479 lines
19 KiB
JavaScript
479 lines
19 KiB
JavaScript
#! /usr/bin/env runjs
|
|
|
|
requireJS('component-json.js');
|
|
requireJS('component-colorprint.js');
|
|
requireJS('component-gpg.js');
|
|
|
|
requireJAR('bcpkix-jdk15on-154.jar');
|
|
requireJAR('bcprov-ext-jdk15on-154.jar');
|
|
requireJAR('bcprov-jdk15on-154.jar');
|
|
requireJAR('crypto-1.0.jar');
|
|
|
|
var StringReader = java.io.StringReader;
|
|
var BufferedReader = java.io.BufferedReader;
|
|
var TimeUnit = java.util.concurrent.TimeUnit;
|
|
var Bytes = Packages.me.hatter.tools.commons.bytes.Bytes;
|
|
var PEMUtil = Packages.me.hatter.tools.commons.security.pem.PEMUtil;
|
|
var UnixArgsUtil = Packages.me.hatter.tools.commons.args.UnixArgsUtil;
|
|
var X509CertUtil = Packages.me.hatter.tools.commons.security.cert.X509CertUtil;
|
|
var PrivateKeyParseTool = Packages.me.hatter.tools.commons.security.rsa.PrivateKeyParseTool;
|
|
var KeyPairGenerateTool = Packages.me.hatter.tools.commons.security.key.KeyPairGenerateTool;
|
|
var CertificateAuthority = Packages.me.hatter.tools.crypto.ca.CertificateAuthority;
|
|
|
|
|
|
var printHelp = () => {
|
|
println('tinyca.js - Tiny CA.')
|
|
println();
|
|
println('tinyca.js <type> <command>');
|
|
println('type - _, global, ca, intermediate, server, client');
|
|
println('command, cases below:');
|
|
println(' type = _, global - init');
|
|
println(' type = ca - create, list, delete');
|
|
println(' type = intermediate - create, list, delete');
|
|
println(' type = server - create, list, delete');
|
|
println(' type = client - create, list, delete');
|
|
println('params:');
|
|
println(' -type <rsa,ec> - RSA or EC');
|
|
println(' -keyLength <len> - Key length');
|
|
println(' -validYear <year> - Valid year(s)');
|
|
println(' -certId <certId> - Cert ID');
|
|
println(' -subject <subject> - Subject');
|
|
println(' -dnsName <name,name> - DNS name(s)');
|
|
};
|
|
|
|
var dvalue = (key) => {
|
|
var ks = key.split(/\./g);
|
|
var val = $GLOBAL();
|
|
for (var i = 0; i < ks.length; i++) {
|
|
var val2 = val[ks[i]];
|
|
if (val2 == null) { return null; }
|
|
val = val2;
|
|
}
|
|
return val;
|
|
};
|
|
|
|
var getTypeKeyLengthKeyPair = (ty) => {
|
|
var type = UnixArgsUtil.ARGS.kvalue('type', dvalue('GLOBAL_CA_CONFIG.defaults.' + ty + '.type') || dvalue('GLOBAL_CA_CONFIG.defaults._.type'));
|
|
var keyLength = UnixArgsUtil.ARGS.kvalue('keyLength', 0);
|
|
var kpt = KeyPairGenerateTool.instance();
|
|
|
|
if (type.toUpperCase() == 'RSA') {
|
|
kpt.rsa();
|
|
if (keyLength == 0) {
|
|
kpt.keyLength(dvalue('GLOBAL_CA_CONFIG.defaults.' + ty + '.keyLength.RSA') || dvalue('GLOBAL_CA_CONFIG.defaults._.keyLength.RSA'));
|
|
}
|
|
} else if (type.toUpperCase() == 'EC') {
|
|
kpt.ec();
|
|
if (keyLength == 0) {
|
|
kpt.keyLength(dvalue('GLOBAL_CA_CONFIG.defaults.' + ty + '.keyLength.EC') || dvalue('GLOBAL_CA_CONFIG.defaults._.keyLength.EC'));
|
|
}
|
|
} else {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Unknown type: ' + type);
|
|
}
|
|
if (keyLength < 0) {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Key length invalid: ' + keyLength);
|
|
} else if (keyLength > 0) {
|
|
kpt.keyLength(keyLength);
|
|
}
|
|
|
|
