basic shell scripts for to create certs

diff --git a/certification-authority.sh b/certification-authority.sh
new file mode 100755 (executable)
index 0000000..1b534f5
--- /dev/null
+++ b/certification-authority.sh
@@ -0,0 +1,9 @@
+cd /etc/strongswan/ipsec.d/
+strongswan pki --gen --type rsa --size 4096 --outform pem \
+       > private/strongswanKey.pem
+chmod 600 private/strongswanKey.pem
+strongswan pki --self --ca --lifetime 3650 \
+       --in private/strongswanKey.pem --type rsa \
+       --dn "C=JP, O=ROB-VPN-JP, CN=207.148.98.140" \
+       --outform pem \
+       > cacerts/strongswanCert.pem

diff --git a/outputPKCS12.sh b/outputPKCS12.sh
new file mode 100755 (executable)
index 0000000..74a249b
--- /dev/null
+++ b/outputPKCS12.sh
@@ -0,0 +1,6 @@
+cd /etc/strongswan/ipsec.d/
+openssl pkcs12 -export -inkey private/RobKey.pem \
+       -in certs/RobCert.pem -name "Rob's Certifcate" \
+       -certfile cacerts/strongswanCert.pem \
+       -caname "207.148.98.140" \
+       -out Rob.p12

diff --git a/revoke-certificate.sh_ b/revoke-certificate.sh_
new file mode 100644 (file)
index 0000000..dda80ea
--- /dev/null
+++ b/revoke-certificate.sh_
@@ -0,0 +1,6 @@
+$ cd /etc/ipsec.d/
+$ ipsec pki --signcrl --reason key-compromise \
+       --cacert cacerts/strongswanCert.pem \
+       --cakey private/strongswanKey.pem \
+       --cert certs/AlexanderCert.pem \
+       --outform pem > crls/crl.pem

diff --git a/server-certificate.sh b/server-certificate.sh
new file mode 100755 (executable)
index 0000000..e3c5995
--- /dev/null
+++ b/server-certificate.sh
@@ -0,0 +1,13 @@
+cd /etc/strongswan/ipsec.d/
+strongswan pki --gen --type rsa --size 2048 \
+       --outform pem \
+       > private/vpnHostKey.pem
+chmod 600 private/vpnHostKey.pem
+strongswan pki --pub --in private/vpnHostKey.pem --type rsa | \
+       strongswan pki --issue --lifetime 730 \
+       --cacert cacerts/strongswanCert.pem \
+       --cakey private/strongswanKey.pem \
+       --dn "C=JP, O=ROB-VPN-JP, CN=207.148.98.140" \
+       --san 207.148.98.140 \
+       --flag serverAuth --flag ikeIntermediate \
+       --outform pem > certs/vpnHostCert.pem

diff --git a/user-certificate.sh b/user-certificate.sh
new file mode 100755 (executable)
index 0000000..ad489b7
--- /dev/null
+++ b/user-certificate.sh
@@ -0,0 +1,12 @@
+cd /etc/strongswan/ipsec.d/
+strongswan pki --gen --type rsa --size 2048 \
+       --outform pem \
+       > private/RobKey.pem
+chmod 600 private/RobKey.pem
+strongswan pki --pub --in private/RobKey.pem --type rsa | \
+       strongswan pki --issue --lifetime 730 \
+       --cacert cacerts/strongswanCert.pem \
+       --cakey private/strongswanKey.pem \
+       --dn "C=JP, O=ROB-VPN-JP, CN=rakrens@gmail.com" \
+       --san rakrens@gmail.com \
+       --outform pem > certs/RobCert.pem

diff --git a/x509certificates-shellscripts.tar.gz b/x509certificates-shellscripts.tar.gz
new file mode 100644 (file)
index 0000000..3e8e8fa
Binary files /dev/null and b/x509certificates-shellscripts.tar.gz differ