|
1 #!/usr/bin/perl |
|
2 |
|
3 use strict; |
|
4 use warnings; |
|
5 use if $ENV{DEBUG} => "Smart::Comments"; |
|
6 my $pfad='/home/zert/CA'; |
|
7 &menue; |
|
8 |
|
9 sub menue { |
|
10 my $eg=""; |
|
11 system ('clear'); |
|
12 do { |
|
13 print " Willkommen beim SSL-Certificator, Ihrem nuetzlichem Perlprogramm\n zum einfachen erstellen von SSL-Zertifikaten.\n\n\n"; |
|
14 print " Menue\n\n"; |
|
15 print " n - Neues Root-Zertifikat erstellen\n r - Request erstellen\n s - Request signieren\n w - Zertifikat wiederrufen\n a - Annulierungsliste erstellen\n\n q - Beenden\n\n "; |
|
16 chomp ($eg=<STDIN>); |
|
17 if ($eg eq 'q'){ |
|
18 system ('clear'); |
|
19 exit; |
|
20 } |
|
21 if ($eg eq 'n'){ |
|
22 system ('clear'); |
|
23 &rootca; |
|
24 } |
|
25 if ($eg eq 's'){ |
|
26 system ('clear'); |
|
27 &sign; |
|
28 } |
|
29 if ($eg eq 'r'){ |
|
30 system ('clear'); |
|
31 &request; |
|
32 } |
|
33 if ($eg eq 'w'){ |
|
34 system ('clear'); |
|
35 &revoke; |
|
36 } |
|
37 if ($eg eq 'a'){ |
|
38 system ('clear'); |
|
39 &revlist; |
|
40 } |
|
41 } |
|
42 until ($eg ne 'n'|$eg ne 's'|$eg ne 'r'|$eg ne 'a'|$eg ne 'q'|$eg ne 'w'); |
|
43 } |
|
44 sub rootca { |
|
45 my $days; |
|
46 my $pk; |
|
47 my $rca; |
|
48 print " Ihr Zertifikat wird erstellt. Bitte warten Sie.\n"; |
|
49 print " ...\n "; |
|
50 system ("/bin/mkdir -p $pfad/newcerts"); |
|
51 system ("/bin/mkdir -p $pfad/private"); |
|
52 system ("/bin/echo '01' >$pfad/serial"); |
|
53 if (-e "$pfad/index.txt"){ |
|
54 system ("/bin/rm $pfad/index.txt"); |
|
55 } |
|
56 system ("/bin/touch $pfad/index.txt"); |
|
57 open (CONF, ">$pfad/openssl.cnf"); |
|
58 print CONF "#\n# OpenSSL configuration file.\n#\n\n# Establish working directory.\n\ndir = $pfad\n\n[ req ]\ndefault_bits\t\t= 1024\t\t# Size of keys\ndefault_keyfile\t\t= key.pem\t\t# name of generated keys\ndefault_md\t\t= md5\t\t# message digest algorithm\nstring_mask\t\t= nombstr\t\t# permitted characters\ndistinguished_name\t= req_distinguished_name\n\n[ req_distinguished_name ]\n# Variable name\t\t\t Prompt string\n#----------------------\t ----------------------------------\n0.organizationName\t= Organization Name (company)\norganizationalUnitName\t= Organizational Unit Name (department, division)\nemailAddress\t\t= Email Address\nemailAddress_max\t= 40\nlocalityName\t\t= Locality Name (city, district)\nstateOrProvinceName\t= State or Province Name (full name)\ncountryName\t\t= Country Name (2 letter code)\ncountryName_min\t\t= 2\ncountryName_max\t\t= 2\ncommonName\t\t= Common Name (hostname, IP, or your name)\ncommonName_max\t\t= 64\n\n# Default values for the above, for consistency and less typing.\n# Variable name\t\t\t Value\n#------------------------------\t ------------------------------\n0.organizationName_default\t= Your Company\nlocalityName_default\t\t= Your City\nstateOrProvinceName_default\t= Your Province\ncountryName_default\t\t= OO\n\n[ v3_ca ]\nbasicConstraints\t= CA:TRUE\nsubjectKeyIdentifier\t= hash\nauthorityKeyIdentifier\t= keyid:always,issuer:always"; |
|
59 close CONF; |
|
60 <STDIN>; |
|
61 do { |
|
62 system('clear'); |
|
63 print " Wie lange soll das Zertifikat gueltig sein? (Angabe in Tagen)\n "; |
|
64 chomp ($days=<STDIN>); |
|
65 } |
|
66 while ($days !~ m/\d*/); |
|
67 system('clear'); |
|
68 print " Ihr Zertifikat wird $days Tage gueltig sein.\n "; |
