48 lines
1.5 KiB
Bash
Executable File
48 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# gen-server-cert.sh — Generate the Traefik server cert for ems.famfi.dyndns.org.
|
|
#
|
|
# Signed by the private CA. Once ca.crt is trusted on a device,
|
|
# this cert is accepted without warnings.
|
|
# Renew annually (before 825-day expiry) by re-running this script.
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
cd "$SCRIPT_DIR"
|
|
|
|
DOMAIN="${1:-ems.famfi.dyndns.org}"
|
|
|
|
if [[ ! -f ca.key ]]; then
|
|
echo "ERROR: ca.key not found. Run gen-ca.sh first."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Generating server cert for ${DOMAIN}..."
|
|
|
|
openssl req -newkey rsa:2048 -nodes \
|
|
-keyout server.key \
|
|
-out server.csr \
|
|
-subj "/CN=${DOMAIN}/O=FamFi/C=DE"
|
|
|
|
openssl x509 -req \
|
|
-in server.csr \
|
|
-CA ca.crt \
|
|
-CAkey ca.key \
|
|
-CAcreateserial \
|
|
-out server.crt \
|
|
-days 825 \
|
|
-sha256 \
|
|
-extfile <(printf "basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:%s\nsubjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid" "$DOMAIN")
|
|
|
|
chmod 600 server.key
|
|
rm -f server.csr
|
|
|
|
echo ""
|
|
echo "Done: server.crt + server.key for ${DOMAIN}"
|
|
echo ""
|
|
echo "Deploy certs to Synology (run from infra/ca/):"
|
|
echo " ssh user@synology 'mkdir -p /etc/ems/certs'"
|
|
echo " scp ca.crt server.crt server.key user@synology:/etc/ems/certs/"
|
|
echo " ssh user@synology 'chmod 600 /etc/ems/certs/server.key'"
|
|
echo ""
|
|
echo "Traefik will pick up the new cert on next container restart."
|