wn/home-automation
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

certs scripts

Browse Source
This commit is contained in:
Wolfgang Hottgenroth
2025-11-30 16:05:41 +01:00
parent 1078e4cd53
commit 6d0f38965d
5 changed files with 54 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@@ -66,3 +66,5 @@ apps/homekit/homekit.state
tools/ca/ tools/ca/
tools/clients/ tools/clients/
tools/certificates/
tools/certificates.tgz

42
tools/create-client-cert.sh
View File

@@ -12,7 +12,7 @@ CLIENT_NAME="$1"
P12_PASSWORD="$2" P12_PASSWORD="$2"
# Check if CA exists # Check if CA exists
if [ ! -f "ca/ca.crt" ] || [ ! -f "ca/ca.key" ]; then if [ ! -f "certificates/ca/ca.crt" ] || [ ! -f "certificates/ca/ca.key" ]; then
echo "Error: CA not found. Please run setup-ca.sh first." echo "Error: CA not found. Please run setup-ca.sh first."
exit 1 exit 1
fi fi
@@ -21,49 +21,47 @@ echo "=== Creating Client Certificate ==="
echo "Client Name: $CLIENT_NAME" echo "Client Name: $CLIENT_NAME"
# Create client directory # Create client directory
mkdir -p clients/$CLIENT_NAME mkdir -p certificates/clients/$CLIENT_NAME
# Generate client private key # Generate client private key
echo "Generating client private key..." echo "Generating client private key..."
openssl genrsa -out clients/$CLIENT_NAME/$CLIENT_NAME.key 2048 openssl genrsa -out certificates/clients/$CLIENT_NAME/$CLIENT_NAME.key 2048
# Generate client certificate signing request # Generate client certificate signing request
echo "Generating client certificate signing request..." echo "Generating client certificate signing request..."
openssl req -new -key clients/$CLIENT_NAME/$CLIENT_NAME.key \ openssl req -new -key certificates/clients/$CLIENT_NAME/$CLIENT_NAME.key \
-out clients/$CLIENT_NAME/$CLIENT_NAME.csr \ -out certificates/clients/$CLIENT_NAME/$CLIENT_NAME.csr \
-subj "/DC=de/DC=hottis/DC=homea2/CN=$CLIENT_NAME" -subj "/DC=de/DC=hottis/DC=homea2/CN=$CLIENT_NAME"
# Sign the client certificate # Sign the client certificate
echo "Signing client certificate..." echo "Signing client certificate..."
openssl x509 -req -in clients/$CLIENT_NAME/$CLIENT_NAME.csr \ openssl x509 -req -in certificates/clients/$CLIENT_NAME/$CLIENT_NAME.csr \
-CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial \ -CA certificates/ca/ca.crt -CAkey certificates/ca/ca.key -CAcreateserial \
-out clients/$CLIENT_NAME/$CLIENT_NAME.crt \ -out certificates/clients/$CLIENT_NAME/$CLIENT_NAME.crt \
-days 365 -sha256 -days 365 -sha256
# Create PKCS#12 bundle # Create PKCS#12 bundle
echo "Creating PKCS#12 bundle..." echo "Creating PKCS#12 bundle..."
openssl pkcs12 -export \ openssl pkcs12 -export \
-out clients/$CLIENT_NAME/$CLIENT_NAME.p12 \ -out certificates/clients/$CLIENT_NAME/$CLIENT_NAME.p12 \
-inkey clients/$CLIENT_NAME/$CLIENT_NAME.key \ -inkey certificates/clients/$CLIENT_NAME/$CLIENT_NAME.key \
-in clients/$CLIENT_NAME/$CLIENT_NAME.crt \ -in certificates/clients/$CLIENT_NAME/$CLIENT_NAME.crt \
-certfile ca/ca.crt \ -certfile certificates/ca/ca.crt \
-name "$CLIENT_NAME Home Automation Client" \ -name "$CLIENT_NAME Home Automation Client" \
-passout pass:$P12_PASSWORD -passout pass:$P12_PASSWORD
# Set appropriate permissions # Set appropriate permissions
chmod 400 clients/$CLIENT_NAME/$CLIENT_NAME.key chmod 400 certificates/clients/$CLIENT_NAME/$CLIENT_NAME.key
chmod 644 clients/$CLIENT_NAME/$CLIENT_NAME.crt chmod 644 certificates/clients/$CLIENT_NAME/$CLIENT_NAME.crt
chmod 644 clients/$CLIENT_NAME/$CLIENT_NAME.p12 chmod 644 certificates/clients/$CLIENT_NAME/$CLIENT_NAME.p12
# Verify client certificate # Verify client certificate
echo "Verifying client certificate..." echo "Verifying client certificate..."
openssl x509 -noout -text -in clients/$CLIENT_NAME/$CLIENT_NAME.crt openssl x509 -noout -text -in certificates/clients/$CLIENT_NAME/$CLIENT_NAME.crt
echo "" echo ""
echo "=== Client Certificate Created ===" echo "=== Client Certificate Created ==="
echo "Client Certificate: clients/$CLIENT_NAME/$CLIENT_NAME.crt" echo "Client Certificate: certificates/clients/$CLIENT_NAME/$CLIENT_NAME.crt"
echo "Client Private Key: clients/$CLIENT_NAME/$CLIENT_NAME.key" echo "Client Private Key: certificates/clients/$CLIENT_NAME/$CLIENT_NAME.key"
echo "PKCS#12 Bundle: clients/$CLIENT_NAME/$CLIENT_NAME.p12" echo "PKCS#12 Bundle: certificates/clients/$CLIENT_NAME/$CLIENT_NAME.p12"
echo "" echo ""
echo "Installation Instructions:" echo "Installation Instructions:"
echo "1. Import the PKCS#12 file into your browser/application" echo "1. Import the PKCS#12 file into your browser/application"
@@ -71,4 +69,4 @@ echo "2. The bundle contains both the client certificate and CA certificate"
echo "3. Password for PKCS#12 file: $P12_PASSWORD" echo "3. Password for PKCS#12 file: $P12_PASSWORD"
echo "" echo ""
echo "For testing with curl:" echo "For testing with curl:"
echo "curl --cert clients/$CLIENT_NAME/$CLIENT_NAME.crt --key clients/$CLIENT_NAME/$CLIENT_NAME.key --cacert ca/ca.crt https://homea2.hottis.de/" echo "curl --cert certificates/clients/$CLIENT_NAME/$CLIENT_NAME.crt --key certificates/clients/$CLIENT_NAME/$CLIENT_NAME.key https://homea2.hottis.de/"

