hcoop-backup: Delete backups older than 10 days.
[clinton/scripts.git] / ca-sign
CommitLineData
4c237a24 1#!/bin/sh -e
2#
3# Sign a certificate request as a CA. Run this on deleuze as an
4# admin.
5#
6# Usage: ca-sign days request.csr out-cert-file.pem
7
8test -n "$3" || exit 1
9
10DIR=/var/local/lib/ca
11CONF=$DIR/openssl.cnf
12POLICY=policy_anything
13
14# Certificate revocation list
15CRL1=$DIR/crl-v1
16CRL2=$DIR/crl-v2
17CA_LOC=/afs/hcoop.net/user/h/hc/hcoop/public_html/ca
18
19DAYS=$1
20REQUEST=$2
21PEM=$3
22ID=$(cat -- $DIR/serial)
23
24# Sign.
25echo "Signing certificate request $REQUEST ..."
26openssl ca -config $CONF -policy $POLICY -out $PEM -in $REQUEST -days $DAYS
27echo
28
29# Make a copy of the request
30cp $REQUEST $DIR/requests/$ID.csr
31
32# Update revocation list.
33echo "Updating certificate revocation list ..."
87d0fa09 34openssl ca -config $CONF -batch -gencrl -crldays 30 -out $CRL1.pem
4c237a24 35openssl crl -outform DER -out $CRL1.crl -in $CRL1.pem
87d0fa09 36openssl ca -config $CONF -batch -gencrl -crldays 30 -crlexts crl_ext \
4c237a24 37 -out $CRL2.pem
38openssl crl -outform DER -out $CRL2.crl -in $CRL2.pem
39cp $CRL1.crl $CRL2.crl $CA_LOC
40echo
41
42echo "Don't forget to run ca-install to install the signed certificate!"