1 files changed, 95 insertions, 0 deletions
diff --git a/scripts/mkreq b/scripts/mkreq
new file mode 100755
index 0000000..4493867
--- /dev/null
+++ b/scripts/mkreq
@@ -0,0 +1,95 @@
+#!/bin/sh
+
+host="$1"; shift
+ca_host="ca.sunet.se"
+ca_name="infra"
+type=""
+
+usage ()
+{
+    echo "\
+Usage: mkreq [-v] [-s*] [-c] [-C <ca host>] [-N <ca name>] [--] <fqdn>
+
+
+  -h, --help                show this help text and exit
+  -s                        request server cert (default if <fqdn> exists in cosmos repo)
+  -c                        request client cert
+  -C                        ca host (ca.sunet.se)
+  -N                        ca name (infra)
+  
+  <fqdn>                    fully qualified name of host
+
+" 1>&2
+}
+
+{
+   while test $# -gt 0; do
+      case "$1" in
+          -s)
+             type="server"
+             ;;
+          -c)
+             type="client"
+             ;;
+          -C)
+             ca_host="$2"
+             shift
+             ;;
+          -N)
+             ca_name="$2"
+             shift
+             ;;
+          -h)
+             usage
+             exit 0
+             ;;
+          --)
+             break
+             ;;
+      esac
+      shift
+   done
+}
+
+if [ -d $host -a -z $type ]; then
+   type="server"
+fi
+
+
+cfg=`mktemp`
+key="/tmp/$host.key"
+csr="/tmp/$host.csr"
+
+trap 'rm -f $cfg' EXIT
+
+cat>$cfg<<EOC
+[ req ]
+default_bits           = 4096
+distinguished_name     = req_distinguished_name
+req_extensions         = req_extensions
+prompt		       = no
+
+[ req_distinguished_name ]
+C			= SE
+O			= SUNET
+CN			= $host
+
+[ req_extensions ]
+subjectAltName          = DNS:$host
+EOC
+
+reqs="$ca_host/overlay/var/lib/ca/$ca_name/requests/$type"
+if [ ! -d $reqs ]; then
+   echo "*** ERROR - missing request directory $reqs"
+   exit 1
+fi
+
+openssl req -config $cfg -new -newkey rsa:4096 -sha256 -keyout $key -nodes -out $csr
+mv $csr "$reqs/$host.csr"
+git add "$reqs/$host.csr" && git commit -m "certification request for $host from $ca_host:$ca_name"
+
+if [ -d $host ]; then
+   ssh root@$host mkdir -p /etc/ssl/private && scp "$key" "root@$host:/etc/ssl/private/${host}_${ca_name}.key" && rm -f "$key" && echo "** private key given to $host" || echo "** private key left in $key - should be in root@$host:/etc/ssl/private/${host}_${ca_name}.key"
+fi
+
+echo "** successfully generated key and certification request for $host from $ca_host:$ca_name"