-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathcert-gen.sh
69 lines (61 loc) · 2.02 KB
/
cert-gen.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
#delete old certs
rm -rf company.se*
#gen new key + csr
#openssl \
# req \
# -nodes \
# -newkey rsa:4096 \
# -keyout company.se.key \
# -out company.se.csr \
# -subj "/C=SE/ST=Stockholm Lan/L=Stockholm/O=Company AB/OU=DevOps/CN=www.company.se/[email protected]"
#linux version
#openssl req \
# -newkey rsa:4096 \
# -x509 \
# -new \
# -nodes \
# -keyout company.se.key \
# -out company.se.crt \
# -subj "/C=SE/ST=Stockholm Lan/L=Stockholm/O=Company AB/OU=DevOps/CN=www.company.se/[email protected]" \
# -sha256 \
# -days 365 \
# -addext "subjectAltName = DNS:company.se,IP:127.0.0.1,IP:192.168.1.1" \
# -addext "extendedKeyUsage = serverAuth"
#macos versions
#fido2 and web server certs
openssl req \
-newkey rsa:4096 \
-x509 \
-nodes \
-keyout company.se.key \
-new \
-out company.se.crt \
-subj "/C=SE/ST=Stockholm Lan/L=Stockholm/O=Company AB/OU=DevOps/CN=security-engineer.test/[email protected]" \
-extensions v3_new \
-config <(cat /System/Library/OpenSSL/openssl.cnf \
<(printf '[v3_new]\nsubjectAltName=DNS:security-engineer.test,IP:127.0.0.1,IP:192.168.1.1\nextendedKeyUsage=serverAuth')) \
-sha256 \
-days 365
#redis certs
#openssl req \
# -newkey rsa:4096 \
# -x509 \
# -nodes \
# -keyout redis.company.se.key \
# -new \
# -out redis.company.se.crt \
# -subj "/C=SE/ST=Stockholm Lan/L=Stockholm/O=Company AB/OU=DevOps/CN=www.company.se/[email protected]" \
# -extensions v3_new \
# -config <(cat /System/Library/OpenSSL/openssl.cnf \
# <(printf '[v3_new]\nsubjectAltName=DNS:redis.company.se,DNS:redis,IP:127.0.0.1,IP:192.168.1.1\nextendedKeyUsage=serverAuth')) \
# -sha256 \
# -days 365
#redis port forward ssh keys
#ssh-keygen -b 4096 -t rsa -f ./fido2.key -q -N ""
#ssh-keygen -b 4096 -t rsa -f ./web.key -q -N ""
#generate redis certs
bash gen-redis-crts.sh
#make cert
#openssl x509 -req -days 365 -in company.se.csr -signkey company.se.key -out company.se.crt
#remove CSR, not needed anymore
#rm ./company.se.csr