This repository has been archived by the owner on Dec 16, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathsafelocalhost.sh
executable file
·92 lines (74 loc) · 4.03 KB
/
safelocalhost.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
#!/bin/bash
# Generate a random string
PASS=$(openssl rand -base64 12)
CA_CERTIFICATES_DIR=/usr/share/ca-certificates/safelocalhost
TEMP_DIR=$PWD/temp
ROOT_KEY=$TEMP_DIR/root_key.key
ROOT_CRT=$TEMP_DIR/root_crt.crt
SERVER_CSR=$TEMP_DIR/server.csr
SERVER_KEY=$TEMP_DIR/server.key
SERVER_CRT=$TEMP_DIR/server.crt
PEM=$TEMP_DIR/public_certificate.pem
CNF_SETTINGS=$TEMP_DIR/cnf_settings.cnf
V3_SETTINGS=$TEMP_DIR/v3_settings.ext
# Directories
# ..................................................................................................................................................................
mkdir -p $TEMP_DIR
if [[ ! -e $CA_CERTIFICATES_DIR ]]; then
sudo mkdir -p $CA_CERTIFICATES_DIR
fi
# Create a new OpenSSL configuration
# ..................................................................................................................................................................
cat > $CNF_SETTINGS << EOL
[req]
default_bits=2048
prompt=no
default_md=sha256
distinguished_name=dn
days=1024
[dn]
C=VE
ST=ACME STATE
L=ACME CITY
O=ACME
OU=ACME DEV
CN=localhost
EOL
# Create a X509 v3 certificate configuration file. Notice how we’re specifying subjectAltName here.
# ..................................................................................................................................................................
cat > $V3_SETTINGS << EOL
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = *.localhost
DNS.2 = localhost
EOL
# CREATE ROOT KEY
# ..................................................................................................................................................................
openssl genpkey -aes-256-cbc -algorithm RSA -out $ROOT_KEY -pkeyopt rsa_keygen_bits:4096 -pass pass:$PASS
# CREATE PEM
# ..................................................................................................................................................................
openssl req -x509 -new -nodes -key $ROOT_KEY -sha256 -days 1024 -out $PEM -config <( cat $CNF_SETTINGS ) -passin pass:$PASS
# CREATE ROOT CRT
# ..................................................................................................................................................................
openssl x509 -in $PEM -inform PEM -out $ROOT_CRT
# MOVE ROOT CRT TO CERTIFICATES_HOME
# ..................................................................................................................................................................
sudo cp $ROOT_CRT $CA_CERTIFICATES_DIR
# INSTALL ROOT CRT
# ..................................................................................................................................................................
sudo update-ca-certificates
# ..................................................................................................................................................................
#
# Server Client
#
# ..................................................................................................................................................................
# Create a certificate key for localhost.
# ..................................................................................................................................................................
openssl req -new -sha256 -nodes -out $SERVER_CSR -newkey rsa:2048 -keyout $SERVER_KEY -config <( cat $CNF_SETTINGS )
# A certificate signing request is issued via the root SSL certificate we created earlier to create a domain certificate for localhost. The output is a certificate file called server.crt.
# ..................................................................................................................................................................
openssl x509 -req -in $SERVER_CSR -CA $PEM -CAkey $ROOT_KEY -CAcreateserial -out $SERVER_CRT -days 500 -sha256 -extfile $V3_SETTINGS -passin pass:$PASS