From 1aadb186aa2ac7cd3ae69c58c28e5661d2c37df6 Mon Sep 17 00:00:00 2001 From: Guillaume Thouvenin Date: Mon, 27 Jun 2016 12:10:56 +0200 Subject: [PATCH] Add script to generate certificate for plugins This patch adds a script that generates a certificate signed by the StackLight authority. The PEM file generated can be used to configure plugins with HTTPs support. Change-Id: I6ad092fa197d5d61a03f721304c8d9fe6d0a3ee1 --- fixtures/https/Readme.md | 34 ++++- fixtures/https/create_certificate.sh | 191 +++++++++++++++++++++++++++ fixtures/https/md5.txt | 2 + 3 files changed, 225 insertions(+), 2 deletions(-) create mode 100755 fixtures/https/create_certificate.sh create mode 100644 fixtures/https/md5.txt diff --git a/fixtures/https/Readme.md b/fixtures/https/Readme.md index b216cae..c1992d0 100644 --- a/fixtures/https/Readme.md +++ b/fixtures/https/Readme.md @@ -2,6 +2,10 @@ - **rootCA.key** is the key used to self-signed rootCA.pem - **rootCA.pem** is the certificate that will act as the **StackLight Root Authority** +- **md5.txt** that contains the checksum of the two previous files + +The **rootCA.pem** is the one that you need to add to your client to +authenticate certificates that will be signed by this certificate. The certificate has the following information: ``` @@ -29,8 +33,34 @@ the client by using the correct option. # Create a certificate -Follow these steps to generate a new certificate that can be used to enable -HTTPS for the StackLight plugins. +To create a certificate you just need to run the script +**create_certificate.sh** provided in this directory. You must pass the common +name that will be used in the certificate by your plugin. For example if you +need a certificate for the *Elasticsearch-Kibana* plugin and if you will +access to server using the FQDN *kibana.fuel.local* you will generate the +certificate by running: +``` +create_certificate.sh kibana.fuel.local +``` + +It will create four files: +- kibana.key: the private key +- kibana.csr: the certificate singing request. The script will create a + certificate with the following parameters: + - Common Name: *kibana.fuel.local* (that parameter you gave to the script) + - Organization: *Mirantis* + - Organizational Unit: *Fuel plugins* + - City: *Grenoble* + - State: *Rhone-Alpes* + - Country: *FR* +- kibana.crt: The certificate signed by the StackLight authority +- kibana.pem: The concatenation of the CRT certificate and the private key + +Only **kibana.pem** is needed for configuring the Fuel plugin. Currently you +can only pass the common name as a parameter. + +If you don't want to use the script and prefer to do it manually, follow these +steps: - Generate the key for the plugin _my-plugin_. ``` diff --git a/fixtures/https/create_certificate.sh b/fixtures/https/create_certificate.sh new file mode 100755 index 0000000..94fb66b --- /dev/null +++ b/fixtures/https/create_certificate.sh @@ -0,0 +1,191 @@ +#!/bin/bash + +if [ "$#" -lt 1 ]; then + echo "Usage: $0 " + exit 1 +fi + +CN="$1" +BASE=$(echo "$CN" | awk -F'.' '{print $1}') +SUBJECT="/C=FR/ST=Rhone-Alpes/L=Grenoble/O=Mirantis/OU=Fuel plugins/CN=$CN" + +# We only check that openssl is available +OPENSSL=$(which openssl) +if [ "$?" -ne 0 ]; then + echo "openssl: command not found" + exit 1 +fi + +# First we create the private key +$OPENSSL genrsa -out "$BASE.key" 2048 +if [ "$?" -ne 0 ]; then + echo "Failed to create $BASE.key" + exit 1 +fi +echo "Creation of $BASE.key done" + +# Then we create the certificate signing request for BASE +$OPENSSL req -new -key "$BASE.key" -out "$BASE.csr" -subj "$SUBJECT" +if [ "$?" -ne 0 ]; then + echo "Failed to create the CSR $BASE.csr" + exit 1 +fi +echo "Creation of $BASE.csr done" + +# Sign it with the CA root key +ROOTKEY=$(cat < "$MD5FILE" + +md5sum -c "$MD5FILE" +if [ "$?" -ne 0 ]; then + echo "Failed to validate checksum for $ROOTKEYFILE/$ROOTPEMFILE" + exit 1 +fi + +$OPENSSL x509 -req -in "$BASE.csr" \ + -CAkey "$ROOTKEYFILE" \ + -CA "$ROOTPEMFILE" \ + -CAcreateserial -out "$BASE.crt" -days 500 -sha256 +if [ "$?" -ne 0 ]; then + echo "Failed to create the signed certificate $BASE.crt" + exit 1 +fi +echo "Creation of $BASE.crt done" + +# Concatenate file +cat "$BASE.crt" "$BASE.key" > "$BASE.pem" +echo "Creation of $BASE.pem done" + +# Cleanup +rm -f "$BASE.key" "$BASE.csr" "$BASE.crt" +rm -f "$ROOTKEYFILE" "$ROOTPEMFILE" "$MD5FILE" diff --git a/fixtures/https/md5.txt b/fixtures/https/md5.txt new file mode 100644 index 0000000..c7a8fb2 --- /dev/null +++ b/fixtures/https/md5.txt @@ -0,0 +1,2 @@ +8e3c74e6a6f143c902540968fce833d2 rootCA.key +9f9813ac87039b621d50a47d20cc3568 rootCA.pem