Commit 84a492da authored by Ian Douglas's avatar Ian Douglas
Browse files

added logic to require CN as parameter

parent 234e8799

create-ca.sh

+15 −15
Original line number Diff line number Diff line
@@ -9,9 +9,9 @@ set -e 
if [[ $# -lt 1 ]]; then 

    echo "at least 1 argument is required. "

    echo "example - create root ca:"

    echo "${0##*/} my_root_ca"

    echo "${0##*/} root_ca_mount root_ca_cn"

    echo "example - create intermediate ca:"

    echo "${0##*/} -i my_intermediate_ca my_root_ca"

    echo "${0##*/} -i intermediate_ca_mount intermediate_ca_cn root_ca_mount"

fi

 

# Default to create root ca
@@ -30,7 +30,7 @@ do 
        shift

 	;;

    *)

        usage "${0##*/} [-i ] my_ca"

        usage "${0##*/} [-i ] my_ca my_ca_cn"

        

        ;;

   esac
@@ -39,7 +39,7 @@ done 
create_root_ca() {

    # Generate root ca

    vault write $pki_path/root/generate/internal \

        common_name="$pki_path" ttl=$rootCAttl key_bits=$keyBits exclude_cn_from_sans=true

        common_name="$common_name" ttl=$rootCAttl key_bits=$keyBits exclude_cn_from_sans=true



    # Create CA url and CRL

    vault write $pki_path/config/urls \
@@ -53,12 +53,12 @@ create_interm_ca() { 


    # create csr

    vault write -format=json $pki_path/intermediate/generate/internal \

        common_name="$description" ttl=$intermCAttl key_bits=$keyBits exclude_cn_from_sans=true \

        common_name="$common_name" ttl=$intermCAttl key_bits=$keyBits exclude_cn_from_sans=true \

        | jq -r '.data.csr' > /tmp/$pki_path.csr



    # Sign the cert with root ca

    vault write -format=json $root_ca_path/root/sign-intermediate csr=@/tmp/$pki_path.csr \

        common_name="$description" \

        common_name="$common_name" \

        format=pem_bundle \

        ttl=$intermCAttl | jq -r '.data.certificate' > /tmp/$pki_path.crt
@@ -80,25 +80,25 @@ create_interm_ca() { 


# PKI mount path

pki_path=$1

root_ca_path=$2

common_name=$2

root_ca_path=$3



if [ -z "$pki_path" ]; then

  echo "pki path is required."

if [[ -z "$pki_path" ]] || [[ -z $common_name ]]; then

  echo "pki_mount_path and common_name are required, eg:"

  echo "${0##*/} my_pki 'My CA Root Authority'"

  exit 1

else

  description=$pki_path

fi





if [[ "$interm_ca" = "true" ]] && [[ -z $2 ]]; then

if [[ "$interm_ca" = "true" ]] && [[ -z $3 ]]; then

  echo "you must specify a root ca in order to sign the cert of the intermediate CA, eg:"

  echo "${0##*/} -i my_intermediate_ca my_root_ca"

  echo "${0##*/} -i intermediate_ca_mount intermediate_ca_cn root_ca_mount"

  exit 1

elif [ "$interm_ca" = "true" ]; then

  description="$description Intermediate CA"

  #description="$description Intermediate CA"

  ttl=$intermCAttl

else

  description="$description Root CA"

  #description="$description Root CA"

  ttl=$rootCAttl

fi