easycert

#!/bin/sh
# easycert (part of ossobv/vcutil) // wdoekes/2012-2016 // Public Domain
#
# Wrapper around openssl to create basic KEY+CSR pairs for submittal to
# a certificate authority.
#
# Also features a small test mode. And usable as CGI script.
#
# Usage:
#
#     # Create two files:
#     # -rw-rw-r-- my_example_com-2014.csr
#     # -rw------- my_example_com-2014.key
#     easycert -c UK -l London -s London -o MyCompany -e my@example.com \
#         my.example.com
#
#     # Or, an alternate notation:
#     # -rw-rw-r-- STAR_example_com-2014.csr
#     # -rw------- STAR_example_com-2014.key
#     easycert '*.example.com' \
#         '/C=UK/L=London/ST=State/O=MyCompany/CN=*.example.com/'
#
#     # Test if the certificate chain is in the right order:
#     #  0 s:/OU=Domain .../OU=PositiveSSL Wildcard/CN=*.osso.nl
#     #    i:/C=GB/ST=Greater .../L=Salford/O=COMODO/CN=PositiveSSL CA 2
#     #  1 s:/C=GB/ST=Greater .../L=Salford/O=COMODO/CN=PositiveSSL CA 2
#          i:/C=SE/O=AddTrust AB/OU=AddTrust .../CN=AddTrust External CA Root
#     easycert -T www.osso.nl 443
#
# When run as CGI service, it displays input boxes for the options
# and writes the output to CERTHOME.
#

# defaults
country=NL
city=Groningen
state=Groningen
organisation="OSSO B.V."
email="info@osso.nl"

# cgi config
CERTHOME=/srv/easycert

openssl_connect() {
    host="$1"; shift
    port="$1"; shift
    openssl s_client -connect "$host:$port" -servername "$host" "$@"
}

run_help() {
    echo "Usage: $0 -c NL -l Groningen -o OSSO\ B.V. -e info@osso.nl osso.nl"
    echo "Usage: $0 osso.nl \"/C=NL/L=Groningen/ST=Groningen/\
O=OSSO B.V./CN=osso.nl/\""
    echo "Usage: $0 -T www.osso.nl"
}

run_test() {
    show_certchain "$@"
    echo "Expires in `get_expiry "$@"` days"
}

show_certchain() {
    host="$1"
    port="$2"
    echo "The list below should be logically ordered,"
    echo "and end with a self-signed root certificate."
    echo "(Although the last one is optional and only "
    echo "overhead.)"
    echo
    output="`openssl_connect $host $port </dev/null 2>&0 |
        sed -e '/^Certificate chain/,/^---/!d'`"
    if test -z "$output"; then
        openssl_connect $host $port </dev/null
        exit 1
    fi
    echo "$output"
}

get_expiry() {
    host="$1"
    port="$2"
    certinfo=`openssl_connect $host $port -showcerts </dev/null 2>/dev/null |
        openssl x509 -text`
    sigalgo=`echo "$certinfo" |
             sed -n 's/^ *Signature Algorithm: \([^ ]*\).*/\1/p' | head -n1`
    if test "$sigalgo" = "sha1WithRSAEncryption"; then
        echo "WARNING: Uses old SHA-1 hash" >&2
    fi
    cn=`echo "$certinfo" | sed -e '/Subject.*CN=/!d;s/.*CN=\([^/]*\).*/\1/'`
    date=`echo "$certinfo" | sed -e '/^ *Not After :/!d;s/^[^:]*: *//'`
    if test "$host" = "$cn"; then
        :
    elif test "*.$host" = "$cn"; then
        :
    elif test "$host" = "www.$cn"; then
        :
    elif echo "$host" | grep -q `echo $cn | sed -e 's/\./\\./g;s/*/.*/;s/^/^/;s/$/$/'`; then
        :
    else
        echo "($host!=$cn)"
    fi
    echo $(( (`date -d "$date" +%s` - `date +%s`) / 86400 ))  # days
}

run_generate() {
    cn="$1"
    subject="$2"
    dst="`echo "$cn" | tr . _ | sed -e 's/\*/STAR/g'`-`date +%Y`"

    if test -f "$dst.key" -o \
            -f "$dst.csr" -o \
            -f "$dst.crt"; then
        echo "Files starting with $dst.* exist already:" >&2
        ls "$dst."* | sed -e 's/^/  /' >&2
        exit 1
    fi

    if test -t 0; then
        echo "Subject: $subject"
        echo -n 'Enter to proceed (or ^C to abort to change parameters)...'
        read yes
    fi

