SSL certificate factory

#!/bin/bash

export SCRIPT_PATH=$( cd "$(dirname "${BASH_SOURCE}")" ; pwd -P )

DEFAULT_DOMAIN='reverse.com'
DEFAULT_IP='123.123.123.123'

# create certificates
# $ make tls-server example.com ssl
# $ make tls-server sub.example.com ssl
# creates example.com.ssl.tls-server.crt:
# - request created with example.com.tls-server.cnf
# - signed by example.com.ca-tls.crt using config example.com.ca-tls.cnf


check_result()
{
    if [ $1 -ne 0 ]; then
        echo -e "\e[91m        Error\e[39m $2"
        exit $1
    fi
    echo -e "\e[92m        +\e[39m"
}

warn_result()
{
    if [ $1 -ne 0 ]; then
        echo -e "\e[93m        Warning\e[39m $2"
    fi
}

check_prompt()
{
    if [ $1 -ne 0 ]; then
        warn_result "$@"
        read -p 'Would you like to continue [y/n]: ' answer
        if [ "$answer" != 'y' ] && [ "$answer" != 'Y'  ]; then
            echo 'Goodbye'
            exit 1
        fi
    fi
}

domainPath()
{
    local domain=$1
    local lookup="$SCRIPT_PATH/$DEFAULT_DOMAIN/lookup"
    local path=$lookup/$domain

    if [ -e $path ]; then
        echo $(head -n 1 $path)
    fi
}

# type: for avail crt-types see crt-*/etc/*.cnf {email|tls-client|tls-server|code-signing}
# domain: a valid domain, stored in /lookup
# fileName: a unique filename. If the file exists, the last version will be revoked as affiliationChanged
#
# files will be stored in ./crt-*/$domain.$filename.$type.ext
# ---
# make tls-server example.com ssl
# ---
make()
{
    local type=$1
    local domain=$2
    local fileName=$3


    local path=$(domainPath $domain)
    if [ -z $path ]; then
        check_result 1 "domain $domain not found in $SCRIPT_PATH/$DEFAULT_DOMAIN"
    fi

    local baseType
    case "$type" in
            email)
                baseType='email'
                echo "create $baseType/$type"
                ;;
            tls-server|tls-client)
                baseType='tls'
                echo "create $baseType/$type"
                ;;
            code-signing)
                baseType='software'
                echo "create $baseType/$type"
                ;;
            *)
                check_result 1 "invalid request type $type; {email|tls-client|tls-server|code-signing}"
                exit 1
    esac

    local lvl=$(grep -o '/intermediate/' <<< "$path" | wc -l)
    case "$lvl" in
        0)
            export CA_0_SCRIPT_PATH="$path"
            ;;
        1)
            export CA_1_SCRIPT_PATH="$path"
            ;;
        2)
            export CA_2_SCRIPT_PATH="$path"
            ;;
    esac

    local caCrl="$path/ca-$baseType/db/$domain.ca-$baseType.crl"
    local caCnf="$path/ca-$baseType/etc/$domain.ca-$baseType.cnf"
    local caPwd="$path/ca-$baseType/private/$domain.ca-$baseType.pwd"
    local csrCnf="$path/crt-$baseType/etc/$domain.$type.cnf"
    local key="$path/crt-$baseType/private/$domain.$fileName.$type.key"
    local csr="$path/crt-$baseType/$domain.$fileName.$type.csr"
    local crt="$path/crt-$baseType/$domain.$fileName.$type.crt"
    local p12="$path/crt-$baseType/$domain.$fileName.$type.p12"
    local chain="$path/$domain.ca-$baseType.chain.pem"

    if [ -e $crt ]; then
        local lastSrl=$(openssl x509 -in $crt -serial -noout)
        local lastFnr=$(openssl x509 -in $crt -fingerprint -noout)

        check_prompt 1 "certificate $domain.$fileName.$type.crt exists as \n\t$lastSrl\n\t$lastFnr\nRevoke this version and create a new verion."

        echo 'Please set the revokation reason, type any other key to continue without setting the CRL reason.'
        echo '[1] unspecified'
        echo '[2] keyCompromise'
        echo '[3] CACompromise'
        echo '[4] affiliationChanged'
        echo '[5] superseded'
        echo '[6] cessationOfOperation'
        echo '[7] certificateHold'
        echo '[8] removeFromCRL'
        read -p 'Please set the revokation reason [1-8]: ' answer

        local revokationReason=no
        case "$answer" in
                1)
                    revokationReason=unspecified
                    ;;
                2)
                    revokationReason=keyCompromise
                    ;;
                3)
                    revokationReason=CACompromise
                    ;;
                4)
                    revokationReason=affiliationChanged
                    ;;
                5)
                    revokationReason=superseded
                    ;;
                6)
                    revokationReason=cessationOfOperation
                    ;;
                7)
                    revokationReason=certificateHold
                    ;;
                8)
                    revokationReason=removeFromCRL
                    ;;
                *)
                    warn_result 1 'Nothing matched. Continue without setting a reason.'
        esac

        if [ $revokationReason == 'no' ]; then
            openssl ca \
                -config $caCnf \
                -revoke $crt \
                -passin file:$caPwd
        else
            openssl ca \
                -config $caCnf \
                -revoke $crt \
                -passin file:$caPwd \
                -crl_reason $revokationReason
        fi

        openssl ca -gencrl \
            -config $caCnf \
            -out $caCrl \
            -passin file:$caPwd
    fi

    # note -subj
    # if you want to use multiple values you should remove the -subj and use the prompt.
    # /O/ST must match, see CA-configs.
    # I prefer to bypass the prompt for ~300 domains with ~2k subdomains.
    case "$type" in
            tls-server)
                export SAN="DNS:$domain,DNS:*.$domain"
                openssl req -new \
                    -config $csrCnf \
                    -out $csr \
                    -keyout $key \
                    -subj "/C=BE/ST=Antwerp/O=### Network $domain/CN=$domain"

                openssl ca \
                    -batch \
                    -config $caCnf \
                    -in $csr \
                    -out $crt \
                    -passin file:$caPwd \
                    -extensions server_ext

                openssl pkcs12 -export \
                    -name "$domain (TLS Network Component)" \
                    -inkey $key \
                    -passout pass:\
                    -in $crt \
                    -certfile $chain \
                    -out $p12

                ;;

            *)
                check_result 1 "invalid request type $type; {email|tls-client|tls-server|code-signing}"
                exit 1
    esac
}