automate SSL certificate generation

jakev383 · 07-21-2009, 01:16 PM

Does anyone know of a quick, simple way to automate SSL generation? I'm trying to write a script that asks for the different information (City, State, Common Name, etc.) and generate multiple certificates using that information instead of having to type the information in for each cert generation. Here is a sample of how I generate a cert:

Code:

openssl req -new -x509 -extensions v3_ca -keyout keys/private/cakey.pem -out cacert.pem -days 3653

If anyone has any suggestions, I would appreciate it!
Thanks.

deathsfriend99 · 07-21-2009, 01:30 PM

This may not be what you are trying to do, but check out the mkcert.sh and the dovecot-openssl.cnf. The cnf needs to be edited to include City, State, Common Name, etc. and the mkcert will make the dovecot.pem. Make sure to look at the mkcert.sh. You may be able to modify it to do what you need.

http://wiki.dovecot.org/SSL/CertificateCreation

jakev383 · 07-22-2009, 06:17 AM

Ah! I did not realize that the openssl command will take a -config option.
Thanks! The Dovecot script gave me the bump I needed! I'll have to try this out later today.

lcoronato · 07-22-2009, 12:01 PM

Hi,

You can use the following command:

Code:

make -C /etc/pki/tls/certs/

For example, creating the certificate to Dovecot, you use:

Code:

make -C /etc/pki/tls/certs/ dovecot.pem

make: Entering directory `/etc/pki/tls/certs'
umask 77 ; \
	PEM1=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
	PEM2=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
	/usr/bin/openssl req -utf8 -newkey rsa:1024 -keyout $PEM1 -nodes -x509 -days 365 -out $PEM2 -set_serial 0 ; \
	cat $PEM1 >  dovecot.pem ; \
	echo ""    >> dovecot.pem ; \
	cat $PEM2 >> dovecot.pem ; \
	rm -f $PEM1 $PEM2
Generating a 1024 bit RSA private key
........++++++
..................++++++
writing new private key to '/tmp/openssl.eF3723'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:BR
State or Province Name (full name) [Berkshire]:Sao Paulo
Locality Name (eg, city) [Newbury]:Sao Paulo
Organization Name (eg, company) [My Company Ltd]:lcoronato
Organizational Unit Name (eg, section) []:TI
Common Name (eg, your name or your server's hostname) []:cluster2.rhce.com.br
Email Address []:
make: Leaving directory `/etc/pki/tls/certs'

Will be created the certificate dovecot.pem in the correct folder.

/etc/pki/tls/certs
/etc/pki/tls/private

Is necessary uncomment this lines, in /etc/dovecot.conf

ssl_cert_file = /etc/pki/tls/certs/dovecot.pem
ssl_key_file = /etc/pki/tsl/private/dovecot.pem

I Think that will help.

Good luck.

Leandro.

jakev383 · 07-24-2009, 08:50 AM

I still haven't gotten a chance to try this yet.
Does the last solution allow me to generate a cert in a script without requiring input for the cert? I don't want to have to enter the City, State, etc.
Thanks.