|
| 1 | +#!/usr/bin/env sh |
| 2 | + |
| 3 | +set -eu |
| 4 | + |
| 5 | +output_directory="${CERT_OUTPUT_DIRECTORY:-/certs}" |
| 6 | +ca_days="${CERT_CA_DAYS:-3650}" |
| 7 | +node_days="${CERT_NODE_DAYS:-825}" |
| 8 | +node_common_name="${CERT_NODE_COMMON_NAME:-trogondb-node}" |
| 9 | +output_owner="${CERT_OUTPUT_OWNER:-10000:10000}" |
| 10 | + |
| 11 | +expected_files=" |
| 12 | +$output_directory/ca/ca.crt |
| 13 | +$output_directory/node1/node.crt |
| 14 | +$output_directory/node1/node.key |
| 15 | +$output_directory/node2/node.crt |
| 16 | +$output_directory/node2/node.key |
| 17 | +$output_directory/node3/node.crt |
| 18 | +$output_directory/node3/node.key |
| 19 | +" |
| 20 | + |
| 21 | +validate_node() { |
| 22 | + node_name="$1" |
| 23 | + node_ip="$2" |
| 24 | + node_directory="$output_directory/$node_name" |
| 25 | + |
| 26 | + openssl verify -CAfile "$output_directory/ca/ca.crt" "$node_directory/node.crt" >/dev/null |
| 27 | + openssl verify -purpose sslserver -CAfile "$output_directory/ca/ca.crt" "$node_directory/node.crt" >/dev/null |
| 28 | + openssl verify -purpose sslclient -CAfile "$output_directory/ca/ca.crt" "$node_directory/node.crt" >/dev/null |
| 29 | + openssl x509 -in "$node_directory/node.crt" -noout -checkend 0 >/dev/null |
| 30 | + openssl x509 -in "$node_directory/node.crt" -noout -checkhost localhost >/dev/null |
| 31 | + openssl x509 -in "$node_directory/node.crt" -noout -checkhost "esdb-$node_name" >/dev/null |
| 32 | + openssl x509 -in "$node_directory/node.crt" -noout -checkip 127.0.0.1 >/dev/null |
| 33 | + openssl x509 -in "$node_directory/node.crt" -noout -checkip "$node_ip" >/dev/null |
| 34 | + test "$(openssl x509 -in "$node_directory/node.crt" -noout -subject -nameopt RFC2253)" = "subject=CN=$node_common_name" |
| 35 | + |
| 36 | + certificate_public_key="$(mktemp)" |
| 37 | + private_public_key="$(mktemp)" |
| 38 | + openssl x509 -in "$node_directory/node.crt" -pubkey -noout >"$certificate_public_key" |
| 39 | + openssl pkey -in "$node_directory/node.key" -pubout >"$private_public_key" 2>/dev/null |
| 40 | + cmp "$certificate_public_key" "$private_public_key" >/dev/null |
| 41 | + rm -f "$certificate_public_key" "$private_public_key" |
| 42 | +} |
| 43 | + |
| 44 | +normalize_output_permissions() { |
| 45 | + chown -R "$output_owner" "$output_directory" |
| 46 | + chmod 755 "$output_directory" "$output_directory/ca" |
| 47 | + chmod 700 "$output_directory"/node* |
| 48 | + chmod 600 "$output_directory"/node*/node.key |
| 49 | + chmod 644 "$output_directory/ca/ca.crt" "$output_directory"/node*/node.crt |
| 50 | +} |
| 51 | + |
| 52 | +validate_existing_certificates() { |
| 53 | + openssl verify -CAfile "$output_directory/ca/ca.crt" "$output_directory/ca/ca.crt" >/dev/null |
| 54 | + validate_node node1 172.30.240.11 |
| 55 | + validate_node node2 172.30.240.12 |
| 56 | + validate_node node3 172.30.240.13 |
| 57 | +} |
| 58 | + |
| 59 | +existing_files=0 |
| 60 | +missing_files=0 |
| 61 | + |
| 62 | +for output_path in "$output_directory" "$output_directory/ca" "$output_directory/node1" "$output_directory/node2" "$output_directory/node3"; do |
| 63 | + if [ -L "$output_path" ] || { [ -e "$output_path" ] && [ ! -d "$output_path" ]; }; then |
| 64 | + echo "Certificate output path '$output_path' must be a real directory, not a link or another file type." >&2 |
| 65 | + exit 1 |
| 66 | + fi |
| 67 | +done |
| 68 | + |
| 69 | +if [ -d "$output_directory/ca" ]; then |
| 70 | + unexpected_ca_entry="$(find "$output_directory/ca" -mindepth 1 -maxdepth 1 ! -name ca.crt -print -quit)" |
| 71 | + if [ -n "$unexpected_ca_entry" ]; then |
