feat: scripts
This commit is contained in:
478
scripts/tinyca.js
Normal file
478
scripts/tinyca.js
Normal file
@@ -0,0 +1,478 @@
|
||||
#! /usr/bin/env runjs
|
||||
|
||||
requireJS('component-json.js');
|
||||
requireJS('component-colorprint.js');
|
||||
requireJS('component-gpg.js');
|
||||
|
||||
requireJAR('bcpkix-jdk15on-154.jar');
|
||||
requireJAR('bcprov-ext-jdk15on-154.jar');
|
||||
requireJAR('bcprov-jdk15on-154.jar');
|
||||
requireJAR('crypto-1.0.jar');
|
||||
|
||||
var StringReader = java.io.StringReader;
|
||||
var BufferedReader = java.io.BufferedReader;
|
||||
var TimeUnit = java.util.concurrent.TimeUnit;
|
||||
var Bytes = Packages.me.hatter.tools.commons.bytes.Bytes;
|
||||
var PEMUtil = Packages.me.hatter.tools.commons.security.pem.PEMUtil;
|
||||
var UnixArgsUtil = Packages.me.hatter.tools.commons.args.UnixArgsUtil;
|
||||
var X509CertUtil = Packages.me.hatter.tools.commons.security.cert.X509CertUtil;
|
||||
var PrivateKeyParseTool = Packages.me.hatter.tools.commons.security.rsa.PrivateKeyParseTool;
|
||||
var KeyPairGenerateTool = Packages.me.hatter.tools.commons.security.key.KeyPairGenerateTool;
|
||||
var CertificateAuthority = Packages.me.hatter.tools.crypto.ca.CertificateAuthority;
|
||||
|
||||
|
||||
var printHelp = () => {
|
||||
println('tinyca.js - Tiny CA.')
|
||||
println();
|
||||
println('tinyca.js <type> <command>');
|
||||
println('type - _, global, ca, intermediate, server, client');
|
||||
println('command, cases below:');
|
||||
println(' type = _, global - init');
|
||||
println(' type = ca - create, list, delete');
|
||||
println(' type = intermediate - create, list, delete');
|
||||
println(' type = server - create, list, delete');
|
||||
println(' type = client - create, list, delete');
|
||||
println('params:');
|
||||
println(' -type <rsa,ec> - RSA or EC');
|
||||
println(' -keyLength <len> - Key length');
|
||||
println(' -validYear <year> - Valid year(s)');
|
||||
println(' -certId <certId> - Cert ID');
|
||||
println(' -subject <subject> - Subject');
|
||||
println(' -dnsName <name,name> - DNS name(s)');
|
||||
};
|
||||
|
||||
var dvalue = (key) => {
|
||||
var ks = key.split(/\./g);
|
||||
var val = $GLOBAL();
|
||||
for (var i = 0; i < ks.length; i++) {
|
||||
var val2 = val[ks[i]];
|
||||
if (val2 == null) { return null; }
|
||||
val = val2;
|
||||
}
|
||||
return val;
|
||||
};
|
||||
|
||||
var getTypeKeyLengthKeyPair = (ty) => {
|
||||
var type = UnixArgsUtil.ARGS.kvalue('type', dvalue('GLOBAL_CA_CONFIG.defaults.' + ty + '.type') || dvalue('GLOBAL_CA_CONFIG.defaults._.type'));
|
||||
var keyLength = UnixArgsUtil.ARGS.kvalue('keyLength', 0);
|
||||
var kpt = KeyPairGenerateTool.instance();
|
||||
|
||||
if (type.toUpperCase() == 'RSA') {
|
||||
kpt.rsa();
|
||||
if (keyLength == 0) {
|
||||
kpt.keyLength(dvalue('GLOBAL_CA_CONFIG.defaults.' + ty + '.keyLength.RSA') || dvalue('GLOBAL_CA_CONFIG.defaults._.keyLength.RSA'));
|
||||
}
|
||||
} else if (type.toUpperCase() == 'EC') {
|
||||
kpt.ec();
|
||||
if (keyLength == 0) {
|
||||
kpt.keyLength(dvalue('GLOBAL_CA_CONFIG.defaults.' + ty + '.keyLength.EC') || dvalue('GLOBAL_CA_CONFIG.defaults._.keyLength.EC'));
|
||||
}
|
||||
} else {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Unknown type: ' + type);
|
||||
}
|
||||
if (keyLength < 0) {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Key length invalid: ' + keyLength);
|
||||
} else if (keyLength > 0) {
|
||||
