2
        cat "$extfile" 1>&2
        echo EOF 1>&2

        if test -f "$cn.crt.pem"; then
            echo "Certificate '$cn.crt.pem' already exists, aborting!"
            return 1
        fi
        if test -f "$cn.certbundle"; then
            echo "Certificate '$cn.certbundle' already exists, aborting!"
            return 1
        fi
        errmsg=$($make_temp_filename)
        if ! ( (test -f "$picoCA_CA.crt.pem" || _create_ca) \
	    && (test -f "$cn.key.pem" || echo_do openssl genpkey -algorithm "$pkey_algorithm" $([ -n "$pkey_options" ] && printf "%s %s" "-pkeyopt" "$pkey_options") -out "$cn.key.pem") 2> /dev/null \
            && echo_do openssl req -new -key "$cn.key.pem" -utf8 -subj "$picoCA_SUBJ/CN=$cn" -out "$cn.req" \
            && echo_do openssl x509 -req -extfile "$extfile" -in "$cn.req" -days $picoCA_DAYS --CA "$picoCA_CA.crt.pem" -CAkey "$picoCA_CA.key.pem" -CAcreateserial -out "$cn.crt.pem" 2> "$errmsg" \
            && echo "cat $cn".key.pem "$cn".crt.pem \> "$cn".key+cert.pem 2>&1 \
            && cat "$cn".key.pem "$cn".crt.pem > "$cn".key+cert.pem \
            && _to_pkcs12 "$cn" \
            && _to_pkcs7 "$cn" \
            && echo_do chmod 644 "$cn.crt.pem" "$cn.p7b")
	 then
                    echo "Error creating '$picoCA_CA.key.pem', '$picoCA_CA.crt.pem', '$cn.key' or '$cn.crt', aborting!"
                    test -f "$errmsg" && cat "$errmsg" && rm "$errmsg"
                    return 1
        fi
    fi
}

_create_ca() {
    if test $# -ne 0; then
        echo "Usage: _create_ca"
        return 1
    else
        if test -f "$picoCA_CA.crt.pem"; then
            echo "Certificate '$cn.crt.pem' already exists, aborting!"
            return 1
        fi
        if ! ( (test -f "$picoCA_CA.key.pem" || echo_do openssl genpkey -algorithm "$pkey_algorithm" $([ -n "$pkey_options" ] && printf "%s %s" "-pkeyopt" "$pkey_options") -out "$picoCA_CA.key.pem") 2> /dev/null \
            && echo_do openssl req -new -x509 -extensions v3_ca -utf8 -subj "$picoCA_SUBJ/CN=$picoCA_CA" \
            -key "$picoCA_CA.key.pem" -out "$picoCA_CA.crt.pem" \
            && echo_do chmod 644 "$picoCA_CA.crt.pem"); then
                    echo "Error creating '$picoCA_CA.key.pem' or '$picoCA_CA.crt.pem', aborting!"
                    return 1
        fi
    fi
}

create_client_extensions_file() {
    if [ ! -f "$1" ]; then
        cat << EOF > "$1"
basicConstraints = critical, CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer:always
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = critical, clientAuth
EOF
    fi
}

create_server_extensions_file() {
    if [ ! -f "$1" ]; then
        cat << EOF > "$1"
basicConstraints = critical, CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer:always
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
extendedKeyUsage = critical, serverAuth
EOF
    fi
}

_picoCA_pager() {
    if test -z "$PAGER"; then
        if command -v less > /dev/null; then
            PAGER=less
        elif command -v more > /dev/null; then
            PAGER=more
        else
            PAGER=cat
        fi
    fi
    if test -t 1; then
        "$PAGER"
    else
        cat
    fi
}

##############################################################################
# Main program
##############################################################################

if test -z "$BASH_SOURCE"; then
    if test $# -ge 1; then
        case $1 in
            inspect_key | inspect_cert | inspect_cert_bundle | \
                create_server_cert | create_client_cert )
                            if ! command -v openssl > /dev/null; then
                                echo "picoCA error: 'openssl' not in \$PATH, aborting!" \
                                    > /dev/stderr
                                exit 1
                            fi
			    echo_do umask 0077
                            "$@"
                            ;;
                        *)
                            _picoCA_usage | _picoCA_pager
                            ;;
                    esac
                else
                    _picoCA_usage | _picoCA_pager
    fi
fi