The cert "bootstrap" code now checks certs for validity

[freeradius.git] / raddb / certs / Makefile

diff --git a/raddb/certs/Makefile b/raddb/certs/Makefile
index a9fa070..5a91002 100644 (file)
--- a/raddb/certs/Makefile
+++ b/raddb/certs/Makefile
@@ -14,11 +14,12 @@ DH_KEY_SIZE = 1024
 #
 #  Set the passwords
 #
-PASSWORD_SERVER        = $(shell grep output_password server.cnf | sed 's/.*=//;s/^ *//')
-PASSWORD_CA    = $(shell grep output_password ca.cnf | sed 's/.*=//;s/^ *//')
-PASSWORD_CLIENT        = $(shell grep output_password client.cnf | sed 's/.*=//;s/^ *//')
+PASSWORD_SERVER        = `grep output_password server.cnf | sed 's/.*=//;s/^ *//'`
+PASSWORD_CA    = `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'`
+PASSWORD_CLIENT        = `grep output_password client.cnf | sed 's/.*=//;s/^ *//'`
 
-USER_NAME      = $(shell grep emailAddress client.cnf | grep '@' | sed 's/.*=//;s/^ *//')
+USER_NAME      = `grep emailAddress client.cnf | grep '@' | sed 's/.*=//;s/^ *//'`
+CA_DEFAULT_DAYS = `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'`
 
 ######################################################################
 #
@@ -26,16 +27,16 @@ USER_NAME   = $(shell grep emailAddress client.cnf | grep '@' | sed 's/.*=//;s/^ *
 #
 ######################################################################
 .PHONY: all
-all: dh random server ca
+all: index.txt serial dh random server ca
 
 .PHONY: client
 client: client.pem
 
 .PHONY: ca
-ca: ca.pem
+ca: ca.der
 
 .PHONY: server
-server: server.pem
+server: server.pem server.vrfy
 
 ######################################################################
 #
@@ -50,18 +51,22 @@ dh:
 #  Create a new self-signed CA certificate
 #
 ######################################################################
-ca.key ca.pem:
-       openssl req -new -x509 -keyout ca.key -out ca.pem -config ./ca.cnf 
+ca.key ca.pem: ca.cnf
+       openssl req -new -x509 -keyout ca.key -out ca.pem \
+               -days $(CA_DEFAULT_DAYS) -config ./ca.cnf
+
+ca.der: ca.pem
+       openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der
 
 ######################################################################
 #
 #  Create a new server certificate, signed by the above CA.
 #
 ######################################################################
-server.csr server.key: 
+server.csr server.key: server.cnf
        openssl req -new  -out server.csr -keyout server.key -config ./server.cnf
 
-server.crt: server.csr ca.key ca.pem index.txt serial
+server.crt: server.csr ca.key ca.pem
        openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key $(PASSWORD_CA) -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf
 
 server.p12: server.crt
@@ -70,6 +75,10 @@ server.p12: server.crt
 server.pem: server.p12
        openssl pkcs12 -in server.p12 -out server.pem -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
 
+.PHONY: server.vrfy
+server.vrfy: ca.pem
+       openssl verify -CAfile ca.pem server.pem
+
 ######################################################################
 #
 #  Create a new client certificate, signed by the the above server
@@ -79,16 +88,21 @@ server.pem: server.p12
 client.csr client.key: client.cnf
        openssl req -new  -out client.csr -keyout client.key -config ./client.cnf
 
-client.crt: client.csr server.crt server.key index.txt serial
-       openssl ca -batch -keyfile server.key -cert server.crt -in client.csr  -key $(PASSWORD_SERVER) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
+client.crt: client.csr ca.pem ca.key
+       openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key $(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
 
 client.p12: client.crt
        openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12  -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
 
 client.pem: client.p12
-       openssl pkcs12 -in client.p12 -out client.pem -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_CLIENT)
+       openssl pkcs12 -in client.p12 -out client.pem -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
        cp client.pem $(USER_NAME).pem
 
+.PHONY: server.vrfy
+client.vrfy: server.pem client.pem 
+       c_rehash .
+       openssl verify -CApath . client.pem
+
 ######################################################################
 #
 #  Miscellaneous rules.
@@ -101,7 +115,7 @@ serial:
        @echo '01' > serial
 
 random:
-       @if [ -e /dev/urandom ] ; then \
+       @if [ -c /dev/urandom ] ; then \
                dd if=/dev/urandom of=./random count=10 >/dev/null 2>&1; \
        else \
                date > ./random; \
@@ -110,16 +124,15 @@ random:
 print:
        openssl x509 -text -in server.crt
 
+printca:
+       openssl x509 -text -in ca.pem
+
 clean:
        @rm -f *~ *old client.csr client.key client.crt client.p12 client.pem
 
 #
-#  Run distclean ONLY if there's a CVS directory, AND it points to
-#  cvs.freeradius.org.  Otherwise, it would be easy for administrators
-#  to type "make distclean", and destroy their CA and server certificates.
+#      Make a target that people won't run too often.
 #
-distclean:
-       @if [ -d CVS -a `grep -i 'cvs\.freeradius\.org' CVS/Root` ] ; then \
-               rm -f *~ dh *.csr *.crt *.p12 *.der *.pem *.key index.txt* \
-                       serial* random; \
-       fi
+destroycerts:
+       rm -f *~ dh *.csr *.crt *.p12 *.der *.pem *.key index.txt* \
+                       serial* random *\.0 *\.1