|
69 system ("/usr/bin/openssl req -new -x509 -extensions v3_ca -keyout $pfad/private/cakey.pem -out $pfad/cacert.pem -days $days -config $pfad/openssl.cnf"); |
|
70 <STDIN>; |
|
71 do { |
|
72 system('clear'); |
|
73 print " Moechten Sie sich den Private Key ansehen?\n\n j - ja\n n - nein\n\n "; |
|
74 chomp ($pk=<STDIN>); |
|
75 system('clear'); |
|
76 if ($pk eq 'j') { |
|
77 system ("/bin/cat $pfad/private/cakey.pem"); |
|
78 <STDIN>; |
|
79 } |
|
80 } |
|
81 until ($pk ne 'j'|$pk ne 'n'); |
|
82 do { |
|
83 system('clear'); |
|
84 print " Moechten Sie sich das Zertifikat ansehen?\n\n j - ja\n n - nein\n\n "; |
|
85 chomp ($rca=<STDIN>); |
|
86 system('clear'); |
|
87 if ($rca eq 'j') { |
|
88 system ("/bin/cat $pfad/cacert.pem"); |
|
89 <STDIN>; |
|
90 } |
|
91 } |
|
92 until ($rca ne 'j'|$rca ne 'n'); |
|
93 system ('clear'); |
|
94 &menue; |
|
95 } |
|
96 sub request { |
|
97 my $egreq; |
|
98 my $rootpf; |
|
99 my $config; |
|
100 my $eg; |
|
101 do { |
|
102 system ('clear'); |
|
103 print " Konfigurationsdatei erstellen oder Pfad angeben?\n\n e - erstellen\n p - Pfad angeben\n\n "; |
|
104 chomp ($eg=<STDIN>); |
|
105 system ('clear'); |
|
106 } |
|
107 until ($eg ne 'e' |$eg ne 'p'); |
|
108 if ($eg eq 'e') { |
|
109 if (-d $pfad){ |
|
110 open (CONF, ">$pfad/openssl.cnf"); |
|
111 print CONF "#\n# OpenSSL configuration file.\n#\n\n# Establish working directory.\n\ndir = $pfad\n\n[ req ]\ndefault_bits\t\t= 1024\t\t# Size of keys\ndefault_keyfile\t\t= key.pem\t\t# name of generated keys\ndefault_md\t\t= md5\t\t# message digest algorithm\nstring_mask\t\t= nombstr\t\t# permitted characters\ndistinguished_name\t= req_distinguished_name\nreq_extensions\t\t= v3_req\n\n[ req_distinguished_name ]\n# Variable name\t\t\t Prompt string\n#----------------------\t ----------------------------------\n0.organizationName\t= Organization Name (company)\norganizationalUnitName\t= Organizational Unit Name (department, division)\nemailAddress\t\t= Email Address\nemailAddress_max\t= 40\nlocalityName\t\t= Locality Name (city, district)\nstateOrProvinceName\t= State or Province Name (full name)\ncountryName\t\t= Country Name (2 letter code)\ncountryName_min\t\t= 2\ncountryName_max\t\t= 2\ncommonName\t\t= Common Name (hostname, IP, or your name)\ncommonName_max\t\t= 64\n\n# Default values for the above, for consistency and less typing.\n# Variable name\t\t\t Value\n#------------------------------\t ------------------------------\n0.organizationName_default\t= Your Company\nlocalityName_default\t\t= Your City\nstateOrProvinceName_default\t= Your Province\ncountryName_default\t\t= OO\n\n[ v3_ca ]\nbasicConstraints\t\t= CA:TRUE\nsubjectKeyIdentifier\t\t= hash\nauthorityKeyIdentifier\t\t= keyid:always,issuer:always\n\n[ v3_req ]\nbasicConstraints\t\t= CA:FALSE\nsubjectKeyIdentifier\t\t= hash"; |
|
112 close CONF; |
|
113 } |
|
114 else { |
|
115 system ("/bin/mkdir $pfad"); |
|
116 open (CONF, ">$pfad/openssl.cnf"); |
|