kpt.keyLength(keyLength);
|
||||
}
|
||||
|
||||
return [type, keyLength, kpt.generate()];
|
||||
};
|
||||
|
||||
var displayLimitChars = (str) => {
|
||||
if (str.length < 80) {
|
||||
return str;
|
||||
}
|
||||
return str.substring(0, 87) + '...';
|
||||
};
|
||||
|
||||
var listCerts = (dir) => {
|
||||
$ARRAY(dir.listFiles()).forEach((d) => {
|
||||
var fileCert = $$.file(d, 'cert.pem');
|
||||
if (!fileCert.exists()) {
|
||||
println(colorPrint.warning.render('[WARN]') + 'No cert found in: ' + d.getName());
|
||||
return;
|
||||
}
|
||||
var certs = X509CertUtil.parseX509CertificateList($$.rFile(fileCert).bytes());
|
||||
if ((certs == null) || (certs.size() == 0)) {
|
||||
println(colorPrint.warning.render('[WARN]') + 'No cert found in: ' + fileCert);
|
||||
return;
|
||||
} else if (certs.size() > 1) {
|
||||
println(colorPrint.warning.render('[WARN]') + 'More than one certs found in: ' + fileCert);
|
||||
return;
|
||||
}
|
||||
var cert = certs.get(0);
|
||||
var isValid = (cert.getNotBefore().getTime() <= $$.date().millis()) && (cert.getNotAfter().getTime() >= $$.date().millis());
|
||||
println(colorPrint.bold.render('CERT ID: ')
|
||||
+ colorPrint.underline.render(d.getName())
|
||||
+ ' '
|
||||
+ (isValid? colorPrint.okgreen.render('[VALID]'): colorPrint.okgreen.render('[EXPIRED]'))
|
||||
+ (isValid? (' left ' + colorPrint.underline.render(parseInt((cert.getNotAfter().getTime() - $$.date().millis()) / TimeUnit.DAYS.toMillis(1))) + ' day(s)'): '')
|
||||
);
|
||||
println(' Subject : ' + cert.getSubjectDN());
|
||||
println(' Issuer : ' + cert.getIssuerDN());
|
||||
if ((cert.getSubjectAlternativeNames() != null) && (cert.getSubjectAlternativeNames().size() > 0)) {
|
||||
println(' Alt Subject : ' + cert.getSubjectAlternativeNames());
|
||||
}
|
||||
println(' NotBefore : ' + cert.getNotBefore());
|
||||
println(' NotAfter : ' + cert.getNotAfter());
|
||||
if (UnixArgsUtil.ARGS.flags().containsAny('v', 'verbose')) {
|
||||
var pkLines = $STR(cert.getPublicKey()).split("\n");
|
||||
println(' PublicKey : ' + pkLines[0]);
|
||||
for (var i = 1; i < pkLines.length; i++) {
|
||||
println(' : ' + displayLimitChars(pkLines[i]));
|
||||
}
|
||||
println(' Issuer : ' + cert.getIssuerDN());
|
||||
println(' Sign Alg : ' + cert.getSigAlgName());
|
||||
// println(' Sign Alg OID : ' + cert.getSigAlgOID());
|
||||
println(' Signature : ' + displayLimitChars(Bytes.from(cert.getSignature()).asHex()));
|
||||
}
|
||||
});
|
||||
};
|
||||
|
||||
var writeCert = (kp, cert, dir) => {
|
||||
var serialNo = Bytes.from(cert.getSerialNumber().toByteArray()).asHex().toUpperCase();
|
||||
if (serialNo.startsWith('00')) { serialNo = serialNo.substring(2); }
|
||||
var dirSerialNo = $$.file(dir, serialNo);
|
||||
dirSerialNo.mkdirs();
|
||||
|
||||
var filePrivKey = $$.file(dirSerialNo, 'privkey.pem');
|
||||
var filePrivKeyEncypted = $$.file(dirSerialNo, 'privkey.pem.asc');
|
||||
var filePubKey = $$.file(dirSerialNo, 'pubkey.pem');
|
||||
var fileCert = $$.file(dirSerialNo, 'cert.pem');
|
||||
|
||||
if (filePrivKey.exists() || filePrivKeyEncypted.exists() || filePubKey.exists() || fileCert.exists()) {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Serial number already exsists: ' + serialNo);
|
||||
return;
|
||||
}
|
||||
|
||||
$$.rFile(filePrivKey).write(PEMUtil.printPEM('PRIVATE KEY', kp.getPrivate().getEncoded()));
|
||||
$$.rFile(filePubKey).write(PEMUtil.printPEM('PUBLIC KEY', kp.getPublic().getEncoded()));
