212 lines
6.0 KiB
Bash
212 lines
6.0 KiB
Bash
#!/bin/bash
|
|
|
|
# Self-Signed Certificate Generator for Uggla Drone Detection System
|
|
# Creates a 10-year certificate with interactive domain configuration
|
|
|
|
set -e
|
|
|
|
# Colors for output
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
BLUE='\033[0;34m'
|
|
NC='\033[0m' # No Color
|
|
|
|
# Certificate configuration
|
|
CERT_DIR="/etc/ssl/uggla"
|
|
CERT_NAME="uggla"
|
|
CERT_KEY="${CERT_DIR}/${CERT_NAME}.key"
|
|
CERT_CRT="${CERT_DIR}/${CERT_NAME}.crt"
|
|
CERT_CSR="${CERT_DIR}/${CERT_NAME}.csr"
|
|
CERT_CONF="${CERT_DIR}/${CERT_NAME}.conf"
|
|
DAYS=3650 # 10 years
|
|
|
|
echo -e "${BLUE}======================================${NC}"
|
|
echo -e "${BLUE} Uggla SSL Certificate Generator${NC}"
|
|
echo -e "${BLUE} For External Proxy Configuration${NC}"
|
|
echo -e "${BLUE}======================================${NC}"
|
|
echo
|
|
|
|
# Check if running as root
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo -e "${RED}This script must be run as root to create certificates in /etc/ssl/${NC}"
|
|
echo "Please run: sudo $0"
|
|
exit 1
|
|
fi
|
|
|
|
# Create SSL directory if it doesn't exist
|
|
mkdir -p "${CERT_DIR}"
|
|
|
|
echo -e "${YELLOW}This script will generate a self-signed SSL certificate valid for 10 years.${NC}"
|
|
echo -e "${YELLOW}Certificate will be placed in /etc/ssl/uggla/ for your external proxy.${NC}"
|
|
echo -e "${YELLOW}You'll need to provide certificate details and domain names.${NC}"
|
|
echo
|
|
|
|
# Collect certificate information
|
|
echo -e "${GREEN}Enter certificate information:${NC}"
|
|
read -p "Country (2 letter code) [SE]: " COUNTRY
|
|
COUNTRY=${COUNTRY:-SE}
|
|
|
|
read -p "State/Province [Stockholm]: " STATE
|
|
STATE=${STATE:-Stockholm}
|
|
|
|
read -p "City [Stockholm]: " CITY
|
|
CITY=${CITY:-Stockholm}
|
|
|
|
read -p "Organization [Uggla Systems]: " ORG
|
|
ORG=${ORG:-"Uggla Systems"}
|
|
|
|
read -p "Organizational Unit [IT Department]: " OU
|
|
OU=${OU:-"IT Department"}
|
|
|
|
read -p "Common Name (main domain) [localhost]: " CN
|
|
CN=${CN:-localhost}
|
|
|
|
echo
|
|
echo -e "${GREEN}Enter Subject Alternative Names (SANs):${NC}"
|
|
echo -e "${YELLOW}Press Enter after each domain. Enter empty line when done.${NC}"
|
|
echo -e "${YELLOW}Examples: example.com, www.example.com, 192.168.1.100, localhost${NC}"
|
|
echo
|
|
|
|
# Collect SANs
|
|
SANS=()
|
|
SANS+=("DNS:${CN}") # Add CN as first SAN
|
|
SANS+=("DNS:localhost")
|
|
SANS+=("IP:127.0.0.1")
|
|
SANS+=("IP:::1")
|
|
|
|
echo "Default SANs added: ${CN}, localhost, 127.0.0.1, ::1"
|
|
echo "Enter additional domains/IPs:"
|
|
|
|
while true; do
|
|
read -p "Domain or IP: " DOMAIN
|
|
if [[ -z "$DOMAIN" ]]; then
|
|
break
|
|
fi
|
|
|
|
# Determine if it's an IP or domain
|
|
if [[ $DOMAIN =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] || [[ $DOMAIN =~ ^[0-9a-fA-F:]+$ ]]; then
|
|
SANS+=("IP:${DOMAIN}")
|
|
echo "Added IP: ${DOMAIN}"
|
|
else
|
|
SANS+=("DNS:${DOMAIN}")
|
|
echo "Added domain: ${DOMAIN}"
|
|
fi
|
|
done
|
|
|
|
echo
|
|
echo -e "${BLUE}Certificate Configuration Summary:${NC}"
|
|
echo "Country: ${COUNTRY}"
|
|
echo "State: ${STATE}"
|
|
echo "City: ${CITY}"
|
|
echo "Organization: ${ORG}"
|
|
echo "Organizational Unit: ${OU}"
|
|
echo "Common Name: ${CN}"
|
|
echo "SANs: ${SANS[*]}"
|
|
echo "Validity: ${DAYS} days (10 years)"
|
|
echo "Output directory: ${CERT_DIR}"
|
|
echo
|
|
|
|
read -p "Continue with certificate generation? (y/N): " CONFIRM
|
|
if [[ ! $CONFIRM =~ ^[Yy]$ ]]; then
|
|
echo "Certificate generation cancelled."
