acmecert: Added certificate expiry check command.
[utils.git] / certreq
CommitLineData
f2571f84
FT
1#!/bin/bash
2
f3768fd2
FT
3commajoin() {
4 f=y
5 for arg in "$@"; do
6 if [ -z "$f" ]; then echo -n ,; fi
7 echo -n "$arg"
8 f=
9 done
10}
11
f2571f84 12usage() {
1b361866 13 echo "usage: certreq [-h] [-a ALTNAMES] [-C] SUBJECT KEYFILE"
f2571f84
FT
14 echo ' SUBJECT is of the form `/PART1=VALUE1/PART2=VALUE2/...'\'
15 echo ' ALTNAMES is of the form `DNS:name1,DNS:name,...'\'
16}
17
18declare -A reqexts config
1b361866 19while getopts hCa: OPT; do
f2571f84
FT
20 case "$OPT" in
21 h)
22 usage
23 exit 0
24 ;;
25 a)
26 reqexts[SAN]=1
27 config[SAN]=1
28 config_SAN=("${config_SAN[@]}" "subjectAltName=$OPTARG")
29 ;;
1b361866
FT
30 C)
31 reqexts[NON_SELF_CA]=1
32 config[NON_SELF_CA]=1
33 config_NON_SELF_CA=("${config_NONE_SELF_CA[@]}"
34 "basicConstraints = critical,CA:true"
35 "keyUsage = cRLSign, keyCertSign")
36 ;;
f2571f84
FT
37 esac
38done
39shift $((OPTIND - 1))
40if [ $# -lt 2 ]; then
41 usage >&2
42 exit 1
43fi
44
45args=(openssl req -new)
46if [ -n "${!reqexts[*]}" ]; then
f3768fd2
FT
47 for reqext in "${!reqexts[@]}"; do
48 args=("${args[@]}" -reqexts "$reqext")
49 done
f2571f84
FT
50fi
51if [ -n "${!config[*]}" ]; then
52 confpath="$(mktemp /tmp/certreq-XXXXXX)"
53 cat /etc/ssl/openssl.cnf >>"$confpath"
54 for section in "${!config[@]}"; do
55 echo "[${section}]" >>"$confpath"
56 var="config_${section}[@]"
57 for confopt in "${!var}"; do
58 echo "$confopt" >>"$confpath"
59 done
60 echo >>"$confpath"
61 done
62 trap 'rm -f "$confpath"' EXIT
63 args=("${args[@]}" -config "$confpath")
64fi
65args=("${args[@]}" -subj "$1" -key "$2")
66
67"${args[@]}"