41 lines
1.3 KiB
Bash
Executable File
41 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# gen-ca.sh — Generate the EMS root CA (one-time operation).
|
|
#
|
|
# Outputs: ca.key (KEEP SECRET) and ca.crt (distribute to all devices).
|
|
# ca.key must be backed up encrypted and kept off the Synology.
|
|
# Losing ca.key means all devices must re-enroll after generating a new CA.
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
cd "$SCRIPT_DIR"
|
|
|
|
if [[ -f ca.key ]]; then
|
|
echo "ERROR: ca.key already exists."
|
|
echo "Delete it explicitly if you intend to replace the CA."
|
|
echo "WARNING: a new CA invalidates ALL existing server and client certs — every device must re-enroll."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Generating EMS root CA (RSA-4096, 10 years)..."
|
|
|
|
openssl req -x509 -newkey rsa:4096 -sha256 \
|
|
-days 3650 \
|
|
-keyout ca.key \
|
|
-out ca.crt \
|
|
-nodes \
|
|
-subj "/CN=EMS Private CA/O=FamFi/C=DE" \
|
|
-addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
|
|
-addext "keyUsage=critical,keyCertSign,cRLSign" \
|
|
-addext "subjectKeyIdentifier=hash"
|
|
|
|
chmod 600 ca.key
|
|
|
|
echo ""
|
|
echo "Done."
|
|
echo " ca.crt — distribute to devices (install as trusted root)"
|
|
echo " ca.key — KEEP SECRET: store in encrypted backup, remove from Synology after cert issuance"
|
|
echo ""
|
|
echo "Next steps:"
|
|
echo " ./gen-server-cert.sh # server cert for Traefik"
|
|
echo " ./issue-client-cert.sh <name> # one per device"
|