sslfie

#!/bin/sh

show_usage() {
    echo "Usage: sslfie [OPTION]... DOMAIN [DOMAIN2]...

Generate a self-signed x.509 certificate for use with SSL/TLS.

Options:
  -o PATH -- output the cert to a file at PATH
  -k PATH -- output the key to a file at PATH
  -K PATH -- sign key at PATH (instead of generating a new one)
  -c CC   -- country code listed in the cert (default: XX)
  -s SIZE -- generate a key of size SIZE (default: 2048)
  -y N    -- expire cert after N years (default: 10)
  -p      -- prompt for cert values
  -r      -- output csr instead of signing a cert"
}

main() {
    local C ST L O OU CN SUBJECT_ALT_NAME
    local cert cert_out expires_years generate_cmd is_temp_key key_append key_out key_path key_size opts prompt
    C=XX
    expires_years=10
    generate_cmd=generate_cert
    key_size=2048

    local OPTIND
    while getopts ho:k:K:c:s:y:pr opt; do
        case "$opt" in
            h) show_usage; exit ;;
            o) cert_out="$OPTARG" ;;
            k) key_out="$OPTARG" ;;
            K) key_path="$OPTARG" ;;
            c) C="$OPTARG" ;;
            s) key_size="$OPTARG" ;;
            y) expires_years="$OPTARG" ;;
            p) prompt=1 ;;
            r) generate_cmd=generate_csr ;;
        esac
    done
    shift $(( OPTIND - 1 ))

    if [ $# -eq 0 ]; then
        show_usage
        exit 1
    fi

    opts=$(get_options "$@")
    if [ -n "$opts" ]; then
        die "Error: all options must go at the beginning: $opts"
    fi

    if ! has_command "$OPENSSL"; then
        die "Error: $OPENSSL command not found"
    fi

    if [ -n "$cert_out" ] && [ "$cert_out" = "$key_out" ]; then
        key_append=1
    fi

    CN=$1
    SUBJECT_ALT_NAME=$(join_commas $(map_subject "$@"))

    local form_path
    if [ -n "$prompt" ]; then
        if ! has_command dialog; then
            die "Error: dialog commnd not found"
        fi

        form_path=$(make_tempfile)

        C="$C" CN="$CN" SUBJECT_ALT_NAME="$SUBJECT_ALT_NAME" expires_years="$expires_years" \
            display_form 2>"$form_path"                         &&
        {
            read -r CN
            read -r SUBJECT_ALT_NAME
            read -r expires_years
            read -r C
            read -r ST
            read -r L
            read -r O
            read -r OU
        } <"$form_path"                                         &&
        rm -f -- "$form_path"
    fi                                                          &&

    if [ -z "$key_path" ]; then
      is_temp_key=1
      key_path=$(make_tempfile)                                 &&
      (umask 077; generate_key "$key_size" >| "$key_path")
    fi                                                          &&

    cert=$(CN="$CN" \
        SUBJECT_ALT_NAME="$SUBJECT_ALT_NAME" \
        KEY="$key_path" \
        DAYS=$(( 365 * expires_years )) \
        C="$C" \
        ST="$ST" \
        L="$L" \
        O="$O" \
        OU="$OU" \
        "$generate_cmd")                                        &&

    printf '%s\n' "$cert" | output "$cert_out"                  &&
    (umask 077; output "$key_out" "$key_append" < "$key_path")  &&

    if [ -n "$is_temp_key" ]; then
      rm -- "$key_path"
    fi
}

join_commas() {
    (IFS=,; printf '%s\n' "$*")
}

map_subject() {
    local arg
    for arg; do
        printf '%s\n' "DNS:$arg"
    done
}

display_form() {
    local max_length num_fields
    max_length=255
    num_fields=8
    dialog \
        --backtitle "sslfie" \
        --title "Certificate Parameters" \
        --form "" $(( num_fields + 6 )) 78 "$num_fields" \
            "Common Name:"              1 1 "$CN"               1 25 "$max_length" "$max_length" \
            "Subject Alt Name:"         2 1 "$SUBJECT_ALT_NAME" 2 25 "$max_length" "$max_length" \
            "Expiration (in years):"    3 1 "$expires_years"    3 25 "$max_length" "$max_length" \
            "Country:"                  4 1 "$C"                4 25 "$max_length" "$max_length" \
            "State/Province:"           5 1 ""                  5 25 "$max_length" "$max_length" \
            "Locality:"                 6 1 ""                  6 25 "$max_length" "$max_length" \
            "Organization:"             7 1 ""                  7 25 "$max_length" "$max_length" \
            "Organization Unit:"        8 1 ""                  8 25 "$max_length" "$max_length"
}

generate_key() {
    "$OPENSSL" genrsa "$1" 2>/dev/null
}

generate_cert() {
    local cfg

    cfg=$(make_tempfile)            &&
    C="$C" ST="$ST" L="$L" O="$O" OU="$OU" CN="$CN" SUBJECT_ALT_NAME="$SUBJECT_ALT_NAME" \
        generate_config >| "$cfg"   &&

    "$OPENSSL" req \
        -config "$cfg" \
        -days "$DAYS" \
        -key "$KEY" \
        -new \
        -sha256 \
        -utf8 \
        -x509                       &&

    rm -f -- "$cfg"
}

generate_csr() {
    local cfg

    cfg=$(make_tempfile)            &&
    C="$C" ST="$ST" L="$L" O="$O" OU="$OU" CN="$CN" SUBJECT_ALT_NAME="$SUBJECT_ALT_NAME" \
        generate_config >| "$cfg"   &&

    "$OPENSSL" req \
        -config "$cfg" \
        -key "$KEY" \
        -new \
        -sha256 \
        -utf8                       &&

    rm -f -- "$cfg"
}

generate_config() {
    local C_LINE ST_LINE L_LINE O_LINE OU_LINE

    if [ -n "$C" ]; then
        C_LINE="C = $C"
    fi
    if [ -n "$ST" ]; then
        ST_LINE="ST = $ST"
    fi
    if [ -n "$L" ]; then
        L_LINE="L = $L"
    fi
    if [ -n "$O" ]; then
        O_LINE="O = $O"
    fi
    if [ -n "$OU" ]; then
        OU_LINE="OU = $OU"
    fi

    echo "[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
x509_extensions = v3_req
prompt = no

[req_distinguished_name]
$C_LINE
$ST_LINE
$L_LINE
$O_LINE
$OU_LINE
CN = $CN

[v3_req]
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = $SUBJECT_ALT_NAME
"
}

get_options() {
    local arg
    for arg; do
        case "$arg" in
            -*) printf '%s ' "$arg" ;;
        esac
    done
}

output() {
    if [ -z "$1" ]; then
        cat
    else
        if [ -z "$2" ]; then
            cat >| "$1"
        else
            cat >> "$1"
        fi
    fi
}

has_command() {
    hash "$1" 2>/dev/null
}

make_tempfile() {
    mktemp -t sslfie.XXXXXX
}

die() {
    printf '%s\n' "$1" >&2
    exit 1
}

OPENSSL=openssl

main "$@"