46 lines
1.8 KiB
Bash
46 lines
1.8 KiB
Bash
#!/usr/bin/env bash
|
||
# 生成内网专用 CA 与服务器证书（自受管内部信任，不涉及公网域名）。
|
||
# 用法：在正式环境 deploy/ 目录执行 ./tls/gen-cert.sh
|
||
# 可用环境变量覆盖：
|
||
# CERT_IP 对外访问 IP（默认 192.168.200.36）
|
||
# CERT_DNS 额外 DNS 名称（空格分隔，默认 caiwuzongzhang.jinniu.internal）
|
||
# 输出：tls/certs/{ca.crt,ca.key,server.crt,server.key}（key 永不入库、不分发）
|
||
# 分发：仅把 ca.crt 发给公司电脑安装（受信任的根证书颁发机构）。
|
||
set -euo pipefail
|
||
ROOT="$(cd "$(dirname "$0")" && pwd)"
|
||
CERTS="$ROOT/certs"
|
||
mkdir -p "$CERTS"
|
||
cd "$CERTS"
|
||
|
||
CERT_IP="${CERT_IP:-192.168.200.36}"
|
||
CERT_DNS="${CERT_DNS:-caiwuzongzhang.jinniu.internal}"
|
||
|
||
SAN="IP:${CERT_IP}"
|
||
for d in $CERT_DNS; do SAN="$SAN,DNS:$d"; done
|
||
|
||
if [[ ! -f ca.key ]]; then
|
||
# 内部根 CA：10 年，仅本系统使用
|
||
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 \
|
||
-keyout ca.key -out ca.crt -days 3650 -nodes -subj "/CN=Jinniu Ledger Internal CA" \
|
||
-addext "basicConstraints=critical,CA:TRUE" \
|
||
-addext "keyUsage=critical,keyCertSign,cRLSign"
|
||
chmod 600 ca.key
|
||
echo "ca 已生成"
|
||
fi
|
||
|
||
openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 \
|
||
-keyout server.key -out server.csr -nodes \
|
||
-subj "/CN=${CERT_DNS%% *}" >/dev/null 2>&1
|
||
cat > server.ext <<EXT
|
||
subjectAltName=${SAN}
|
||
basicConstraints=CA:FALSE
|
||
keyUsage=digitalSignature,keyEncipherment
|
||
extendedKeyUsage=serverAuth
|
||
EXT
|
||
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
|
||
-out server.crt -days 1825 -sha256 -extfile server.ext >/dev/null 2>&1
|
||
chmod 600 server.key
|
||
rm -f server.csr server.ext ca.srl
|
||
echo "server 证书已生成（SAN: ${SAN}），有效期 5 年"
|
||
echo "分发文件：${CERTS}/ca.crt（其余文件不得离开本机）"
|