return [type, keyLength, kpt.generate()];
|
|
};
|
|
|
|
var displayLimitChars = (str) => {
|
|
if (str.length < 80) {
|
|
return str;
|
|
}
|
|
return str.substring(0, 87) + '...';
|
|
};
|
|
|
|
var listCerts = (dir) => {
|
|
$ARRAY(dir.listFiles()).forEach((d) => {
|
|
var fileCert = $$.file(d, 'cert.pem');
|
|
if (!fileCert.exists()) {
|
|
println(colorPrint.warning.render('[WARN]') + 'No cert found in: ' + d.getName());
|
|
return;
|
|
}
|
|
var certs = X509CertUtil.parseX509CertificateList($$.rFile(fileCert).bytes());
|
|
if ((certs == null) || (certs.size() == 0)) {
|
|
println(colorPrint.warning.render('[WARN]') + 'No cert found in: ' + fileCert);
|
|
return;
|
|
} else if (certs.size() > 1) {
|
|
println(colorPrint.warning.render('[WARN]') + 'More than one certs found in: ' + fileCert);
|
|
return;
|
|
}
|
|
var cert = certs.get(0);
|
|
var isValid = (cert.getNotBefore().getTime() <= $$.date().millis()) && (cert.getNotAfter().getTime() >= $$.date().millis());
|
|
println(colorPrint.bold.render('CERT ID: ')
|
|
+ colorPrint.underline.render(d.getName())
|
|
+ ' '
|
|
+ (isValid? colorPrint.okgreen.render('[VALID]'): colorPrint.okgreen.render('[EXPIRED]'))
|
|
+ (isValid? (' left ' + colorPrint.underline.render(parseInt((cert.getNotAfter().getTime() - $$.date().millis()) / TimeUnit.DAYS.toMillis(1))) + ' day(s)'): '')
|
|
);
|
|
println(' Subject : ' + cert.getSubjectDN());
|
|
println(' Issuer : ' + cert.getIssuerDN());
|
|
if ((cert.getSubjectAlternativeNames() != null) && (cert.getSubjectAlternativeNames().size() > 0)) {
|
|
println(' Alt Subject : ' + cert.getSubjectAlternativeNames());
|
|
}
|
|
println(' NotBefore : ' + cert.getNotBefore());
|
|
println(' NotAfter : ' + cert.getNotAfter());
|
|
if (UnixArgsUtil.ARGS.flags().containsAny('v', 'verbose')) {
|
|
var pkLines = $STR(cert.getPublicKey()).split("\n");
|
|
println(' PublicKey : ' + pkLines[0]);
|
|
for (var i = 1; i < pkLines.length; i++) {
|
|
println(' : ' + displayLimitChars(pkLines[i]));
|
|
}
|
|
println(' Issuer : ' + cert.getIssuerDN());
|
|
println(' Sign Alg : ' + cert.getSigAlgName());
|
|
// println(' Sign Alg OID : ' + cert.getSigAlgOID());
|
|
println(' Signature : ' + displayLimitChars(Bytes.from(cert.getSignature()).asHex()));
|
|
}
|
|
});
|
|
};
|
|
|
|
var writeCert = (kp, cert, dir) => {
|
|
var serialNo = Bytes.from(cert.getSerialNumber().toByteArray()).asHex().toUpperCase();
|
|
if (serialNo.startsWith('00')) { serialNo = serialNo.substring(2); }
|
|
var dirSerialNo = $$.file(dir, serialNo);
|
|
dirSerialNo.mkdirs();
|
|
|
|
var filePrivKey = $$.file(dirSerialNo, 'privkey.pem');
|
|
var filePrivKeyEncypted = $$.file(dirSerialNo, 'privkey.pem.asc');
|
|
var filePubKey = $$.file(dirSerialNo, 'pubkey.pem');
|
|
var fileCert = $$.file(dirSerialNo, 'cert.pem');
|
|
|
|
if (filePrivKey.exists() || filePrivKeyEncypted.exists() || filePubKey.exists() || fileCert.exists()) {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Serial number already exsists: ' + serialNo);
|
|
return;
|
|
}
|
|
|
|
$$.rFile(filePrivKey).write(PEMUtil.printPEM('PRIVATE KEY', kp.getPrivate().getEncoded()));
|
|
$$.rFile(filePubKey).write(PEMUtil.printPEM('PUBLIC KEY', kp.getPublic().getEncoded()));