117 print CONF "#\n# OpenSSL configuration file.\n#\n\n# Establish working directory.\n\ndir = $pfad\n\n[ req ]\ndefault_bits\t\t= 1024\t\t# Size of keys\ndefault_keyfile\t\t= key.pem\t\t# name of generated keys\ndefault_md\t\t= md5\t\t# message digest algorithm\nstring_mask\t\t= nombstr\t\t# permitted characters\ndistinguished_name\t= req_distinguished_name\nreq_extensions\t\t= v3_req\n\n[ req_distinguished_name ]\n# Variable name\t\t\t Prompt string\n#----------------------\t ----------------------------------\n0.organizationName\t= Organization Name (company)\norganizationalUnitName\t= Organizational Unit Name (department, division)\nemailAddress\t\t= Email Address\nemailAddress_max\t= 40\nlocalityName\t\t= Locality Name (city, district)\nstateOrProvinceName\t= State or Province Name (full name)\ncountryName\t\t= Country Name (2 letter code)\ncountryName_min\t\t= 2\ncountryName_max\t\t= 2\ncommonName\t\t= Common Name (hostname, IP, or your name)\ncommonName_max\t\t= 64\n\n# Default values for the above, for consistency and less typing.\n# Variable name\t\t\t Value\n#------------------------------\t ------------------------------\n0.organizationName_default\t= Your Company\nlocalityName_default\t\t= Your City\nstateOrProvinceName_default\t= Your Province\ncountryName_default\t\t= OO\n\n[ v3_ca ]\nbasicConstraints\t\t= CA:TRUE\nsubjectKeyIdentifier\t\t= hash\nauthorityKeyIdentifier\t\t= keyid:always,issuer:always\n\n[ v3_req ]\nbasicConstraints\t\t= CA:FALSE\nsubjectKeyIdentifier\t\t= hash"; |
|
118 close CONF; |
|
119 } |
|
120 print " Konfigurationsdatei erstellt $pfad/openssl.cnf\n "; |
|
121 <STDIN>; |
|
122 } |
|
123 if ($eg eq 'p') { |
|
124 system('clear'); |
|
125 print " Bitte geben Sie den Pfad zu Ihrer Konfigurationsdatei an.\n "; |
|
126 chomp ($config=<STDIN>); |
|
127 system ('clear'); |
|
128 print " Bitte achten Sie darauf, dass sie den Common Name aendern, sodass er zu Ihrer Domain passt.\n Bsp.:\n\n Domain: hostname.domainname\n secure.yourdomain.de\n\n "; |
|
129 system ("/usr/bin/openssl req -new -nodes -out $pfad/req.pem -config $config"); |
|
130 } |
|
131 else { |
|
132 system('clear'); |
|
133 print " Bitte achten Sie darauf, dass sie den Common Name aendern, sodass er zu Ihrer Domain passt.\n Bsp.:\n\n Domain: hostname.domainname\n secure.yourdomain.de "; |
|
134 system ("/usr/bin/openssl req -new -nodes -out $pfad/req.pem -config $pfad/openssl.cnf"); |
|
135 } |
|
136 <STDIN>; |
|
137 do { |
|
138 system ('clear'); |
|
139 print " Request ueberpruefen?\n\n j - ja\n n - nein\n\n "; |
|
140 chomp ($egreq=<STDIN>); |
|
141 if ($egreq eq 'j'){ |
|
142 system('clear'); |
|
143 system ("/usr/bin/openssl req -in $pfad/req.pem -text -verify -noout"); |
|
144 <STDIN>; |
|
145 } |
|
146 } |
|
147 until ($egreq ne 'j'|$egreq ne 'n'); |
|
148 system ('clear'); |
|
149 &menue; |
|
150 } |
|
151 sub sign { |
|
152 my $eg; |
|
153 open (CONF,">$pfad/openssl.cnf"); |
|
154 print CONF "#\n# OpenSSL configuration file.\n#\n\n# Establish working directory.\n\ndir = $pfad\n\n[ ca ]\ndefault_ca\t\t= CA_default\n\n[ CA_default ]\nserial\t\t\t= \$dir/serial\ndatabase\t\t= \$dir/index.txt\nnew_certs_dir\t\t= \$dir/newcerts\ncertificate\t\t= \$dir/cacert.pem\nprivate_key\t\t= \$dir/private/cakey.pem\ndefault_days\t\t= 365\ndefault_md\t\t= md5\npreserve\t\t= no\nemail_in_dn\t\t= no\nnameopt\t\t\t= default_ca\ncertopt\t\t\t= default_ca\npolicy\t\t\t= policy_match\n\n[ policy_match ]\ncountryName\t\t= match\nstateOrProvinceName\t= match\norganizationName\t= match\norganizationalUnitName\t= optional\ncommonName\t\t= supplied\nemailAddress\t\t= optional\n\n[ req ]\ndefault_bits\t\t= 1024\t\t# Size of keys\ndefault_keyfile\t\t= key.pem\t\t# name of generated