13
tools/decrypt-certificates.sh Executable file
View File

@@ -0,0 +1,13 @@
#!/bin/bash
set -e
gpg --decrypt --pinentry-mode=loopback --output secrets.tgz secrets.asc
tar -xzvf secrets.tgz ./secret-configuration/
rm secrets.tgz

13
tools/encrypt-certificates.sh Executable file
View File

@@ -0,0 +1,13 @@
#!/bin/bash
set -e
tar -czvf certificates.tgz ./certificates/
gpg --symmetric --cipher-algo AES256 --armor --pinentry-mode=loopback --output certificates.asc certificates.tgz
rm certificates.tgz

13
tools/setup-ca.sh
View File

@@ -4,21 +4,20 @@ set -e
echo "=== mTLS CA Setup ===" echo "=== mTLS CA Setup ==="
# Create CA directory # Create CA directory
mkdir -p ca mkdir -p certificates/ca
# Generate CA private key # Generate CA private key
echo "Generating CA private key..." echo "Generating CA private key..."
openssl genrsa -out ca/ca.key 2048 openssl genrsa -out certificates/ca/ca.key 2048
# Generate CA certificate # Generate CA certificate
echo "Generating CA certificate..." echo "Generating CA certificate..."
openssl req -new -x509 -days 3650 -key ca/ca.key -out ca/ca.crt \ openssl req -new -x509 -days 3650 -key certificates/ca/ca.key -out certificates/ca/ca.crt \
-subj "/DC=de/DC=hottis/DC=homea2/CN=Home Automation CA" -subj "/DC=de/DC=hottis/DC=homea2/CN=Home Automation CA"
echo "" echo ""
echo "=== CA Setup Complete ===" echo "=== CA Setup Complete ==="
echo "CA Certificate: ca/ca.crt" echo "CA Certificate: certificates/ca/ca.crt"
echo "CA Private Key: ca/ca.key" echo "CA Private Key: certificates/ca/ca.key"
echo "" echo ""
echo "Deploy to Kubernetes:" echo "Deploy to Kubernetes:"
echo "kubectl create secret generic mtls-ca-cert --from-file=ca.crt=ca/ca.crt -n homea2" echo "kubectl create secret generic mtls-ca-cert --from-file=ca.crt=certificates/ca/ca.crt -n homea2"