    # Generate new private key.
    old_umask=`umask`
    umask 0077
    openssl genrsa -out "$dst.key" 4096 >&2
    umask $old_umask

    # Generate new csr. No need to pass -sha256 here (during the move
    # from sha1 in 2014). The CSR is signed with sha256 by default
    # anyway (openssl 1.0.1f). And it usually doesn't have any effect on
    # the CA's signing of the CRT.
    openssl req -new -key "$dst.key" -out "$dst.csr" -subj "$subject" \
                -batch >&2

    echo "$dst.csr"
}

cgi_get() {
    cat <<__EOF__
    <form method="POST" action="$0">
        <input name="cn" value="Domain without www..."/>
          Common Name (domain.tld or *.domain.tld for wildcard)<br/>
        <input name="organisation" value="$organisation"/> Company<br/>
        <input name="email" value="$email"/> E-mail<br/>
        <input name="city" value="$city"/> City<br/>
        <input name="state" value="$state"/> State<br/>
        <input name="country" value="$country"/> Country<br/>
        <input type="submit"/>
    </form>
__EOF__
}

cgi_post() {
    eval "`cat | python -c 'import urlparse
for k,v in urlparse.parse_qs(raw_input()).items():
    if k in ("cn","organisation","email","city","state","country"):
        print "%s='\''%s'\''" % (k,v[0].replace("\\"","").replace("/","")
                                   .replace(",",";").replace("'\''",""))'`"
    # "`"`" # vim.. break out of syntax fun
    if test -n "$cn" -o -n "$organisation" -o -n "$email" -o \
            -n "$city" -o -n "$state" -o -n "$country"; then
        echo "Invalid arguments...<br/>"
        exit 0
    fi
    echo "Generating in ${CERTHOME}...<br/>"
    if ! test -d "$CERTHOME"; then
        echo "Cannot chdir to ${CERTHOME}...<br/>"
        exit 0
    fi
    cd "$CERTHOME"
    subject="/C=$country/L=$city/ST=$state/O=$organisation/CN=$cn/\
emailAddress=$email"
    file="`run_generate "$cn" "$subject" </dev/null 2>&0`"
    if test $? != 0; then
        echo "Failure...<br/>"
        exit 0
    fi
    echo "Generated: $file<br/><pre>"
    cat "$file"
    echo "</pre>"
}

# If we're called as CGI script, do CGI stuff.
if test -n "$GATEWAY_INTERFACE"; then
    printf "Content-Type: text/html; charset=UTF-8\r\n\r\n"
    if test "$REQUEST_METHOD" = "POST"; then
        cgi_post
    else
        cgi_get
    fi
    exit 0
fi

# Default CLI action is generate.
action=generate

# Trick: we use getopt(1) to reposition the arguments, because the
# builtin getopts plays POSIXLY_CORRECT and refuses to do so. We then
# use builtin getopts (plural!) that handles quoted arguments.
options=Thc:l:s:o:e:
temp=`getopt -o $options -- "$@"`
test $? != 0 && exit 1
eval set -- "$temp"
while getopts $options opt; do
    case $opt in
    c)
        country="$OPTARG"
        ;;
    l)
        city="$OPTARG"
        ;;
    s)
        state="$OPTARG"
        ;;
    o)
        organisation="$OPTARG"
        ;;
    e)
        email="$OPTARG"
        ;;
    T)
        action=test
        ;;
    h)
        action=help
        ;;
    *)
        exit 1
    esac
done
shift $((OPTIND-1))

case $action in
help)
    run_help
    ;;
test)
    if test $# != 2; then
        echo "Action test requires host and port!" >&2
        exit 1
    fi
    host="$1"
    port="$2"
    run_test "$host" "$port"
    ;;
generate)
    if test $# -lt 1; then
        echo "Missing argument. See $0 -h for help." >&2
        exit 1
    elif test $# -gt 2; then
        echo "Action generate takes at most two arguments!" >&2
        exit 1
    fi
    cn="$1"
    test -n "$2" && subject="$2"
    test -z "$2" && subject="/C=$country/L=$city/ST=$state/O=$organisation/\
CN=$cn/emailAddress=$email"
    if ! echo "$subject" | grep -q ^/; then
        echo "Subject does not start with '/'." >&2
        exit 1
    fi
    run_generate "$cn" "$subject"
    ;;
esac

# vim: set ts=8 sw=4 sts=4 et ai: