-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathMakefile
119 lines (107 loc) · 3.58 KB
/
Makefile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
SHELL := bash
CONFIG := $(PWD)/config.sh
CFSSL := bin/cfssl
JSON := bin/cfssljson
CFSSL_URL := $(shell curl -s https://api.github.com/repos/cloudflare/cfssl/releases/latest | jq -r '.assets[].browser_download_url | select(contains("/cfssl_")) | select(endswith("linux_amd64"))')
CFSSLJSON_URL := $(shell curl -s https://api.github.com/repos/cloudflare/cfssl/releases/latest | jq -r '.assets[].browser_download_url | select(contains("/cfssljson_")) | select(endswith("linux_amd64"))')
all: clean cfssl ca client server
certs: client server
cfssl:
rm -f $(CFSSL) $(JSON)
curl -L -o $(CFSSL) $(CFSSL_URL) && chmod 755 $(CFSSL)
curl -L -o $(JSON) $(CFSSLJSON_URL) && chmod 755 $(JSON)
root_ca:
mkdir -p certs
$(CFSSL) gencert -initca config/ca_root-config.json | $(JSON) -bare certs/ca_root
int_ca:
$(CFSSL) gencert -initca config/ca_int-config.json | $(JSON) -bare certs/ca_int
$(CFSSL) sign \
-ca certs/ca_root.pem \
-ca-key certs/ca_root-key.pem \
-config config/signing-profiles.json \
-profile intermediate \
certs/ca_int.csr | $(JSON) -bare certs/ca_int
cat certs/ca_int.pem certs/ca_root.pem > certs/bundle_ca.pem
ca: root_ca int_ca
client:
source $(CONFIG); \
for i in "$${!CLIENTS[@]}"; do \
echo "GENERATING CLIENTS: $${i}"; \
sed "s/PLACEHOLDER/$${i}/" config/csr-generic.json | \
$(CFSSL) gencert \
-ca certs/ca_int.pem \
-ca-key certs/ca_int-key.pem \
-config config/signing-profiles.json \
-profile client \
-hostname "$${CLIENTS[$$i]}" \
- \
| $(JSON) -bare certs/client_$${i}; \
cat certs/client_$${i}.pem certs/ca_int.pem > certs/client_$${i}-chain.pem; \
openssl pkcs8 \
-in certs/client_$${i}-key.pem \
-topk8 \
-nocrypt \
-out certs/client_$${i}-key.pk8.pem; \
done
client-signedbyroot:
source $(CONFIG); \
for i in "$${!CLIENTS[@]}"; do \
echo "GENERATING CLIENTS: $${i}"; \
sed "s/PLACEHOLDER/$${i}/" config/csr-generic.json | \
$(CFSSL) gencert \
-ca certs/ca_root.pem \
-ca-key certs/ca_root-key.pem \
-config config/signing-profiles.json \
-profile client \
-hostname "$${CLIENTS[$$i]}" \
- \
| $(JSON) -bare certs/client_$${i}; \
cat certs/client_$${i}.pem certs/ca_root.pem > certs/client_$${i}-chain.pem; \
openssl pkcs8 \
-in certs/client_$${i}-key.pem \
-topk8 \
-nocrypt \
-out certs/client_$${i}-key.pk8.pem; \
done
server:
source $(CONFIG); \
for i in "$${!SERVERS[@]}"; do \
echo "GENERATING SERVER: $${i}"; \
sed "s/PLACEHOLDER/$${i}/" config/csr-generic.json | \
$(CFSSL) gencert \
-ca certs/ca_int.pem \
-ca-key certs/ca_int-key.pem \
-config config/signing-profiles.json \
-profile server \
-hostname "$${SERVERS[$$i]}" \
- \
| $(JSON) -bare certs/server_$${i}; \
cat certs/server_$${i}.pem certs/ca_int.pem > certs/server_$${i}-chain.pem; \
openssl pkcs8 \
-in certs/server_$${i}-key.pem \
-topk8 \
-nocrypt \
-out certs/server_$${i}-key.pk8.pem; \
done
server-signedbyroot:
source $(CONFIG); \
for i in "$${!SERVERS[@]}"; do \
echo "GENERATING SERVER: $${i}"; \
sed "s/PLACEHOLDER/$${i}/" config/csr-generic.json | \
$(CFSSL) gencert \
-ca certs/ca_root.pem \
-ca-key certs/ca_root-key.pem \
-config config/signing-profiles.json \
-profile server \
-hostname "$${SERVERS[$$i]}" \
- \
| $(JSON) -bare certs/server_$${i}; \
cat certs/server_$${i}.pem certs/ca_root.pem > certs/server_$${i}-chain.pem; \
openssl pkcs8 \
-in certs/server_$${i}-key.pem \
-topk8 \
-nocrypt \
-out certs/server_$${i}-key.pk8.pem; \
done
clean:
rm -f ${PWD}/certs/*.csr ${PWD}/certs/*.pem ${PWD}/certs/*.pk8