|
|
exit 1
|
|
fi
|
|
|
|
echo
|
|
echo -e "${GREEN}Generating certificate...${NC}"
|
|
|
|
# Create OpenSSL configuration file
|
|
cat > "${CERT_CONF}" << EOF
|
|
[req]
|
|
default_bits = 4096
|
|
prompt = no
|
|
default_md = sha256
|
|
distinguished_name = dn
|
|
req_extensions = v3_req
|
|
|
|
[dn]
|
|
C=${COUNTRY}
|
|
ST=${STATE}
|
|
L=${CITY}
|
|
O=${ORG}
|
|
OU=${OU}
|
|
CN=${CN}
|
|
|
|
[v3_req]
|
|
basicConstraints = CA:FALSE
|
|
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
|
subjectAltName = @alt_names
|
|
|
|
[alt_names]
|
|
EOF
|
|
|
|
# Add SANs to config
|
|
for i in "${!SANS[@]}"; do
|
|
echo "${SANS[$i]}" | sed 's/DNS:/DNS.'$((i+1))' = /' | sed 's/IP:/IP.'$((i+1))' = /' >> "${CERT_CONF}"
|
|
done
|
|
|
|
echo -e "${YELLOW}Step 1/3: Generating private key...${NC}"
|
|
openssl genrsa -out "${CERT_KEY}" 4096
|
|
|
|
echo -e "${YELLOW}Step 2/3: Generating certificate signing request...${NC}"
|
|
openssl req -new -key "${CERT_KEY}" -out "${CERT_CSR}" -config "${CERT_CONF}"
|
|
|
|
echo -e "${YELLOW}Step 3/3: Generating self-signed certificate...${NC}"
|
|
openssl x509 -req -in "${CERT_CSR}" -signkey "${CERT_KEY}" -out "${CERT_CRT}" -days "${DAYS}" -extensions v3_req -extfile "${CERT_CONF}"
|
|
|
|
# Set appropriate permissions
|
|
chmod 600 "${CERT_KEY}"
|
|
chmod 644 "${CERT_CRT}"
|
|
|
|
# Clean up temporary files
|
|
rm "${CERT_CSR}" "${CERT_CONF}"
|
|
|
|
echo
|
|
echo -e "${GREEN}======================================${NC}"
|
|
echo -e "${GREEN} Certificate Generation Complete!${NC}"
|
|
echo -e "${GREEN}======================================${NC}"
|
|
echo
|
|
echo -e "${GREEN}Certificate files created:${NC}"
|
|
echo "Private Key: ${CERT_KEY}"
|
|
echo "Certificate: ${CERT_CRT}"
|
|
echo
|
|
echo -e "${BLUE}Certificate Information:${NC}"
|
|
openssl x509 -in "${CERT_CRT}" -text -noout | grep -A 5 "Subject:"
|
|
openssl x509 -in "${CERT_CRT}" -text -noout | grep -A 10 "Subject Alternative Name"
|
|
echo
|
|
echo -e "${BLUE}Certificate validity:${NC}"
|
|
openssl x509 -in "${CERT_CRT}" -dates -noout
|
|
|
|
echo
|
|
echo -e "${YELLOW}Next steps:${NC}"
|
|
echo "1. Configure your external proxy (nginx/apache/traefik) to use these certificates:"
|
|
echo " Certificate: ${CERT_CRT}"
|
|
echo " Private Key: ${CERT_KEY}"
|
|
echo ""
|
|
echo "2. Example nginx configuration:"
|
|
echo " server {"
|
|
echo " listen 443 ssl;"
|
|
echo " ssl_certificate ${CERT_CRT};"
|
|
echo " ssl_certificate_key ${CERT_KEY};"
|
|
echo " location /uggla/ {"
|
|
echo " proxy_pass http://localhost:8080/uggla/;"
|
|
echo " }"
|
|
echo " }"
|
|
echo ""
|
|
echo "3. Example Apache configuration:"
|
|
echo " <VirtualHost *:443>"
|
|
echo " SSLEngine on"
|
|
echo " SSLCertificateFile ${CERT_CRT}"
|
|
echo " SSLCertificateKeyFile ${CERT_KEY}"
|
|
echo " ProxyPass /uggla/ http://localhost:8080/uggla/"
|
|
echo " </VirtualHost>"
|
|
echo ""
|
|
echo "4. Docker cluster should run on internal ports (8080/8443)"
|
|
echo "5. External proxy forwards traffic to Docker cluster"
|
|
echo
|
|
echo -e "${RED}Warning: This is a self-signed certificate.${NC}"
|
|
echo -e "${RED}Browsers will show security warnings. Add to trusted certificates if needed.${NC}"
|
|
echo
|
|
echo -e "${GREEN}Certificate generation completed successfully!${NC}"
|