create-client

#!/bin/bash
# Derek Moore <derek.moore@gmail.com>
# Tiago Possato <tiago.possato@yahoo.com.br>

usage() {
    echo "Usage: $0 -c CLIENT_NAME -n CERT_NAME"
    echo "Options:"
    echo "    -c CLIENT_NAME  Client name (commonName) for the new cert"
    echo "    -n CERT_NAME  Cert name for the new cert"
    echo
    exit 2
}

CLIENT_NAME=
CERT_NAME=

while getopts "c:n:" FLAG; do
    case "${FLAG}" in
        c) CLIENT_NAME=${OPTARG} ;;
        n) CERT_NAME=${OPTARG} ;;
        *) usage ;;
    esac
done

if [ "${CLIENT_NAME}" == "" ]; then
    usage
fi

if [ "${CERT_NAME}" == "" ]; then
    usage
fi

echo "CERT_NAME: "${CERT_NAME}
echo "CLIENT_NAME: "${CLIENT_NAME}

BIN_DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
source ${BIN_DIR}/functions
source ${BIN_DIR}/defaults.conf

SAFE_NAME=`echo ${CERT_NAME} | sed 's/\*/star/g'`
SAFE_NAME=`echo $SAFE_NAME | sed 's/[^A-Za-z0-9-]/-/g'`

echo
echo "Creating new client certificate for '${CLIENT_NAME}'"
echo

pushd ${BIN_DIR}/.. > /dev/null

if [ -f conf/${SAFE_NAME}.client.conf ]; then
    echo "Configuration already exists for '${CERT_NAME}', exiting."
    exit 1
fi

#echo -n "Enter passphase for signing CA key: "
#read -s PASS
#echo
#export CA_PASS=${PASS}
export CA_PASS=""

# Generate the client cert openssl config
export SAN=""
export CA_USERNAME=${CLIENT_NAME}
template "${BIN_DIR}/templates/client.tpl" "conf/${SAFE_NAME}.client.conf"

# Create the client key and csr
openssl req -new -nodes \
            -config conf/${SAFE_NAME}.client.conf \
            -keyout private/${SAFE_NAME}.client.key \
            -out csr/${SAFE_NAME}.client.csr
chmod 0400 private/${SAFE_NAME}.client.key

# Create the client certificate
openssl ca -batch -notext \
           -config conf/ca.conf \
           -in csr/${SAFE_NAME}.client.csr \
           -out certs/${SAFE_NAME}.client.crt \
           -days 730 \
           -extensions client_ext \
           -passin env:CA_PASS

popd > /dev/null

echo
echo "Client certificate created."
echo