68 lines
2.9 KiB
Bash
68 lines
2.9 KiB
Bash
#!/usr/bin/env bash
|
|
# admin-pki.sh — issue the broker's admin-plane mTLS PKI.
|
|
#
|
|
# SECURITY: the admin client CA MUST be SEPARATE from the fleet CA. If you reused
|
|
# the fleet root as the client CA, any host's *enrolment* cert (signed by that
|
|
# same root) would also authenticate to the admin plane — a privilege escalation
|
|
# letting an enrolled host approve enrolments. So this mints a DEDICATED admin CA,
|
|
# the broker's TLS server cert, and one client cert (+ .p12 for browser import)
|
|
# per named admin.
|
|
#
|
|
# Usage: admin-pki.sh <out-dir> [admin-name ...]
|
|
# e.g. ./admin-pki.sh ../dot1x-bench/pki/broker alice bob
|
|
#
|
|
# Then point the broker at:
|
|
# BROKER_ADMIN_CERT=<out-dir>/server.crt
|
|
# BROKER_ADMIN_KEY=<out-dir>/server.key
|
|
# BROKER_ADMIN_CLIENT_CA=<out-dir>/admin-ca.crt
|
|
# and import clients/<name>.p12 (empty password) into each admin's browser.
|
|
set -euo pipefail
|
|
|
|
OUT=${1:?usage: admin-pki.sh <out-dir> [admin-name ...]}
|
|
shift || true
|
|
ADMINS=("$@")
|
|
[ ${#ADMINS[@]} -eq 0 ] && ADMINS=(admin)
|
|
SAN=${BROKER_ADMIN_SAN:-"IP:127.0.0.1,DNS:localhost"}
|
|
DAYS=${BROKER_ADMIN_DAYS:-825}
|
|
|
|
mkdir -p "$OUT/clients"
|
|
cd "$OUT"
|
|
|
|
# --- dedicated admin CA (separate from the fleet CA) ------------------------
|
|
if [ ! -f admin-ca.crt ]; then
|
|
echo "==> creating admin CA"
|
|
openssl ecparam -name prime256v1 -genkey -noout -out admin-ca.key
|
|
openssl req -x509 -new -key admin-ca.key -days "$DAYS" \
|
|
-subj "/CN=fleet enrol-broker admin CA" -out admin-ca.crt
|
|
fi
|
|
|
|
# --- broker TLS server cert -------------------------------------------------
|
|
echo "==> issuing broker server cert (SAN $SAN)"
|
|
openssl ecparam -name prime256v1 -genkey -noout -out server.key
|
|
openssl req -new -key server.key -subj "/CN=enrol-broker-admin" -out server.csr
|
|
openssl x509 -req -in server.csr -CA admin-ca.crt -CAkey admin-ca.key -CAcreateserial \
|
|
-days "$DAYS" -extfile <(printf "subjectAltName=%s\nextendedKeyUsage=serverAuth" "$SAN") \
|
|
-out server.crt
|
|
rm -f server.csr
|
|
|
|
# --- one client cert (+ .p12) per admin ------------------------------------
|
|
for a in "${ADMINS[@]}"; do
|
|
echo "==> issuing admin client cert: $a"
|
|
openssl ecparam -name prime256v1 -genkey -noout -out "clients/$a.key"
|
|
openssl req -new -key "clients/$a.key" -subj "/CN=$a" -out "clients/$a.csr"
|
|
openssl x509 -req -in "clients/$a.csr" -CA admin-ca.crt -CAkey admin-ca.key -CAcreateserial \
|
|
-days "$DAYS" -extfile <(printf "extendedKeyUsage=clientAuth") -out "clients/$a.crt"
|
|
rm -f "clients/$a.csr"
|
|
openssl pkcs12 -export -inkey "clients/$a.key" -in "clients/$a.crt" -certfile admin-ca.crt \
|
|
-name "fleet enrol admin: $a" -passout pass: -out "clients/$a.p12"
|
|
done
|
|
|
|
chmod 600 ./*.key clients/*.key 2>/dev/null || true
|
|
|
|
echo
|
|
echo "done. broker env:"
|
|
echo " BROKER_ADMIN_CERT=$(pwd)/server.crt"
|
|
echo " BROKER_ADMIN_KEY=$(pwd)/server.key"
|
|
echo " BROKER_ADMIN_CLIENT_CA=$(pwd)/admin-ca.crt"
|
|
echo "import clients/<name>.p12 (empty password) into each admin's browser."
|