Skip to content

Commit ab5733f

Browse files
tomas-soltystomas-soltys
committed
Initial implementation
1 parent 3808f2f commit ab5733f

12 files changed

+1301
-0
lines changed

‎README.md

+110
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# Range - Certificate Authority
2+
3+
**Range CA** is a set of tools to create own limited Certificate Authority to issue (sign), revoke and verify client or host certificates.
4+
5+
## Setup Certificate Authority
6+
7+
```
8+
./scripts/ca_setup.sh \
9+
--ca-dir="/path/to/your/range-ca" \
10+
--country="<iso-country-code>" \
11+
--state="<state>" \
12+
--location="<location>" \
13+
--organization="<organization>" \
14+
--organization-unit="<organization-unit>" \
15+
--common-name="your-domain.com" \
16+
[email protected]
17+
```
18+
NOTE: Replace above parameter values and placeholders with real values.
19+
20+
## Cleanup Certificate Authority
21+
22+
```
23+
./scripts/ca_cleanup.sh --ca-dir="/path/to/your/range-ca"
24+
```
25+
26+
## Sign certificate
27+
28+
```
29+
./scripts/ca_sign_certificate.sh \
30+
--csr="/path/to/input_file.csr" \
31+
--cert="/path/to/output_file.crt" \
32+
--extension=["client_cert" or "server_cert"]
33+
```
34+
35+
## Verify certificate
36+
37+
```
38+
./scripts/ca_verify_certificate.sh --cert="/path/to/input_file.crt"
39+
```
40+
41+
## Revoke certificate
42+
43+
```
44+
./scripts/ca_revoke_certificate.sh --common-name="certificate common name" --serial="certificate serial number"
45+
```
46+
47+
## Directory and file structure
48+
49+
### Directories
50+
* **certs** - This directory contains the certificates generated and signed by the CA. For the root CA, this includes the root CA certificate itself. For the intermediate CA, this includes the intermediate CA certificate and any server or client certificates signed by the intermediate CA.
51+
* **crl** - The Certificate Revocation List (CRL) directory contains the CRLs generated by the CA. A CRL is a list of certificates that have been revoked by the CA before their expiration date.
52+
* **newcerts** - This directory stores a copy of each certificate signed by the CA, with the certificate's serial number as the file name. It helps maintain a backup of all issued certificates.
53+
* **private** - This directory contains the private keys for the CA, including the root CA and intermediate CA private keys. These keys are used to sign certificates and CRLs. The private keys should be kept secure and not shared.
54+
55+
### Files
56+
* **serial** - Used to keep track of the last serial number that was used to issue a certificate.
57+
* **crlnumber** - Configuration directive specifying the file that contains the current CRL number.
58+
* **index.txt** - Database of sorts that keeps track of the certificates that have been issued by the CA.
59+
60+
```
61+
range-ca/
62+
├── conf
63+
│   ├── openssl_intermediate.cnf
64+
│   └── openssl_root.cnf
65+
├── intermediateCA
66+
│   ├── certs
67+
│   │   ├── ca-chain.cert.pem
68+
│   │   └── intermediate.cert.pem
69+
│   ├── crl
70+
│   ├── crlnumber
71+
│   ├── csr
72+
│   ├── index.txt
73+
│   ├── index.txt.attr
74+
│   ├── newcerts
75+
│   ├── openssl.cnf
76+
│   ├── private
77+
│   │   └── intermediate.key.pem
78+
│   └── serial
79+
├── LICENSE
80+
├── README.md
81+
├── rootCA
82+
│   ├── certs
83+
│   │   └── ca.cert.pem
84+
│   ├── crl
85+
│   ├── crlnumber
86+
│   ├── csr
87+
│   │   └── intermediate.csr.pem
88+
│   ├── index.txt
89+
│   ├── index.txt.attr
90+
│   ├── index.txt.old
91+
│   ├── newcerts
92+
│   │   └── 1000.pem
93+
│   ├── openssl.cnf
94+
│   ├── private
95+
│   │   └── ca.key.pem
96+
│   ├── serial
97+
│   └── serial.old
98+
└── scripts
99+
├── ca_cleanup.sh
100+
├── ca_create_intermediate_ca.sh
101+
├── ca_create_root_ca.sh
102+
├── ca_create_signed_certificate.sh
103+
├── ca_generate_crl.sh
104+
├── ca_revoke_certificate.sh
105+
├── ca_setup.sh
106+
├── ca_sign_certificate.sh
107+
└── ca_verify_certificate.sh
108+
```
109+
110+
_Based on instructions from: https://www.golinuxcloud.com/openssl-create-certificate-chain-linux/_