|
||||
$$.rFile(fileCert).write(PEMUtil.printPEM('CERTIFICATE', cert.getEncoded()));
|
||||
|
||||
gpgEncryptArmor(dvalue('GLOBAL_CA_CONFIG.gpgKeyId') || '6FAFC0E0170985AA71545483C794B1646A886CD6', filePrivKey.getPath(), filePrivKeyEncypted.getPath());
|
||||
|
||||
if (!filePrivKeyEncypted.exists()) {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Encrypt private key failed: ' + filePrivKey);
|
||||
return;
|
||||
}
|
||||
filePrivKey.delete();
|
||||
|
||||
if (UnixArgsUtil.ARGS.flags().containsAny('v', 'verbose')) {
|
||||
println('[INFO] Public key:');
|
||||
println(kp.getPublic());
|
||||
println('[INFO] Certificate:');
|
||||
println(cert);
|
||||
}
|
||||
|
||||
println(colorPrint.okgreen.render('[SUCCESS]') + 'Certificate created: ' + serialNo + ' ---> ' + dir);
|
||||
};
|
||||
|
||||
var defaultCA_JSON = {
|
||||
"name": "My Private CA",
|
||||
"gpgKeyId": "6FAFC0E0170985AA71545483C794B1646A886CD6",
|
||||
"dirs": {
|
||||
"CA": "ca",
|
||||
"INTERMEDATE": "intermediate",
|
||||
"SERVER": "server",
|
||||
"CLIENT": "client"
|
||||
},
|
||||
"defaults": {
|
||||
"_": {
|
||||
"type": "EC",
|
||||
"keyLength": {
|
||||
"RSA": 2048,
|
||||
"EC": 256
|
||||
},
|
||||
"validYear": 5
|
||||
},
|
||||
"ca": {
|
||||
"type": "EC",
|
||||
"keyLength": {
|
||||
"RSA": 4096,
|
||||
"EC": 384
|
||||
},
|
||||
"validYear": 100
|
||||
},
|
||||
"intermediate": {
|
||||
"validYear": 10
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
var main = () => {
|
||||
UnixArgsUtil.parseGlobalArgs($ARGS);
|
||||
var args = UnixArgsUtil.ARGS.args();
|
||||
if (args == null || args.length != 2) {
|
||||
printHelp();
|
||||
return;
|
||||
}
|
||||
var type = $STR(args[0]);
|
||||
var command = $STR(args[1]);
|
||||
|
||||
if (((type == '_') || (type == 'global')) && (command == 'init')) {
|
||||
if ($$.file('ca.json').exists()) {
|
||||
// println(colorPrint.okblue.render('[OK]') + 'File: ca.json already exists.');
|
||||
} else {
|
||||
$$.rFile('ca.json').write(prettyJSON(defaultCA_JSON));
|
||||
println(colorPrint.okgreen.render('[SUCCESS]') + 'File: ca.json created.');
|
||||
}
|
||||
}
|
||||
if (!$$.file('ca.json').exists()) {
|
||||
println('No file ca.json found!');
|
||||
println('');
|
||||
println('Please create ca.json first:');
|
||||
println(prettyJSON(defaultCA_JSON));
|
||||
return;
|
||||
}
|
||||
GLOBAL_CA_CONFIG = JSON.parse($$.rFile('ca.json').string());
|
||||
println('::::::Tiny CA programme: ' + (dvalue('GLOBAL_CA_CONFIG.name') || 'Unnamed CA') + ':');
|
||||
|
||||
if ((type == '_') || (type == 'global')) {
|
||||
if (command == 'init') {
|
||||
var tobeCreatedDirs = [dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca',
|
||||
dvalue('GLOBAL_CA_CONFIG.dirs.INTERMEDATE') || 'intermediate',
|
||||
dvalue('GLOBAL_CA_CONFIG.dirs.SERVER') || 'server',
|
||||
dvalue('GLOBAL_CA_CONFIG.dirs.CLIENT') || 'client'];
|
||||
|
||||
tobeCreatedDirs.forEach((e) => {
|
||||
var f = $$.file(e);
|
||||
if (f.exists()) {
|
||||
if (f.isDirectory()) {
|
||||
println(colorPrint.okblue.render('[OK]') + 'Directory: ' + e + ' already exists.');
|
||||
} else {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'File?: ' + e + ' exists, but not directory!');
|
||||
}
|
||||
} else {
|
||||
f.mkdirs();
|
||||
println(colorPrint.okgreen.render('[SUCCESS]') + 'Directory: ' + e + ' created.');
|
||||
}
|
||||
});
|
||||
