exit 1
fi
+umask 0066 # Prevent others from reading any files creating on local fs
+
+ WORKDIR=/tmp/domtool-keyreq
KEYDIR=`domtool-config -path cert keys`/$USER
KEYFILE=$KEYDIR/key.pem
CERTFILE=`domtool-config -path cert certs`/$USER.pem
- NEWREQ=~/.newreq.pem
- NEW=~/.new.pem
- KEYIN=~/.keyin
+ NEWREQ=$WORKDIR/.newreq.pem
+ NEW=$WORKDIR/.new.pem
+ KEYIN=$WORKDIR/.keyin
+ NEWCERT=$WORKDIR/.cert
CACONF=`domtool-config -path cert ca`/domtool-openssl.conf
+mkdir $WORKDIR && chmod 700 $WORKDIR || (echo Cannot create work dir ; exit 1)
+
mkdir $KEYDIR || echo Key directory already exists.
openssl genrsa -out $KEYFILE 4096
# chown -R domtool.nogroup $KEYDIR
if [ -z "`getent passwd $USER`" ]; then
echo "$USER does not exist. This must be a server principal."
else
- chown -R $USER.nogroup $KEYDIR
+ chown -R $USER:nogroup $KEYDIR
fi
fi
ROOTCMD=sudo
fi
-$ROOTCMD openssl ca -batch -config `domtool-config -path cert ca`/domtool-openssl.conf -out $CERTFILE -infiles $NEW
+$ROOTCMD openssl ca -batch -config `domtool-config -path cert ca`/domtool-openssl.conf -out $NEWCERT -infiles $NEW
+$ROOTCMD chown `whoami` $NEWCERT
+mv $NEWCERT $CERTFILE
rm $NEW
+rm $WORKDIR -rf
#chown domtool.nogroup $CERTFILE