‎conf/openssl_intermediate.cnf

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
[ ca ] # The default CA section
2+
default_ca = CA_default # The default CA name
3+
4+
[ CA_default ] # Default settings for the intermediate CA
5+
dir = <ca-dir> # Intermediate CA directory
6+
certs = $dir/certs # Certificates directory
7+
crl_dir = $dir/crl # CRL directory
8+
new_certs_dir = $dir/newcerts # New certificates directory
9+
database = $dir/index.txt # Certificate index file
10+
serial = $dir/serial # Serial number file
11+
RANDFILE = $dir/private/.rand # Random number file
12+
private_key = $dir/private/intermediate.key.pem # Intermediate CA private key
13+
certificate = $dir/certs/intermediate.cert.pem # Intermediate CA certificate
14+
crl = $dir/crl/intermediate.crl.pem # Intermediate CA CRL
15+
crlnumber = $dir/crlnumber # Intermediate CA CRL number
16+
crl_extensions = crl_ext # CRL extensions
17+
default_days = 365 # Default number of days to certify the cert for
18+
default_crl_days = 30 # Default CRL validity days
19+
default_md = sha256 # Default message digest
20+
preserve = no # Preserve existing extensions
21+
email_in_dn = no # Exclude email from the DN
22+
name_opt = ca_default # Formatting options for names
23+
cert_opt = ca_default # Certificate output options
24+
policy = policy_loose # Certificate policy
25+
unique_subject = no # Allow non unique subjects
26+
27+
[ policy_loose ] # Policy for less strict validation
28+
countryName = optional # Country is optional
29+
stateOrProvinceName = optional # State or province is optional
30+
localityName = optional # Locality is optional
31+
organizationName = optional # Organization is optional
32+
organizationalUnitName = optional # Organizational unit is optional
33+
commonName = supplied # Must provide a common name
34+
emailAddress = optional # Email address is optional
35+
36+
[ req ] # Request settings
37+
default_bits = 4096 # Default key size
38+
distinguished_name = req_distinguished_name # Default DN template
39+
string_mask = utf8only # UTF-8 encoding
40+
default_md = sha256 # Default message digest
41+
x509_extensions = v3_intermediate_ca # Extensions for intermediate CA certificate
42+
43+
[ req_distinguished_name ] # Template for the DN in the CSR
44+
countryName = <country-name> # Country Name (2 letter code)
45+
stateOrProvinceName = <state> # State or Province Name (full name)
46+
localityName = <location> # Locality Name (city)
47+
0.organizationName = <organization> # Organization Name (company)
48+
organizationalUnitName = <organization-unit> # Organizational Unit Name (section)
49+
commonName = <common-name> # Common Name (your domain)
50+
emailAddress = <email> # Email Address
51+
countryName_default = <country-name> # Country Name (2 letter code)
52+
stateOrProvinceName_default = <state> # State or Province Name (full name)
53+
localityName_default = <location> # Locality Name (city)
54+
0.organizationName_default = <organization> # Organization Name (company)
55+
organizationalUnitName_default = <organization-unit> # Organizational Unit Name (section)
56+
commonName_default = <common-name> # Common Name (your domain)
57+
emailAddress_default = <email> # Email Address
58+
59+
[ v3_intermediate_ca ] # Intermediate CA certificate extensions
60+
subjectKeyIdentifier = hash # Subject key identifier
61+
authorityKeyIdentifier = keyid:always,issuer # Authority key identifier
62+
basicConstraints = critical, CA:true, pathlen:0 # Basic constraints for a CA
63+
keyUsage = critical, digitalSignature, cRLSign, keyCertSign # Key usage for a CA
64+
65+
[ crl_ext ] # CRL extensions
66+
authorityKeyIdentifier=keyid:always # Authority key identifier
67+
68+
[ server_cert ] # Server certificate extensions
69+
basicConstraints = CA:FALSE # Not a CA certificate
70+
nsCertType = server # Server certificate type
71+
keyUsage = critical, digitalSignature, keyEncipherment # Key usage for a server cert
72+
extendedKeyUsage = serverAuth # Extended key usage for server authentication purposes (e.g., TLS/SSL servers).
73+
authorityKeyIdentifier = keyid,issuer # Authority key identifier linking the certificate to the issuer's public key.
74+
75+
[ client_cert ] # Client certificate extensions
76+
basicConstraints = CA:FALSE # Not a CA certificate
77+
nsCertType = client, email # Client certificate type
78+
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment # Key usage for a server cert
79+
extendedKeyUsage = clientAuth, emailProtection # Extended key usage for server authentication purposes (e.g., TLS/SSL client).
80+
authorityKeyIdentifier = keyid,issuer # Authority key identifier linking the certificate to the issuer's public key.