println(colorPrint.okgreen.render('[DONE]') + 'Global init finished.');
|
||||
} else if (command == 'list') {
|
||||
println('[CA]' + ' list:');
|
||||
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca'));
|
||||
println();
|
||||
println('[INTERMEDIATE]' + ' list:');
|
||||
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.INTERMEDIATE') || 'intermediate'));
|
||||
println();
|
||||
println('[SERVER]' + ' list:');
|
||||
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.SERVER') || 'server'));
|
||||
println();
|
||||
println('[CLIENT]' + ' list:');
|
||||
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CLIENT') || 'client'));
|
||||
}
|
||||
} else if (type == 'ca') {
|
||||
if (command == 'create') {
|
||||
var typeKeyLengthKP = getTypeKeyLengthKeyPair('ca');
|
||||
var type = typeKeyLengthKP[0];
|
||||
var keyLength = typeKeyLengthKP[1];
|
||||
var kp = typeKeyLengthKP[2];
|
||||
var subject = UnixArgsUtil.ARGS.kvalue('subject', '').replaceAll('__', ' ');
|
||||
if (subject == '') {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Subject cannot be null.');
|
||||
return;
|
||||
}
|
||||
var validYear = UnixArgsUtil.ARGS.kvalue('validYear', dvalue('GLOBAL_CA_CONFIG.defaults.ca.validYear') || dvalue('GLOBAL_CA_CONFIG.defaults._.validYear') || 100);
|
||||
|
||||
var cert = CertificateAuthority
|
||||
.instance()
|
||||
.validYears(validYear)
|
||||
.subject(subject)
|
||||
.certPubKey(kp.getPublic())
|
||||
.signPrivKey(kp.getPrivate())
|
||||
.createCA();
|
||||
|
||||
writeCert(kp, cert, dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca');
|
||||
} else if (command == 'list') {
|
||||
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca'));
|
||||
} else if (command == 'delete') {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Not implemented: ' + command);
|
||||
} else {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Unknow command: ' + command);
|
||||
printHelp();
|
||||
}
|
||||
} else if (type == 'intermediate') {
|
||||
if (command == 'create') {
|
||||
var typeKeyLengthKP = getTypeKeyLengthKeyPair('intermediate');
|
||||
var type = typeKeyLengthKP[0];
|
||||
var keyLength = typeKeyLengthKP[1];
|
||||
var kp = typeKeyLengthKP[2];
|
||||
var subject = UnixArgsUtil.ARGS.kvalue('subject', '').replaceAll('__', ' ');
|
||||
if (subject == '') {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Subject cannot be null.');
|
||||
return;
|
||||
}
|
||||
var validYear = UnixArgsUtil.ARGS.kvalue('validYear', dvalue('GLOBAL_CA_CONFIG.defaults.intermediate.validYear') || dvalue('GLOBAL_CA_CONFIG.defaults._.validYear') || 20);
|
||||
var certId = UnixArgsUtil.ARGS.kvalue('certId');
|
||||
if (certId == null) {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Cert ID cannot be null.');
|
||||
return;
|
||||
}
|
||||
var dirCA = $$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca');
|
||||
var fileCACert = $$.file(dirCA, certId, "cert.pem");
|
||||
var fileCAPrivKeyEncrypted = $$.file(dirCA, certId, "privkey.pem.asc");
|
||||
|
||||
if (!(fileCACert.exists()) || !fileCAPrivKeyEncrypted.exists()) {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Cert ID not exists: ' + certId);
|
||||
return;
|
||||
}
|
||||
var signCert = X509CertUtil.parseX509CertificateList($$.rFile(fileCACert).bytes()).get(0);
|
||||
var privKeyVal;
|
||||
try {
|
||||
privKeyVal = gpgDecrypt(fileCAPrivKeyEncrypted.getPath());
|
||||
