#!/bin/sh
#
# Httpd certification with RSA
#
# 2008-06-28
#   Changed for httpd-2.2
# 2004-03-28
#   Changed for Apache2
# 2003-04-22
#   Fix csr generation
# 2002-04-02
#   Changed to auto generation.
# 2001-12-02
#   This script delived from mod_ssl installation script.
#   Featureing for Plamo Linux installation.
#

confdir=$ROOT/opt/httpd/conf
sslkeydir=$ROOT/$confdir/ssl.key
sslcsrdir=$ROOT/$confdir/ssl.csr
sslcrtdir=$ROOT/$confdir/ssl.crt

openssl=$ROOT/usr/bin/openssl
if ! [ -x $openssl ]; then
   if [ -x /usr/ssl/bin/openssl ]; then
     openssl=/usr/ssl/bin/openssl
   else
      if [ -x /usr/local/bin/openssl ]; then
        openssl=/usr/local/bin/openssl
      else
        echo "############################################"
	echo "# Please run                               #"
	echo "#       $0                       #"
        echo "#               after you install openssh. #"
        echo "############################################"
      fi
   fi
fi

# STEP 1: Generating RSA private key (1024 bit) [server.key]
randfiles=''    
for file in /var/log/messages /var/adm/messages /var/log/system.log /var/wtmp \
            /kernel /kernel/genunix /vmunix /vmlinuz /mach \
            /etc/hosts /etc/group /etc/resolv.conf /bin/ls; do
    if [ -r $file ]; then
        if [ ".$randfiles" = . ]; then
            randfiles="$file"
        else
            randfiles="${randfiles}:$file" 
        fi
    fi           
done                            
$openssl genrsa -rand $randfiles -out $confdir/server.key 1024
if [ $? -ne 0 ]; then
    echo "Error: Failed to generate RSA private key" 1>&2
    exit 1
fi


# STEP 2: Generating X.509 certificate signing request [server.csr]
cat >.mkrsakey.cfg <<EOT
[ req ]
default_bits                    = 1024
distinguished_name     = req_DN
prompt                 = no

[ req_DN ]
countryName                     = JP
stateOrProvinceName             = "Namazu Loam"
localityName                    = "Namazu Village"
0.organizationName              = "Namazu Jerky, Ltd"
organizationalUnitName          = "Webserver Team"
commonName                      = LOCALHOST
emailAddress                    = root@LOCALHOST
EOT
$openssl     req -config .mkrsakey.cfg \
             -new \
             -key $confdir/server.key \
             -out $confdir/server.csr
rm -f .mkrsakey.cfg

if [ $? -ne 0 ]; then
    echo "Error: Failed to generate certificate signing request" 1>&2
    exit 1
fi


# STEP 3: Generating X.509 certificate signed by Snake Oil CA [server.crt]
cat >.mkrsakey.cfg <<EOT
extensions = x509v3
[ x509v3 ]
subjectAltName   = email:copy
nsComment        = "mod_ssl generated test server certificate"
nsCertType       = server
EOT
echo '01' >.mkrsakey.serial
days=365
$openssl x509 -extfile .mkrsakey.cfg \
              -days $days \
              -CAserial .mkrsakey.serial \
              -CA $sslcrtdir/snakeoil-ca-rsa.crt \
              -CAkey $sslkeydir/snakeoil-ca-rsa.key \
              -in $confdir/server.csr -req \
              -out $confdir/server.crt
rm -f .mkrsakey.cfg  .mkrsakey.serial

#########################################################
# Exit without verification.                            #
exit
# Actual key should be re-created for your instalation. #
#########################################################

# Verify: matching certificate & key modulus
modcrt=`$openssl x509 -noout -modulus -in $confdir/server.crt | sed -e 's;.*Modulus=;;'`
modkey=`$openssl rsa -noout -modulus -in $confdir/server.key | sed -e 's;.*Modulus=;;'`
if [ ".$modcrt" != ".$modkey" ]; then
    echo "mkrsakey.sh:Error: Failed to verify modulus on resulting X.509 certificate" 1>&2
    exit 1
fi
# Verify: matching certificate signature
$openssl verify -CAfile $sslcrtdir/snakeoil-ca-rsa.crt $confdir/server.crt
if [ $? -ne 0 ]; then
    echo "Error: Failed to verify signature on resulting X.509 certificate" 1>&2
    exit 1
fi


#########################################################
# Exitting to make plain key.                           #
# Actual key should be re-created for your instalation. #
exit
#########################################################

# STEP 4: Enrypting RSA private key with a pass phrase for security [server.key] 
# The contents of the server.key file (the generated private key) has to be
# kept secret. So we strongly recommend you to encrypt the server.key file
# with a Triple-DES cipher and a Pass Phrase.
(umask 077
 $openssl rsa -des3 \
              -in  $confdir/server.key \
              -out $confdir/server.key.crypt)
if [ $? -ne 0 ]; then
    echo "Error: Failed to encrypt $algo private key" 1>&2
    exit 1
fi
(umask 077; cp $confdir/server.key.crypt $confdir/server.key)
rm -f $confdir/server.key.crypt

