Add -e option to supply entityID and -f force option.
git-svn-id: https://svn.middleware.georgetown.edu/cpp-sp/trunk@2768
cb58f699-b61c-0410-a6fe-
9272a202ed29
+while getopts h:e:y:bf c
do
case $c in
b) BATCH=1;;
do
case $c in
b) BATCH=1;;
- y) DAYS=$OPTARG;;
- \?) echo keygen [-h hostname/cn for cert] [-y years to issue cert]
+ e) ENTITYID=$OPTARG;;
+ y) YEARS=$OPTARG;;
+ \?) echo keygen [-h hostname for cert] [-y years to issue cert] [-e entityID to embed in cert]
+if [ -n $FORCE ] ; then
+ rm sp-key.pem sp-cert.pem
+fi
+
if [ -e sp-key.pem ] || [ -e sp-cert.pem ] ; then
if [ -z $BATCH ] ; then
echo The files sp-key.pem and/or sp-cert.pem already exist!
if [ -e sp-key.pem ] || [ -e sp-cert.pem ] ; then
if [ -z $BATCH ] ; then
echo The files sp-key.pem and/or sp-cert.pem already exist!
+ echo Use -f option to force recreation of keypair.
-if [ -z $DAYS ] ; then
- DAYS=10
+if [ -z $YEARS ] ; then
+ YEARS=10
+fi
+
+DAYS=$(($YEARS*365))
+
+if [ -z $ENTITYID ] ; then
+ ALTNAME=subjectAltName=DNS:$FQDN
+else
+ ALTNAME=subjectAltName=DNS:$FQDN,URI:$ENTITYID
+cat >sp-cert.cnf <<EOF
+# OpenSSL configuration file for creating sp-cert.pem
+[req]
+prompt=no
+default_bits=2048
+encrypt_key=no
+default_md=sha1
+distinguished_name=dn
+# PrintableStrings only
+string_mask=MASK:0002
+x509_extensions=ext
+[dn]
+CN=$FQDN
+[ext]
+subjectAltName=$ALTNAME
+subjectKeyIdentifier=hash
+EOF
- openssl req -x509 -days $DAYS -newkey rsa:2048 -nodes -keyout sp-key.pem -out sp-cert.pem -subj /CN=$FQDN -extensions usr_cert -set_serial 0
+ openssl req -config sp-cert.cnf -new -x509 -days $DAYS -keyout sp-key.pem -out sp-cert.pem
- openssl req -x509 -days $DAYS -newkey rsa:2048 -nodes -keyout sp-key.pem -out sp-cert.pem -subj /CN=$FQDN -extensions usr_cert -set_serial 0 2> /dev/null
+ openssl req -config sp-cert.cnf -new -x509 -days $DAYS -keyout sp-key.pem -out sp-cert.pem 2> /dev/null