} catch(ex) {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Decrypt private key failed: ' + fileCAPrivKeyEncrypted);
|
||||
return;
|
||||
}
|
||||
var signPrivKey = new PrivateKeyParseTool(new BufferedReader(new StringReader(privKeyVal))).read();
|
||||
|
||||
var cert = CertificateAuthority
|
||||
.instance()
|
||||
.validYears(validYear)
|
||||
.subject(subject)
|
||||
.certPubKey(kp.getPublic())
|
||||
.signCert(signCert)
|
||||
.signPrivKey(signPrivKey)
|
||||
.createIntermediateCert();
|
||||
|
||||
writeCert(kp, cert, dvalue('GLOBAL_CA_CONFIG.dirs.INTERMEDATE') || 'intermediate');
|
||||
} else if (command == 'list') {
|
||||
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.INTERMEDATE') || 'intermediate'));
|
||||
} else if (command == 'delete') {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Not implemented: ' + command);
|
||||
} else {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Unknow command: ' + command);
|
||||
printHelp();
|
||||
}
|
||||
} else if (type == 'server') {
|
||||
if (command == 'create') {
|
||||
var typeKeyLengthKP = getTypeKeyLengthKeyPair('server');
|
||||
var type = typeKeyLengthKP[0];
|
||||
var keyLength = typeKeyLengthKP[1];
|
||||
var kp = typeKeyLengthKP[2];
|
||||
var subject = UnixArgsUtil.ARGS.kvalue('subject', '').replaceAll('__', ' ');
|
||||
if (subject == '') {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Subject cannot be null.');
|
||||
return;
|
||||
}
|
||||
var dnsName = UnixArgsUtil.ARGS.kvalue('dnsName', '');
|
||||
if (dnsName == '') {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'DNSName cannot be null.');
|
||||
return;
|
||||
}
|
||||
var validYear = UnixArgsUtil.ARGS.kvalue('validYear', dvalue('GLOBAL_CA_CONFIG.defaults.client.validYear') || dvalue('GLOBAL_CA_CONFIG.defaults._.validYear') || 5);
|
||||
var certId = UnixArgsUtil.ARGS.kvalue('certId');
|
||||
if (certId == null) {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Cert ID cannot be null.');
|
||||
return;
|
||||
}
|
||||
var dirCA = $$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca');
|
||||
var dirIntermediate = $$.file(dvalue('GLOBAL_CA_CONFIG.dirs.INTERMEDATE') || 'intermediate');
|
||||
var fileCACert;
|
||||
var fileCAPrivKeyEncrypted;
|
||||
if ($$.file(dirIntermediate, certId, "cert.pem").exists()) {
|
||||
fileCACert = $$.file(dirIntermediate, certId, "cert.pem");
|
||||
fileCAPrivKeyEncrypted = $$.file(dirIntermediate, certId, "privkey.pem.asc");
|
||||
} else {
|
||||
fileCACert = $$.file(dirCA, certId, "cert.pem");
|
||||
fileCAPrivKeyEncrypted = $$.file(dirCA, certId, "privkey.pem.asc");
|
||||
}
|
||||
|
||||
if (!(fileCACert.exists()) || !fileCAPrivKeyEncrypted.exists()) {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Cert ID not exists: ' + certId);
|
||||
return;
|
||||
}
|
||||
var signCert = X509CertUtil.parseX509CertificateList($$.rFile(fileCACert).string()).get(0);
|
||||
var privKeyVal;
|
||||
try {
|
||||
privKeyVal = gpgDecrypt(fileCAPrivKeyEncrypted.getPath());
|
||||
} catch(ex) {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Decrypt private key failed: ' + fileCAPrivKeyEncrypted);
|
||||
return;
|
||||
}
|
||||
var signPrivKey = new PrivateKeyParseTool(new BufferedReader(new StringReader(privKeyVal))).read();
|
||||
|
||||
var cert = CertificateAuthority
|
||||
.instance()
|
||||
.validYears(validYear)
|
||||
.subject(subject)
|
||||
.certPubKey(kp.getPublic())
|
||||
.signCert(signCert)
|
||||