|
|
$$.rFile(fileCert).write(PEMUtil.printPEM('CERTIFICATE', cert.getEncoded()));
|
|
|
|
gpgEncryptArmor(dvalue('GLOBAL_CA_CONFIG.gpgKeyId') || '6FAFC0E0170985AA71545483C794B1646A886CD6', filePrivKey.getPath(), filePrivKeyEncypted.getPath());
|
|
|
|
if (!filePrivKeyEncypted.exists()) {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Encrypt private key failed: ' + filePrivKey);
|
|
return;
|
|
}
|
|
filePrivKey.delete();
|
|
|
|
if (UnixArgsUtil.ARGS.flags().containsAny('v', 'verbose')) {
|
|
println('[INFO] Public key:');
|
|
println(kp.getPublic());
|
|
println('[INFO] Certificate:');
|
|
println(cert);
|
|
}
|
|
|
|
println(colorPrint.okgreen.render('[SUCCESS]') + 'Certificate created: ' + serialNo + ' ---> ' + dir);
|
|
};
|
|
|
|
var defaultCA_JSON = {
|
|
"name": "My Private CA",
|
|
"gpgKeyId": "6FAFC0E0170985AA71545483C794B1646A886CD6",
|
|
"dirs": {
|
|
"CA": "ca",
|
|
"INTERMEDATE": "intermediate",
|
|
"SERVER": "server",
|
|
"CLIENT": "client"
|
|
},
|
|
"defaults": {
|
|
"_": {
|
|
"type": "EC",
|
|
"keyLength": {
|
|
"RSA": 2048,
|
|
"EC": 256
|
|
},
|
|
"validYear": 5
|
|
},
|
|
"ca": {
|
|
"type": "EC",
|
|
"keyLength": {
|
|
"RSA": 4096,
|
|
"EC": 384
|
|
},
|
|
"validYear": 100
|
|
},
|
|
"intermediate": {
|
|
"validYear": 10
|
|
}
|
|
}
|
|
};
|
|
|
|
var main = () => {
|
|
UnixArgsUtil.parseGlobalArgs($ARGS);
|
|
var args = UnixArgsUtil.ARGS.args();
|
|
if (args == null || args.length != 2) {
|
|
printHelp();
|
|
return;
|
|
}
|
|
var type = $STR(args[0]);
|
|
var command = $STR(args[1]);
|
|
|
|
if (((type == '_') || (type == 'global')) && (command == 'init')) {
|
|
if ($$.file('ca.json').exists()) {
|
|
// println(colorPrint.okblue.render('[OK]') + 'File: ca.json already exists.');
|
|
} else {
|
|
$$.rFile('ca.json').write(prettyJSON(defaultCA_JSON));
|
|
println(colorPrint.okgreen.render('[SUCCESS]') + 'File: ca.json created.');
|
|
}
|
|
}
|
|
if (!$$.file('ca.json').exists()) {
|
|
println('No file ca.json found!');
|
|
println('');
|
|
println('Please create ca.json first:');
|
|
println(prettyJSON(defaultCA_JSON));
|
|
return;
|
|
}
|
|
GLOBAL_CA_CONFIG = JSON.parse($$.rFile('ca.json').string());
|
|
println('::::::Tiny CA programme: ' + (dvalue('GLOBAL_CA_CONFIG.name') || 'Unnamed CA') + ':');
|
|
|
|
if ((type == '_') || (type == 'global')) {
|
|
if (command == 'init') {
|
|
var tobeCreatedDirs = [dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca',
|
|
dvalue('GLOBAL_CA_CONFIG.dirs.INTERMEDATE') || 'intermediate',
|
|
dvalue('GLOBAL_CA_CONFIG.dirs.SERVER') || 'server',
|
|
dvalue('GLOBAL_CA_CONFIG.dirs.CLIENT') || 'client'];
|
|
|
|
tobeCreatedDirs.forEach((e) => {
|
|
var f = $$.file(e);
|
|
if (f.exists()) {
|
|
if (f.isDirectory()) {
|
|
println(colorPrint.okblue.render('[OK]') + 'Directory: ' + e + ' already exists.');
|
|
} else {
|
|
println(colorPrint.fail.render('[FAIL]') + 'File?: ' + e + ' exists, but not directory!');
|
|
}
|
|
} else {
|
|
f.mkdirs();
|
|
println(colorPrint.okgreen.render('[SUCCESS]') + 'Directory: ' + e + ' created.');
|
|
}
|
|
});
|
|
println(colorPrint.okgreen.render('[DONE]') + 'Global init finished.');
|
|
} else if (command == 'list') {