keys\ndefault_md\t\t= md5\t\t# message digest algorithm\nstring_mask\t\t= nombstr\t\t# permitted characters\ndistinguished_name\t= req_distinguished_name\nreq_extensions\t\t= v3_req\n\n[ req_distinguished_name ]\n# Variable name\t\t\t Prompt string\n#----------------------\t ----------------------------------\n0.organizationName\t= Organization Name (company)\norganizationalUnitName\t= Organizational Unit Name (department, division)\nemailAddress\t\t= Email Address\nemailAddress_max\t= 40\nlocalityName\t\t= Locality Name (city, district)\nstateOrProvinceName\t= State or Province Name (full name)\ncountryName\t\t= Country Name (2 letter code)\ncountryName_min\t\t= 2\ncountryName_max\t\t= 2\ncommonName\t\t= Common Name (hostname, IP, or your name)\ncommonName_max\t\t= 64\n\n# Default values for the above, for consistency and less typing.\n# Variable name\t\t\t Value\n#------------------------------\t ------------------------------\n0.organizationName_default\t= Your Company\nlocalityName_default\t\t= Your City\nstateOrProvinceName_default\t= Your Province\ncountryName_default\t\t= OO\n\n[ v3_ca ]\nbasicConstraints\t\t= CA:TRUE\nsubjectKeyIdentifier\t\t= hash\nauthorityKeyIdentifier\t\t= keyid:always,issuer:always\n[ v3_req ]\nbasicConstraints\t\t= CA:FALSE\nsubjectKeyIdentifier\t\t= hash"; |
|
155 system ("/usr/bin/openssl ca -out $pfad/cert.pem -config $pfad/openssl.cnf -infiles $pfad/req.pem"); |
|
156 print "Zertifikat wurde unterzeichnet"; |
|
157 <STDIN>; |
|
158 do { |
|
159 system ('clear'); |
|
160 print "Zertifikat ueberpruefen?\n\n j - ja\n n - nein\n\n"; |
|
161 chomp ($eg=<STDIN>); |
|
162 if ($eg eq 'j') { |
|
163 system("/usr/bin/openssl x509 -in $pfad/cert.pem -noout -text -purpose | /bin/more"); |
|
164 <STDIN>; |
|
165 } |
|
166 } |
|
167 until ($eg ne 'j'|$eg ne 'n'); |
|
168 $eg=''; |
|
169 do { |
|
170 system ('clear'); |
|
171 print "Sollen die lesbaren Elemente aus dem Zertifikat entfernt werden?\n\n j - ja\n n - nein\n\n"; |
|
172 chomp ($eg=<STDIN>); |
|
173 if ($eg eq 'j') { |
|
174 print "...\n"; |
|
175 system ("/bin/mv $pfad/cert.pem $pfad/tmp.pem"); |
|
176 system ("/usr/bin/openssl x509 -in $pfad/tmp.pem -out $pfad/cert.pem"); |
|
177 print "Alle lesbaren Elemente wurden entfernt."; |
|
178 <STDIN>; |
|
179 } |
|
180 } |
|
181 until ($eg ne 'j'|$eg ne 'n'); |
|
182 &menue; |
|
183 } |
|
184 sub revoke { |
|
185 my $eg; |
|
186 do { |
|
187 print "Welches Zertifikat soll wiederrufen werden?\nFuer Informationen zu allen Zertifikaten, schauen\nSie in die Datei index.txt.\n"; |
|
188 print "Datei öffnen?\n\nj - ja\nn - nein\n\n"; |
|
189 chomp ($eg=<STDIN>); |
|
190 if ($eg eq 'j'){ |
|
191 open (INDEX, "<$pfad/index.txt"); |
|
192 my @index = <INDEX>; |
|
193 print sort @index; |
|
194 <STDIN>; |
|
195 } |
|
196 } |
|
197 until ($eg eq 'j'|$eg eq 'n'); |
|
198 print "Welches Zertifikat soll wiederrufen werden?\n(Geben Sie die 2-stellige Nummer ein)\n"; |
|
199 chomp ($eg=<STDIN>); |
|
200 system ("/usr/bin/openssl ca -revoke $pfad/newcerts/$eg.pem -config $pfad/openssl.cnf"); |
|
201 print "Zertifikat $eg wiederrufen."; |
|
202 <STDIN>; |
|
203 &menue; |
|
204 } |
|
205 sub revlist { |
|
206 system ("/usr/bin/openssl ca -gencrl -crldays 31 -config $pfad/openssl.cnf -out $pfad/rootca.crl"); |
|
207 print "Certicate Revocation List erstellt"; |
|
208 <STDIN>; |
|
209 &menue; |
|
210 } |