.signPrivKey(signPrivKey)
|
||||
.createServerCert($$.asList(dnsName.split(/,/g)));
|
||||
|
||||
writeCert(kp, cert, dvalue('GLOBAL_CA_CONFIG.dirs.SERVER') || 'server');
|
||||
} else if (command == 'list') {
|
||||
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.SERVER') || 'server'));
|
||||
} else if (command == 'delete') {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Not implemented: ' + command);
|
||||
} else {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Unknow command: ' + command);
|
||||
printHelp();
|
||||
}
|
||||
} else if (type == 'client') {
|
||||
if (command == 'create') {
|
||||
var typeKeyLengthKP = getTypeKeyLengthKeyPair('client');
|
||||
var type = typeKeyLengthKP[0];
|
||||
var keyLength = typeKeyLengthKP[1];
|
||||
var kp = typeKeyLengthKP[2];
|
||||
var subject = UnixArgsUtil.ARGS.kvalue('subject', '').replaceAll('__', ' ');
|
||||
if (subject == '') {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Subject cannot be null.');
|
||||
return;
|
||||
}
|
||||
var validYear = UnixArgsUtil.ARGS.kvalue('validYear', dvalue('GLOBAL_CA_CONFIG.defaults.client.validYear') || dvalue('GLOBAL_CA_CONFIG.defaults._.validYear') || 5);
|
||||
var certId = UnixArgsUtil.ARGS.kvalue('certId');
|
||||
if (certId == null) {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Cert ID cannot be null.');
|
||||
return;
|
||||
}
|
||||
var dirCA = $$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca');
|
||||
var dirIntermediate = $$.file(dvalue('GLOBAL_CA_CONFIG.dirs.INTERMEDATE') || 'intermediate');
|
||||
var fileCACert;
|
||||
var fileCAPrivKeyEncrypted;
|
||||
if ($$.file(dirIntermediate, certId, "cert.pem").exists()) {
|
||||
fileCACert = $$.file(dirIntermediate, certId, "cert.pem");
|
||||
fileCAPrivKeyEncrypted = $$.file(dirIntermediate, certId, "privkey.pem.asc");
|
||||
} else {
|
||||
fileCACert = $$.file(dirCA, certId, "cert.pem");
|
||||
fileCAPrivKeyEncrypted = $$.file(dirCA, certId, "privkey.pem.asc");
|
||||
}
|
||||
|
||||
if (!(fileCACert.exists()) || !fileCAPrivKeyEncrypted.exists()) {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Cert ID not exists: ' + certId);
|
||||
return;
|
||||
}
|
||||
var signCert = X509CertUtil.parseX509CertificateList($$.rFile(fileCACert).bytes()).get(0);
|
||||
var privKeyVal;
|
||||
try {
|
||||
privKeyVal = gpgDecrypt(fileCAPrivKeyEncrypted.getPath());
|
||||
} catch(ex) {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Decrypt private key failed: ' + fileCAPrivKeyEncrypted);
|
||||
return;
|
||||
}
|
||||
var signPrivKey = new PrivateKeyParseTool(new BufferedReader(new StringReader(privKeyVal))).read();
|
||||
|
||||
var cert = CertificateAuthority
|
||||
.instance()
|
||||
.validYears(validYear)
|
||||
.subject(subject)
|
||||
.certPubKey(kp.getPublic())
|
||||
.signCert(signCert)
|
||||
.signPrivKey(signPrivKey)
|
||||
.createClientCert();
|
||||
|
||||
writeCert(kp, cert, dvalue('GLOBAL_CA_CONFIG.dirs.CLIENT') || 'client');
|
||||
} else if (command == 'list') {
|
||||
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CLIENT') || 'client'));
|
||||
} else if (command == 'delete') {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Not implemented: ' + command);
|
||||
} else {
|
||||
println(colorPrint.fail.render('[FAIL]') + 'Unknow command: ' + command);
|
||||
printHelp();
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
main();
|
||||
Reference in New Issue
Block a user