|
|
println('[CA]' + ' list:');
|
|
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca'));
|
|
println();
|
|
println('[INTERMEDIATE]' + ' list:');
|
|
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.INTERMEDIATE') || 'intermediate'));
|
|
println();
|
|
println('[SERVER]' + ' list:');
|
|
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.SERVER') || 'server'));
|
|
println();
|
|
println('[CLIENT]' + ' list:');
|
|
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CLIENT') || 'client'));
|
|
}
|
|
} else if (type == 'ca') {
|
|
if (command == 'create') {
|
|
var typeKeyLengthKP = getTypeKeyLengthKeyPair('ca');
|
|
var type = typeKeyLengthKP[0];
|
|
var keyLength = typeKeyLengthKP[1];
|
|
var kp = typeKeyLengthKP[2];
|
|
var subject = UnixArgsUtil.ARGS.kvalue('subject', '').replaceAll('__', ' ');
|
|
if (subject == '') {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Subject cannot be null.');
|
|
return;
|
|
}
|
|
var validYear = UnixArgsUtil.ARGS.kvalue('validYear', dvalue('GLOBAL_CA_CONFIG.defaults.ca.validYear') || dvalue('GLOBAL_CA_CONFIG.defaults._.validYear') || 100);
|
|
|
|
var cert = CertificateAuthority
|
|
.instance()
|
|
.validYears(validYear)
|
|
.subject(subject)
|
|
.certPubKey(kp.getPublic())
|
|
.signPrivKey(kp.getPrivate())
|
|
.createCA();
|
|
|
|
writeCert(kp, cert, dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca');
|
|
} else if (command == 'list') {
|
|
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca'));
|
|
} else if (command == 'delete') {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Not implemented: ' + command);
|
|
} else {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Unknow command: ' + command);
|
|
printHelp();
|
|
}
|
|
} else if (type == 'intermediate') {
|
|
if (command == 'create') {
|
|
var typeKeyLengthKP = getTypeKeyLengthKeyPair('intermediate');
|
|
var type = typeKeyLengthKP[0];
|
|
var keyLength = typeKeyLengthKP[1];
|
|
var kp = typeKeyLengthKP[2];
|
|
var subject = UnixArgsUtil.ARGS.kvalue('subject', '').replaceAll('__', ' ');
|
|
if (subject == '') {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Subject cannot be null.');
|
|
return;
|
|
}
|
|
var validYear = UnixArgsUtil.ARGS.kvalue('validYear', dvalue('GLOBAL_CA_CONFIG.defaults.intermediate.validYear') || dvalue('GLOBAL_CA_CONFIG.defaults._.validYear') || 20);
|
|
var certId = UnixArgsUtil.ARGS.kvalue('certId');
|
|
if (certId == null) {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Cert ID cannot be null.');
|
|
return;
|
|
}
|
|
var dirCA = $$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca');
|
|
var fileCACert = $$.file(dirCA, certId, "cert.pem");
|
|
var fileCAPrivKeyEncrypted = $$.file(dirCA, certId, "privkey.pem.asc");
|
|
|
|
if (!(fileCACert.exists()) || !fileCAPrivKeyEncrypted.exists()) {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Cert ID not exists: ' + certId);
|
|
return;
|
|
}
|
|
var signCert = X509CertUtil.parseX509CertificateList($$.rFile(fileCACert).bytes()).get(0);
|
|
var privKeyVal;
|
|
try {
|
|
privKeyVal = gpgDecrypt(fileCAPrivKeyEncrypted.getPath());
|
|
