PR: 1847

# default openssl.cnf file has setup as per the following

# demoCA ... where everything is stored

cp_pem() {

    infile=$1

    outfile=$2

    bound=$3

    flag=0

    exec <$infile;

    while read line; do

	if [ $flag -eq 1 ]; then

		echo $line|grep "^-----END.*$bound"  2>/dev/null 1>/dev/null

		if [ $? -eq 0 ] ; then

			echo $line >>$outfile

			break

		else

			echo $line >>$outfile

		fi

	fi

	echo $line|grep "^-----BEGIN.*$bound"  2>/dev/null 1>/dev/null

	if [ $? -eq 0 ]; then

		echo $line >$outfile

		flag=1

	fi

    done

}

usage() {

 echo "usage: $0 -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify" >&2

}

if [ -z "$OPENSSL" ]; then OPENSSL=openssl; fi

DAYS="-days 365"	# 1 year

if [ -z "$DAYS" ] ; then DAYS="-days 365" ; fi	# 1 year

CADAYS="-days 1095"	# 3 years

REQ="$OPENSSL req $SSLEAY_CONFIG"

CA="$OPENSSL ca $SSLEAY_CONFIG"

VERIFY="$OPENSSL verify"

X509="$OPENSSL x509"

PKCS12="openssl pkcs12"

CATOP=./demoCA

if [ -z "$CATOP" ] ; then CATOP=./demoCA ; fi

CAKEY=./cakey.pem

CAREQ=./careq.pem

CACERT=./cacert.pem

for i

do

case $i in

RET=0

while [ "$1" != "" ] ; do

case $1 in

-\?|-h|-help)

    echo "usage: CA -newcert|-newreq|-newca|-sign|-verify" >&2

    usage

    exit 0

    ;;

-newcert)

    RET=$?

    echo "Request is in newreq.pem, private key is in newkey.pem"

    ;;

-newreq-nodes) 

    # create a certificate request

    $REQ -new -nodes -keyout newreq.pem -out newreq.pem $DAYS

    RET=$?

    echo "Request (and private key) is in newreq.pem"

    ;;

-newca)

    # if explicitly asked for or it doesn't exist then setup the directory

    # structure that Eric likes to manage things

    NEW="1"

    if [ "$NEW" -o ! -f ${CATOP}/serial ]; then

	# create the directory hierarchy

	mkdir ${CATOP} 

	mkdir ${CATOP}/certs 

	mkdir ${CATOP}/crl 

	mkdir ${CATOP}/newcerts

	mkdir ${CATOP}/private

	echo "00" > ${CATOP}/serial

	mkdir -p ${CATOP}

	mkdir -p ${CATOP}/certs

	mkdir -p ${CATOP}/crl

	mkdir -p ${CATOP}/newcerts

	mkdir -p ${CATOP}/private

	touch ${CATOP}/index.txt

    fi

    if [ ! -f ${CATOP}/private/$CAKEY ]; then

	# ask user for existing CA certificate

	if [ "$FILE" ]; then

	    cp $FILE ${CATOP}/private/$CAKEY

	    cp_pem $FILE ${CATOP}/private/$CAKEY PRIVATE

	    cp_pem $FILE ${CATOP}/$CACERT CERTIFICATE

	    RET=$?

	    if [ ! -f "${CATOP}/serial" ]; then

		$X509 -in ${CATOP}/$CACERT -noout -next_serial \

		      -out ${CATOP}/serial

	    fi

	else

	    echo "Making CA certificate ..."

	    $REQ -new -keyout ${CATOP}/private/$CAKEY \

			   -out ${CATOP}/$CAREQ

	    $CA -out ${CATOP}/$CACERT $CADAYS -batch \

	    $CA -create_serial -out ${CATOP}/$CACERT $CADAYS -batch \

			   -keyfile ${CATOP}/private/$CAKEY -selfsign \

			   -extensions v3_ca \

			   -infiles ${CATOP}/$CAREQ

	    RET=$?

	fi

    $CA -policy policy_anything -infiles newreq.pem

    RET=$?

    ;;

-pkcs12)

    if [ -z "$2" ] ; then

	CNAME="My Certificate"

    else

	CNAME="$2"

    fi

    $PKCS12 -in newcert.pem -inkey newreq.pem -certfile ${CATOP}/$CACERT \

	    -out newcert.p12 -export -name "$CNAME"

    RET=$?

    exit $RET

    ;;

-sign|-signreq)

    $CA -policy policy_anything -out newcert.pem -infiles newreq.pem

    RET=$?

    cat newcert.pem

    echo "Signed certificate is in newcert.pem"

    ;;

-signCA)

    $CA -policy policy_anything -out newcert.pem -extensions v3_ca -infiles newreq.pem

    RET=$?

    echo "Signed CA certificate is in newcert.pem"

    ;;

-signcert)

    echo "Cert passphrase will be requested twice - bug?"

    $X509 -x509toreq -in newreq.pem -signkey newreq.pem -out tmp.pem

    $CA -policy policy_anything -out newcert.pem -infiles tmp.pem

    RET=$?

    cat newcert.pem

    echo "Signed certificate is in newcert.pem"

    ;;

	    fi

	done

    fi

    exit 0

    exit $RET

    ;;

*)

    echo "Unknown arg $i";

    echo "Unknown arg $i" >&2

    usage

    exit 1

    ;;

esac

shift

done

exit $RET