mirror of
https://github.com/kunkundi/crossdesk-server.git
synced 2026-10-25 17:21:59 +08:00
84 lines
2.5 KiB
Bash
84 lines
2.5 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
# 检查参数
|
|
if [ "$#" -lt 1 ] || [ "$#" -gt 2 ]; then
|
|
echo "Usage: $0 <SERVER_IP> [OUTPUT_DIR]"
|
|
echo " SERVER_IP: IP address for the certificate"
|
|
echo " OUTPUT_DIR: Directory to save certificates (default: current directory)"
|
|
exit 1
|
|
fi
|
|
|
|
SERVER_IP="$1"
|
|
OUTPUT_DIR="${2:-$(pwd)}"
|
|
|
|
# 确保输出目录存在
|
|
mkdir -p "$OUTPUT_DIR"
|
|
|
|
# 切换到输出目录
|
|
cd "$OUTPUT_DIR"
|
|
|
|
# 文件名（使用完整路径）
|
|
ROOT_KEY="$OUTPUT_DIR/api.crossdesk.cn_root.key"
|
|
ROOT_CERT="$OUTPUT_DIR/api.crossdesk.cn_root.crt"
|
|
SERVER_KEY="$OUTPUT_DIR/api.crossdesk.cn.key"
|
|
SERVER_CSR="$OUTPUT_DIR/api.crossdesk.cn.csr"
|
|
SERVER_CERT="$OUTPUT_DIR/api.crossdesk.cn_bundle.crt"
|
|
FULLCHAIN_CERT="$OUTPUT_DIR/api.crossdesk.cn_fullchain.crt"
|
|
SAN_CONF="$OUTPUT_DIR/san.cnf"
|
|
|
|
# 证书主题
|
|
SUBJ="/C=CN/ST=Zhejiang/L=Hangzhou/O=CrossDesk/OU=CrossDesk/CN=$SERVER_IP"
|
|
|
|
# 1. 生成根证书
|
|
echo "Generating root private key..."
|
|
openssl genrsa -out "$ROOT_KEY" 4096
|
|
|
|
echo "Generating self-signed root certificate..."
|
|
openssl req -x509 -new -nodes -key "$ROOT_KEY" -sha256 -days 3650 -out "$ROOT_CERT" -subj "$SUBJ"
|
|
|
|
# 2. 生成服务器私钥
|
|
echo "Generating server private key..."
|
|
openssl genrsa -out "$SERVER_KEY" 2048
|
|
|
|
# 3. 生成服务器 CSR
|
|
echo "Generating server CSR..."
|
|
openssl req -new -key "$SERVER_KEY" -out "$SERVER_CSR" -subj "$SUBJ"
|
|
|
|
# 4. 生成临时 OpenSSL 配置文件，加入 SAN
|
|
cat > "$SAN_CONF" <<EOL
|
|
[ req ]
|
|
default_bits = 2048
|
|
distinguished_name = req_distinguished_name
|
|
req_extensions = req_ext
|
|
prompt = no
|
|
|
|
[ req_distinguished_name ]
|
|
C = CN
|
|
ST = Zhejiang
|
|
L = Hangzhou
|
|
O = CrossDesk
|
|
OU = CrossDesk
|
|
CN = $SERVER_IP
|
|
|
|
[ req_ext ]
|
|
subjectAltName = IP:$SERVER_IP
|
|
EOL
|
|
|
|
# 5. 用根证书签发服务器证书（包含 SAN）
|
|
echo "Signing server certificate with root certificate..."
|
|
openssl x509 -req -in "$SERVER_CSR" -CA "$ROOT_CERT" -CAkey "$ROOT_KEY" -CAcreateserial \
|
|
-out "$SERVER_CERT" -days 3650 -sha256 -extfile "$SAN_CONF" -extensions req_ext
|
|
|
|
# 6. 生成完整链证书并更新 bundle.crt（包含服务器证书和根证书）
|
|
cat "$SERVER_CERT" "$ROOT_CERT" > "$FULLCHAIN_CERT"
|
|
# 将完整证书链写入 bundle.crt，这样服务器可以使用完整的证书链
|
|
cp "$FULLCHAIN_CERT" "$SERVER_CERT"
|
|
|
|
# 7. 清理中间文件
|
|
rm -f "$ROOT_CERT.srl" "$SAN_CONF" "$ROOT_KEY" "$SERVER_CSR" "$FULLCHAIN_CERT"
|
|
|
|
echo "Generation complete. Certificates saved to: $OUTPUT_DIR"
|
|
echo " Client root certificate: $ROOT_CERT"
|
|
echo " Server private key: $SERVER_KEY"
|
|
echo " Server certificate: $SERVER_CERT" |