https://github.com/zerwes/basic-ca

some sample scripts to setup and maintain a basic CA with openssl
https://github.com/zerwes/basic-ca

Last synced: over 1 year ago
JSON representation

some sample scripts to setup and maintain a basic CA with openssl

• Host: GitHub
• URL: https://github.com/zerwes/basic-ca
• Owner: zerwes
• License: gpl-3.0
• Created: 2023-12-18T11:24:06.000Z (over 2 years ago)
• Default Branch: main
• Last Pushed: 2023-12-18T22:25:28.000Z (over 2 years ago)
• Last Synced: 2025-01-23T06:46:05.564Z (over 1 year ago)
• Language: Shell
• Size: 36.1 KB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          
# basic-ca

some sample scripts to setup and maintain a basic CA with openssl

# setup

## edit cfg

edit `ca.cfg` and `ssl.cfg`

 * in `ca.cfg`

   * settings in `req_distinguished_name` section

   * `nsCaRevocationUrl`, `crlDistributionPoints` and `authorityInfoAccess` (multiple occurrence, dito in the èxtension.*` files)

   * `new_oids` if required

 * in `ssl.cfg`

   * `UMAIL` env var

 * CA name defaults to ... **CA** :-) but can can be adjusted (`ca.cfg` and `ssl.cfg`)

## gen CA

edit ths script and set the CN for the CA; then run:

`./genCA.sh`

## gen ocsp signing cert

`./genOCSPsignCert.sh`

## gen server cert

`./genCert.sh SERVERNAME [DNSALTNAME|IP [DNSALTNAME|IP [...]]]`

## gen VPN/USR cert

this will use different extensions

`./genCert.sh -[V|U] ...`

## revoke a cert

`./revokeCert.sh CN`

## start OCSP server

port used in `authorityInfoAccess` must be set in the script!

`./startOCSPserver.sh`

## test OCSP server

test a existing cert

`./testOCSPserver.sh [CN]`

the ocsp check can be used with a serial too, not just with existing certs; just use `-serial $SN` instead of `-cert $CERT`

## other scripts

should be self-explanatory