| 72 | + echo "Unexpected content exists in '$output_directory/ca'. Remove the local certificate directory and regenerate it so only the public ca.crt is exposed to nodes." >&2 |
| 73 | + exit 1 |
| 74 | + fi |
| 75 | +fi |
| 76 | + |
| 77 | +for expected_file in $expected_files; do |
| 78 | + if [ -L "$expected_file" ] || { [ -e "$expected_file" ] && [ ! -f "$expected_file" ]; }; then |
| 79 | + echo "Certificate output '$expected_file' must be a regular file, not a link or another file type." >&2 |
| 80 | + exit 1 |
| 81 | + elif [ -f "$expected_file" ]; then |
| 82 | + existing_files=$((existing_files + 1)) |
| 83 | + else |
| 84 | + missing_files=$((missing_files + 1)) |
| 85 | + fi |
| 86 | +done |
| 87 | + |
| 88 | +if [ "$existing_files" -gt 0 ]; then |
| 89 | + if [ "$missing_files" -gt 0 ]; then |
| 90 | + echo "Certificate output is incomplete. Remove '$output_directory' before regenerating it." >&2 |
| 91 | + exit 1 |
| 92 | + fi |
| 93 | + |
| 94 | + normalize_output_permissions |
| 95 | + validate_existing_certificates |
| 96 | + echo "Using the existing validated cluster certificates in '$output_directory'." |
| 97 | + exit 0 |
| 98 | +fi |
| 99 | + |
| 100 | +umask 077 |
| 101 | +mkdir -p "$output_directory/ca" "$output_directory/node1" "$output_directory/node2" "$output_directory/node3" |
| 102 | +private_directory="$(mktemp -d)" |
| 103 | +trap 'rm -rf "$private_directory"' EXIT |
| 104 | +ca_key="$private_directory/ca.key" |
| 105 | + |
| 106 | +openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out "$ca_key" 2>/dev/null |
| 107 | +openssl req -x509 -new -sha256 \ |
| 108 | + -key "$ca_key" \ |
| 109 | + -out "$output_directory/ca/ca.crt" \ |
| 110 | + -days "$ca_days" \ |
| 111 | + -subj "/CN=TrogonEventStore Development CA" \ |
| 112 | + -addext "basicConstraints=critical,CA:TRUE,pathlen:0" \ |
| 113 | + -addext "keyUsage=critical,keyCertSign,cRLSign" \ |
| 114 | + -addext "subjectKeyIdentifier=hash" |
| 115 | + |
| 116 | +generate_node() { |
| 117 | + node_name="$1" |
| 118 | + node_ip="$2" |
| 119 | + serial_number="$3" |
| 120 | + node_directory="$output_directory/$node_name" |
| 121 | + extension_file="$private_directory/$node_name.extensions" |
| 122 | + request_file="$private_directory/$node_name.csr" |
| 123 | + |
| 124 | + cat >"$extension_file" <<EOF |
| 125 | +[node] |
| 126 | +basicConstraints=critical,CA:FALSE |
| 127 | +keyUsage=critical,digitalSignature,keyEncipherment |
| 128 | +extendedKeyUsage=serverAuth,clientAuth |
| 129 | +subjectKeyIdentifier=hash |
| 130 | +authorityKeyIdentifier=keyid,issuer |
| 131 | +subjectAltName=DNS:localhost,DNS:esdb-$node_name,IP:127.0.0.1,IP:$node_ip |
| 132 | +EOF |
| 133 | + |
| 134 | + openssl req -new -newkey rsa:3072 -nodes -sha256 \ |
| 135 | + -keyout "$node_directory/node.key" \ |
| 136 | + -out "$request_file" \ |
| 137 | + -subj "/CN=$node_common_name" 2>/dev/null |
| 138 | + openssl x509 -req -sha256 \ |
| 139 | + -in "$request_file" \ |
| 140 | + -CA "$output_directory/ca/ca.crt" \ |
| 141 | + -CAkey "$ca_key" \ |
| 142 | + -set_serial "$serial_number" \ |
| 143 | + -days "$node_days" \ |
| 144 | + -extfile "$extension_file" \ |
| 145 | + -extensions node \ |
| 146 | + -out "$node_directory/node.crt" |
| 147 | +} |
| 148 | + |
| 149 | +generate_node node1 172.30.240.11 1001 |
| 150 | +generate_node node2 172.30.240.12 1002 |
| 151 | +generate_node node3 172.30.240.13 1003 |
| 152 | + |
| 153 | +normalize_output_permissions |
| 154 | +validate_existing_certificates |
| 155 | +echo "Generated and validated cluster certificates in '$output_directory'." |
0 commit comments