‎conf/openssl_root.cnf

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
[ ca ] # The default CA section
2+
default_ca = CA_default # The default CA name
3+
4+
[ CA_default ] # Default settings for the CA
5+
dir = <ca-dir> # CA directory
6+
certs = $dir/certs # Certificates directory
7+
crl_dir = $dir/crl # CRL directory
8+
new_certs_dir = $dir/newcerts # New certificates directory
9+
database = $dir/index.txt # Certificate index file
10+
serial = $dir/serial # Serial number file
11+
RANDFILE = $dir/private/.rand # Random number file
12+
private_key = $dir/private/ca.key.pem # Root CA private key
13+
certificate = $dir/certs/ca.cert.pem # Root CA certificate
14+
crl = $dir/crl/ca.crl.pem # Root CA CRL
15+
crlnumber = $dir/crlnumber # Root CA CRL number
16+
crl_extensions = crl_ext # CRL extensions
17+
default_crl_days = 30 # Default CRL validity days
18+
default_md = sha256 # Default message digest
19+
preserve = no # Preserve existing extensions
20+
email_in_dn = no # Exclude email from the DN
21+
name_opt = ca_default # Formatting options for names
22+
cert_opt = ca_default # Certificate output options
23+
policy = policy_strict # Certificate policy
24+
unique_subject = no # Allow multiple certs with the same DN
25+
26+
[ policy_strict ] # Policy for stricter validation
27+
countryName = match # Must match the issuer's country
28+
stateOrProvinceName = match # Must match the issuer's state
29+
organizationName = match # Must match the issuer's organization
30+
organizationalUnitName = optional # Organizational unit is optional
31+
commonName = supplied # Must provide a common name
32+
emailAddress = optional # Email address is optional
33+
34+
[ req ] # Request settings
35+
default_bits = 4096 # Default key size
36+
distinguished_name = req_distinguished_name # Default DN template
37+
string_mask = utf8only # UTF-8 encoding
38+
default_md = sha256 # Default message digest
39+
prompt = no # Non-interactive mode
40+
41+
[ req_distinguished_name ] # Template for the DN in the CSR
42+
countryName = <country-name> # Country Name (2 letter code)
43+
stateOrProvinceName = <state> # State or Province Name (full name)
44+
localityName = <location> # Locality Name (city)
45+
0.organizationName = <organization> # Organization Name (company)
46+
organizationalUnitName = <organization-unit> # Organizational Unit Name (section)
47+
commonName = <common-name> # Common Name (your domain)
48+
emailAddress = <email> # Email Address
49+
50+
[ v3_ca ] # Root CA certificate extensions
51+
subjectKeyIdentifier = hash # Subject key identifier
52+
authorityKeyIdentifier = keyid:always,issuer # Authority key identifier
53+
basicConstraints = critical, CA:true # Basic constraints for a CA
54+
keyUsage = critical, keyCertSign, cRLSign # Key usage for a CA
55+
56+
[ crl_ext ] # CRL extensions
57+
authorityKeyIdentifier = keyid:always,issuer # Authority key identifier
58+
59+
[ v3_intermediate_ca ]
60+
subjectKeyIdentifier = hash
61+
authorityKeyIdentifier = keyid:always,issuer
62+
basicConstraints = critical, CA:true, pathlen:0
63+
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

‎scripts/ca_cleanup.sh

+81
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
#!/bin/bash
2+
3+
myName=$(basename $0 .sh)
4+
myPath=$(dirname $0)
5+
6+
caDir=
7+
8+
assert_success()
9+
{
10+
if [ $1 -ne 0 ]
11+
then
12+
echo "$2" >&2
13+
exit 1
14+
fi
15+
}
16+
17+
assert_nonempty()
18+
{
19+
if [ -z "$1" ]
20+
then
21+
echo "Value is empty. $2" >&2
22+
exit 1
23+
fi
24+
}
25+
26+
extract_cmd_parameter_value()
27+
{
28+
echo "${1#*=}"
29+
}
30+
31+
print_help()
32+
{
33+
cat <<End-of-help
34+
Usage: $myName.sh [OPTION]...
35+
36+
mandatory
37+
38+
--ca-dir=[PATH] Path to CA directory structure (default=$caDir)
39+
40+
optional
41+
42+
--help, -h, -? Print this help and exit
43+
44+
End-of-help
45+
}
46+
47+
while [ $# -gt 0 ]
48+
do
49+
case $1 in
50+
--ca-dir=*)
51+
caDir=$(extract_cmd_parameter_value "$1")
52+
;;
53+
--help | -h | -?)
54+
print_help
55+
exit 0
56+
;;
57+
*)
58+
echo "Unknown parameter '$1'" >&2
59+
exit 1
60+
;;
61+
esac
62+
shift
63+
done
64+
65+
assert_nonempty "$caDir" "CA directory not specified"
66+
67+
caRootDir="$caDir/rootCA"
68+
caIntermediateDir="$caDir/intermediateCA"
69+
70+
caRootCommonName="${caCommonName} Root CA"
71+
caIntermediateCommonName="${caCommonName} Intermediate CA"
72+
73+
echo
74+
echo "Remove OpenSSL CA directory structure"
75+
echo
76+
77+
chmod -R u+w "$caRootDir" && \
78+
chmod -R u+w "$caIntermediateDir" && \
79+
rm -rfv "$caRootDir" && \
80+
rm -rfv "$caIntermediateDir"
81+
assert_success $? "Failed to remove CA directory structure"

0 commit comments

Comments
 (0)