First commit, mainly documentation, license.

~*

*~

*.swp

*.swo

certs/*

keys/*

config

The MIT License (MIT)

Copyright (c) [year] [fullname]

Permission is hereby granted, free of charge, to any person obtaining a copy

of this software and associated documentation files (the "Software"), to deal

in the Software without restriction, including without limitation the rights

to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

copies of the Software, and to permit persons to whom the Software is

furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

SOFTWARE.

.PHONY: install

install:

	cp ssl-ca /usr/local/bin/ssl-ca

	chmod 755 /usr/local/bin/ssl-ca

SSL-CA

######

This is a program (written in POSIX shell) to generate an SSL/TLS certificate

authority, signed certificates and to sign existing certificates.

Installation

------------

::

    git clone https://www.shore.co.il/cgit/ssl-ca

    cd ssl-ca

    sudo make install

The dependencies are openssl, getopt and a POSIX shell.

Usage

-----

To start a new CA ::

    $ ssl-ca init workca

This will create a new directory with the directory structure and an example

configuration file. **Remember to change the configuration in the config file.**

To generate a new CA key and certificate (inside the new directory)::

    $ ssl-ca ca-gen

To generate a new key and certificate for the www.example.com domain ::

    $ ssl-ca gen www.example.com

The key will be at ``keys/www.example.com.key`` and the certificate at

``certs/www.example.com.pem``.

To sign existing keys, copy them to ``keys/subdomain.domain.tld.key`` and run (this will sign all of keys found under ``keys/``) ::

    $ ssl-ca sign

To resign **ALL** existing keys (overriding existing certificates) ::

    $ ssl-ca resign

Example config

-------------

::

    # This file is sourced by the shell script program, so comments start with #

    # and usual shell evaluation and variables can be used.

    # No setting is mandatory and missing setting will be left blank or the

    # default value will be used.

    keysize=2048

    keytype='rsa'

    cipher='aes256'

    days=365

    countrycode='US'

    state='Somewhere'

    locality='Some other place.'

    orgname='Acme'

    orgunit='Widgets'

    email='hostmaster@example.com'

TODO

----

- Write said program.

- Fill out example output in the usage section.

#!/bin/sh -e

usage ()

{

}

init ()

{

}

sign_key ()

{

}

gen_key ()

{

}

ca_gen ()

{

}