mirror of
https://github.com/outbackdingo/matchbox.git
synced 2026-01-27 10:19:35 +00:00
1f96cd36b2
* Add initrd=main karg directive for UEFI (ignored by BIOS) * Update Butane config version to v1.4.0 (generates Ignition v3.3.0) in `fedora-coreos` and `fedora-coreos-install` examples * Update virt-install flag --os-variant * Removed virt-install deprecated flag --os-type * Remove virt-install QEMU/KVM event preserve since it apparently wasn't implemented anyway and QEMU/KVM now warns about it * Remove serial consol kernel argument from examples, but still mention it in docs Rel: * https://github.com/coreos/fedora-coreos-docs/pull/282 * https://www.spinics.net/linux/fedora/libvir/msg222078.html
48 lines
1.8 KiB
Bash
Executable File
48 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# note: Script uses -batch and -subj, instead of interactive prompts.
|
|
set -e
|
|
|
|
rm -f ca.key ca.crt server.key server.csr server.crt client.key client.csr client.crt index.* serial*
|
|
rm -rf certs crl newcerts
|
|
|
|
if [ -z $SAN ]
|
|
then echo "Set SAN with a DNS or IP for matchbox (e.g. export SAN=DNS.1:matchbox.example.com,IP.1:172.17.0.2)."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Creating example CA, server cert/key, and client cert/key..."
|
|
|
|
# basic files/directories
|
|
mkdir -p {certs,crl,newcerts}
|
|
touch index.txt
|
|
touch index.txt.attr
|
|
echo 1000 > serial
|
|
|
|
# CA private key (unencrypted)
|
|
openssl genrsa -out ca.key 4096
|
|
# Certificate Authority (self-signed certificate)
|
|
openssl req -config openssl.conf -new -x509 -days 3650 -sha256 -key ca.key -extensions v3_ca -out ca.crt -subj "/CN=fake-ca"
|
|
|
|
# End-entity certificates
|
|
|
|
# Server private key (unencrypted)
|
|
openssl genrsa -out server.key 2048
|
|
# Server certificate signing request (CSR)
|
|
openssl req -config openssl.conf -new -sha256 -key server.key -out server.csr -subj "/CN=fake-server"
|
|
# Certificate Authority signs CSR to grant a certificate
|
|
openssl ca -batch -config openssl.conf -extensions server_cert -days 365 -notext -md sha256 -in server.csr -out server.crt -cert ca.crt -keyfile ca.key
|
|
|
|
# Client private key (unencrypted)
|
|
openssl genrsa -out client.key 2048
|
|
# Signed client certificate signing request (CSR)
|
|
openssl req -config openssl.conf -new -sha256 -key client.key -out client.csr -subj "/CN=fake-client"
|
|
# Certificate Authority signs CSR to grant a certificate
|
|
openssl ca -batch -config openssl.conf -extensions usr_cert -days 365 -notext -md sha256 -in client.csr -out client.crt -cert ca.crt -keyfile ca.key
|
|
|
|
# Remove CSR's
|
|
rm *.csr
|
|
|
|
echo "*******************************************************************"
|
|
echo "WARNING: Generated credentials are self-signed. Prefer your"
|
|
echo "organization's PKI for production deployments."
|