} catch(ex) {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Decrypt private key failed: ' + fileCAPrivKeyEncrypted);
|
|
return;
|
|
}
|
|
var signPrivKey = new PrivateKeyParseTool(new BufferedReader(new StringReader(privKeyVal))).read();
|
|
|
|
var cert = CertificateAuthority
|
|
.instance()
|
|
.validYears(validYear)
|
|
.subject(subject)
|
|
.certPubKey(kp.getPublic())
|
|
.signCert(signCert)
|
|
.signPrivKey(signPrivKey)
|
|
.createIntermediateCert();
|
|
|
|
writeCert(kp, cert, dvalue('GLOBAL_CA_CONFIG.dirs.INTERMEDATE') || 'intermediate');
|
|
} else if (command == 'list') {
|
|
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.INTERMEDATE') || 'intermediate'));
|
|
} else if (command == 'delete') {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Not implemented: ' + command);
|
|
} else {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Unknow command: ' + command);
|
|
printHelp();
|
|
}
|
|
} else if (type == 'server') {
|
|
if (command == 'create') {
|
|
var typeKeyLengthKP = getTypeKeyLengthKeyPair('server');
|
|
var type = typeKeyLengthKP[0];
|
|
var keyLength = typeKeyLengthKP[1];
|
|
var kp = typeKeyLengthKP[2];
|
|
var subject = UnixArgsUtil.ARGS.kvalue('subject', '').replaceAll('__', ' ');
|
|
if (subject == '') {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Subject cannot be null.');
|
|
return;
|
|
}
|
|
var dnsName = UnixArgsUtil.ARGS.kvalue('dnsName', '');
|
|
if (dnsName == '') {
|
|
println(colorPrint.fail.render('[FAIL]') + 'DNSName cannot be null.');
|
|
return;
|
|
}
|
|
var validYear = UnixArgsUtil.ARGS.kvalue('validYear', dvalue('GLOBAL_CA_CONFIG.defaults.client.validYear') || dvalue('GLOBAL_CA_CONFIG.defaults._.validYear') || 5);
|
|
var certId = UnixArgsUtil.ARGS.kvalue('certId');
|
|
if (certId == null) {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Cert ID cannot be null.');
|
|
return;
|
|
}
|
|
var dirCA = $$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca');
|
|
var dirIntermediate = $$.file(dvalue('GLOBAL_CA_CONFIG.dirs.INTERMEDATE') || 'intermediate');
|
|
var fileCACert;
|
|
var fileCAPrivKeyEncrypted;
|
|
if ($$.file(dirIntermediate, certId, "cert.pem").exists()) {
|
|
fileCACert = $$.file(dirIntermediate, certId, "cert.pem");
|
|
fileCAPrivKeyEncrypted = $$.file(dirIntermediate, certId, "privkey.pem.asc");
|
|
} else {
|
|
fileCACert = $$.file(dirCA, certId, "cert.pem");
|
|
fileCAPrivKeyEncrypted = $$.file(dirCA, certId, "privkey.pem.asc");
|
|
}
|
|
|
|
if (!(fileCACert.exists()) || !fileCAPrivKeyEncrypted.exists()) {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Cert ID not exists: ' + certId);
|
|
return;
|
|
}
|
|
var signCert = X509CertUtil.parseX509CertificateList($$.rFile(fileCACert).string()).get(0);
|
|
var privKeyVal;
|
|
try {
|
|
privKeyVal = gpgDecrypt(fileCAPrivKeyEncrypted.getPath());
|
|
} catch(ex) {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Decrypt private key failed: ' + fileCAPrivKeyEncrypted);
|
|
return;
|
|
}
|
|
var signPrivKey = new PrivateKeyParseTool(new BufferedReader(new StringReader(privKeyVal))).read();
|
|
|
|
var cert = CertificateAuthority
|
|
.instance()
|
|
.validYears(validYear)
|
|
.subject(subject)
|
|
.certPubKey(kp.getPublic())
|
|
.signCert(signCert)
