config_gen

#!/bin/bash
########################################################################
#Script Name	: CRYPTOCA
#Description	: Create a CA to sign and issue certificates.
#Args           : Interactive
#Author       	: Dari Garcia (manofftoday)
#GitHub         : https://github.com/manofftoday
#File           : config_gen
#Description    : OpenSSL configuration file generator
########################################################################
function config_file(){
  unset a
  clear
  echo "Would you like to set a new configuration file?[y/n]"
  read a
  if [ "$a" = "y" ]
  then
    cat << EOF > $DIR_CA/openssl.conf
[ ca ]
# man ca
default_ca = $CA_NAME

[ $CA_NAME ]
# Directory and file locations.
dir               = $DIR_CA/
certs             = $DIR_CA/certs
crl_dir           = $DIR_CA/crl
new_certs_dir     = $DIR_CA/newcerts
database          = $DIR_CA/index.txt
serial            = $DIR_CA/serial
RANDFILE          = $DIR_CA/private/.rand

# The root key and root certificate.
private_key       = $DIR_CA/private/$CA_NAME.key.pem
certificate       = $DIR_CA/certs/$CA_NAME.cert.pem

# For certificate revocation lists.
crlnumber         = $DIR_CA/crlnumber
crl               = $DIR_CA/crl/$CA_NAME.crl.pem
crl_extensions    = crl_ext
default_crl_days  = 30

# SHA-1 is deprecated, so use SHA-2 instead.
default_md        = sha256

name_opt          = ca_default
cert_opt          = ca_default
default_days      = 375
preserve          = no
policy            = policy_strict

[ policy_strict ]
# The root CA should only sign intermediate certificates that match.
# See the POLICY FORMAT section of man ca.
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ policy_loose ]
# Allow the intermediate CA to sign a more diverse range of certificates.
# See the POLICY FORMAT section of the ca man page.
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
# Options for the req tool (man req).
default_bits        = 2048
distinguished_name  = req_distinguished_name
string_mask         = utf8only
# SHA-1 is deprecated, so use SHA-2 instead.
default_md          = sha256
# Extension to add when the -x509 option is used.
x509_extensions     = v3_ca
# Extension for SANs
req_extensions      = v3_req

[ v3_req ]
# Extensions to add to a certificate request
# Before invoke openssl use: export SAN=DNS:value1,DNS:value2
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = otherName:1.3.6.1.4.1.311.20.2.3;UTF8:1999999999123456@$CA_NAME

[ req_distinguished_name ]
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
countryName                     = Country Name (2 letter code)
stateOrProvinceName             = State or Province Name
localityName                    = Locality Name
0.organizationName              = Organization Name
organizationalUnitName          = Organizational Unit Name
commonName                      = Common Name
emailAddress                    = Email Address

# Optionally, specify some defaults.
countryName_default             = $COUNTRY
stateOrProvinceName_default     = $PROVINCE
localityName_default            = $LOCALITY
0.organizationName_default      = $OUNAME
organizationalUnitName_default  = $UNITNAME
emailAddress_default            = $EMAIL

[ v3_ca ]
# Extensions for a typical CA (man x509v3_config).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ v3_intermediate_ca ]
# Extensions for a typical intermediate CA (man x509v3_config).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ usr_cert ]
# Extensions for client certificates (man x509v3_config).
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, emailProtection

[ server_cert ]
# Extensions for server certificates (man x509v3_config).
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth

[ crl_ext ]
# Extension for CRLs (man x509v3_config).
authorityKeyIdentifier=keyid:always

[ ocsp ]
# Extension for OCSP signing certificates (man ocsp).
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, OCSPSigning
EOF
    echo "Config file deployed"
  fi
}