58 lines
1.6 KiB
Bash
Executable File
58 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# issue-client-cert.sh — Issue a client cert for one device.
|
|
#
|
|
# Usage: ./issue-client-cert.sh <device-name>
|
|
# Example: ./issue-client-cert.sh lutz-iphone
|
|
#
|
|
# Outputs <device-name>.p12 — install on the device after enrolling ca.crt.
|
|
# See enroll-iphone.md for the full iPhone enrollment flow.
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
cd "$SCRIPT_DIR"
|
|
|
|
NAME="${1:?Usage: $0 <device-name> e.g.: $0 lutz-iphone}"
|
|
|
|
if [[ ! -f ca.key ]]; then
|
|
echo "ERROR: ca.key not found. Run gen-ca.sh first."
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -f "${NAME}.p12" ]]; then
|
|
echo "WARNING: ${NAME}.p12 already exists. Overwriting."
|
|
fi
|
|
|
|
echo "Issuing client cert for: ${NAME}"
|
|
echo "You will be prompted for a PKCS12 export password."
|
|
echo "Use a strong password — you will need it during iPhone installation."
|
|
echo ""
|
|
|
|
openssl req -newkey rsa:2048 -nodes \
|
|
-keyout "${NAME}.key" \
|
|
-out "${NAME}.csr" \
|
|
-subj "/CN=${NAME}/O=FamFi/C=DE"
|
|
|
|
openssl x509 -req \
|
|
-in "${NAME}.csr" \
|
|
-CA ca.crt \
|
|
-CAkey ca.key \
|
|
-CAcreateserial \
|
|
-out "${NAME}.crt" \
|
|
-days 825 \
|
|
-sha256 \
|
|
-extfile <(printf "basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature\nextendedKeyUsage=clientAuth\nsubjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid")
|
|
|
|
openssl pkcs12 -export \
|
|
-out "${NAME}.p12" \
|
|
-inkey "${NAME}.key" \
|
|
-in "${NAME}.crt" \
|
|
-certfile ca.crt \
|
|
-name "${NAME} EMS"
|
|
|
|
chmod 600 "${NAME}.key" "${NAME}.p12"
|
|
rm -f "${NAME}.csr" "${NAME}.crt"
|
|
|
|
echo ""
|
|
echo "Done: ${NAME}.p12"
|
|
echo "AirDrop to iPhone, then follow enroll-iphone.md."
|