|
|
.signPrivKey(signPrivKey)
|
|
.createServerCert($$.asList(dnsName.split(/,/g)));
|
|
|
|
writeCert(kp, cert, dvalue('GLOBAL_CA_CONFIG.dirs.SERVER') || 'server');
|
|
} else if (command == 'list') {
|
|
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.SERVER') || 'server'));
|
|
} else if (command == 'delete') {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Not implemented: ' + command);
|
|
} else {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Unknow command: ' + command);
|
|
printHelp();
|
|
}
|
|
} else if (type == 'client') {
|
|
if (command == 'create') {
|
|
var typeKeyLengthKP = getTypeKeyLengthKeyPair('client');
|
|
var type = typeKeyLengthKP[0];
|
|
var keyLength = typeKeyLengthKP[1];
|
|
var kp = typeKeyLengthKP[2];
|
|
var subject = UnixArgsUtil.ARGS.kvalue('subject', '').replaceAll('__', ' ');
|
|
if (subject == '') {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Subject cannot be null.');
|
|
return;
|
|
}
|
|
var validYear = UnixArgsUtil.ARGS.kvalue('validYear', dvalue('GLOBAL_CA_CONFIG.defaults.client.validYear') || dvalue('GLOBAL_CA_CONFIG.defaults._.validYear') || 5);
|
|
var certId = UnixArgsUtil.ARGS.kvalue('certId');
|
|
if (certId == null) {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Cert ID cannot be null.');
|
|
return;
|
|
}
|
|
var dirCA = $$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CA') || 'ca');
|
|
var dirIntermediate = $$.file(dvalue('GLOBAL_CA_CONFIG.dirs.INTERMEDATE') || 'intermediate');
|
|
var fileCACert;
|
|
var fileCAPrivKeyEncrypted;
|
|
if ($$.file(dirIntermediate, certId, "cert.pem").exists()) {
|
|
fileCACert = $$.file(dirIntermediate, certId, "cert.pem");
|
|
fileCAPrivKeyEncrypted = $$.file(dirIntermediate, certId, "privkey.pem.asc");
|
|
} else {
|
|
fileCACert = $$.file(dirCA, certId, "cert.pem");
|
|
fileCAPrivKeyEncrypted = $$.file(dirCA, certId, "privkey.pem.asc");
|
|
}
|
|
|
|
if (!(fileCACert.exists()) || !fileCAPrivKeyEncrypted.exists()) {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Cert ID not exists: ' + certId);
|
|
return;
|
|
}
|
|
var signCert = X509CertUtil.parseX509CertificateList($$.rFile(fileCACert).bytes()).get(0);
|
|
var privKeyVal;
|
|
try {
|
|
privKeyVal = gpgDecrypt(fileCAPrivKeyEncrypted.getPath());
|
|
} catch(ex) {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Decrypt private key failed: ' + fileCAPrivKeyEncrypted);
|
|
return;
|
|
}
|
|
var signPrivKey = new PrivateKeyParseTool(new BufferedReader(new StringReader(privKeyVal))).read();
|
|
|
|
var cert = CertificateAuthority
|
|
.instance()
|
|
.validYears(validYear)
|
|
.subject(subject)
|
|
.certPubKey(kp.getPublic())
|
|
.signCert(signCert)
|
|
.signPrivKey(signPrivKey)
|
|
.createClientCert();
|
|
|
|
writeCert(kp, cert, dvalue('GLOBAL_CA_CONFIG.dirs.CLIENT') || 'client');
|
|
} else if (command == 'list') {
|
|
listCerts($$.file(dvalue('GLOBAL_CA_CONFIG.dirs.CLIENT') || 'client'));
|
|
} else if (command == 'delete') {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Not implemented: ' + command);
|
|
} else {
|
|
println(colorPrint.fail.render('[FAIL]') + 'Unknow command: ' + command);
|
|
printHelp();
|
|
}
|
|
}
|
|
};
|
|
|
|
main();
|