Sichere Verbindung (TLS/HTTPS)

#!/bin/sh

mkdir certs && cd certs

# ---------------------------------------------------------------------
# ROOT Zertifikat, hat eine Gültigkeitsdauer von 10 Jahren (~ 3650 Tage)
# ----------------------------------------------------------------------

openssl genrsa -out root-ca-key.pem 2048

openssl req \
  -new \
  -x509 \
  -sha256 \
  -key root-ca-key.pem \
  -subj "/DC=com/DC=example/O=Example Com Inc./OU=Example Com Inc. Root CA/CN=Example Com Inc. Root CA" \
  -addext "basicConstraints = critical,CA:TRUE" \
  -addext "keyUsage = critical, digitalSignature, keyCertSign, cRLSign" \
  -addext "subjectKeyIdentifier = hash" \
  -addext "authorityKeyIdentifier = keyid:always,issuer:always" \
  -days 3650 \
  -out root-ca.pem

#openssl pkcs12 -export \
#  -name root-ca \
#  -in root-ca.pem \
#  -inkey root-ca-key.pem \
#  -out root-ca.p12 \
#  -password pass:virtimo

keytool -import \
  -file root-ca.pem \
  -alias root-ca \
  -keystore virtimo_truststore.jks \
  -storepass virtimo \
  -noprompt

# -------------------------------------------------
# Für den Jetty/Karaf/PAX Web mit dem Alias 'karaf'
# -------------------------------------------------

openssl genrsa -out karaf-key-temp.pem 2048

openssl pkcs8 \
  -inform PEM \
  -outform PEM \
  -in karaf-key-temp.pem \
  -topk8 \
  -nocrypt \
  -v1 PBE-SHA1-3DES \
  -out karaf-key.pem

openssl req \
  -new \
  -key karaf-key.pem \
  -subj "/C=DE/L=Berlin/O=Virtimo AG/OU=karaf/CN=karaf.example.com" \
  -out karaf.csr

cat > karaf.extfile << EOF
subjectAltName = DNS:karaf.example.com, DNS:localhost, IP:::1, IP:127.0.0.1
keyUsage = digitalSignature, nonRepudiation, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
basicConstraints = critical,CA:FALSE
EOF

openssl x509 \
  -req \
  -in karaf.csr \
  -out karaf.pem \
  -CA root-ca.pem \
  -CAkey root-ca-key.pem \
  -CAcreateserial \
  -days 3650 \
  -extfile karaf.extfile

openssl pkcs12 -export \
  -name karaf \
  -in karaf.pem \
  -inkey karaf-key.pem \
  -out karaf.p12 \
  -password pass:virtimo

keytool \
  -importkeystore \
  -destkeystore virtimo_keystore.jks \
  -deststoretype jks \
  -deststorepass virtimo \
  -srckeystore karaf.p12 \
  -srcstoretype pkcs12 \
  -srcstorepass virtimo \
  -alias karaf

rm karaf.csr
rm karaf.extfile

# -------------------------------------------------------
# Für den OpenSearch Node mit dem Alias 'opensearch_node'
# -------------------------------------------------------

openssl genrsa -out opensearch_node-key-temp.pem 2048

openssl pkcs8 \
  -inform PEM \
  -outform PEM \
  -in opensearch_node-key-temp.pem \
  -topk8 \
  -nocrypt \
  -v1 PBE-SHA1-3DES \
  -out opensearch_node-key.pem

openssl req \
  -new \
  -key opensearch_node-key.pem \
  -subj "/C=DE/L=Berlin/O=Virtimo AG/OU=node/CN=node-0.example.com" \
  -out opensearch_node.csr

cat > opensearch_node.extfile << EOF
subjectAltName = RID:1.2.3.4.5.5, DNS:node-0.example.com, DNS:localhost, IP:::1, IP:127.0.0.1
keyUsage = digitalSignature, nonRepudiation, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
basicConstraints = critical,CA:FALSE
EOF

openssl x509 \
  -req \
  -in opensearch_node.csr \
  -out opensearch_node.pem \
  -CA root-ca.pem \
  -CAkey root-ca-key.pem \
  -CAcreateserial \
  -days 3650 \
  -extfile opensearch_node.extfile

openssl pkcs12 -export \
  -name opensearch_node \
  -in opensearch_node.pem \
  -inkey opensearch_node-key.pem \
  -out opensearch_node.p12 \
  -password pass:virtimo

keytool \
  -importkeystore \
  -destkeystore virtimo_keystore.jks \
  -deststoretype jks \
  -deststorepass virtimo \
  -srckeystore opensearch_node.p12 \
  -srcstoretype pkcs12 \
  -srcstorepass virtimo \
  -alias opensearch_node

rm opensearch_node.csr
rm opensearch_node.extfile

# ---------------------------------------------------------
# Für den OpenSearch ADMIN mit dem Alias 'opensearch_admin'
# ---------------------------------------------------------

openssl req \
  -new \
  -newkey rsa:2048 \
  -keyout opensearch_admin-key.pem \
  -out opensearch_admin.csr \
  -nodes \
  -subj "/C=DE/L=Berlin/O=Virtimo AG/OU=Dev/CN=opensearch_admin"

cat > opensearch_admin.extfile << EOF
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,nonRepudiation,keyEncipherment
extendedKeyUsage = critical,clientAuth
authorityKeyIdentifier = keyid,issuer:always
subjectKeyIdentifier = hash
EOF

openssl x509 \
  -req \
  -in opensearch_admin.csr \
  -CA root-ca.pem \
  -CAkey root-ca-key.pem \
  -CAcreateserial \
  -out opensearch_admin.pem \
  -days 3650 \
  -extfile opensearch_admin.extfile

#openssl pkcs12 -export \
#  -name opensearch_admin \
#  -in opensearch_admin.pem \
#  -inkey opensearch_admin-key.pem \
#  -out opensearch_admin.p12 \
#  -password pass:virtimo

rm opensearch_admin.csr
rm opensearch_admin.extfile

# ----------------------------------------------------------------------------------------
# Für den OpenSearch BPC User mit dem Alias 'bpc'. Karaf / OpenSearch Client -> OpenSearch
# Unser OpenSearch ist so konfiguriert, dass der Wert aus CN (= bpc) der Username ist.
# ----------------------------------------------------------------------------------------

openssl req \
  -new \
  -newkey rsa:2048 \
  -keyout opensearch_bpc-key.pem \
  -out opensearch_bpc.csr \
  -nodes \
  -subj "/C=DE/L=Berlin/O=Virtimo AG/OU=client/CN=bpc"

cat > opensearch_bpc.extfile << EOF
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,nonRepudiation,keyEncipherment
extendedKeyUsage = critical,clientAuth
authorityKeyIdentifier = keyid,issuer:always
subjectKeyIdentifier = hash
EOF

openssl x509 \
  -req \
  -in opensearch_bpc.csr \
  -CA root-ca.pem \
  -CAkey root-ca-key.pem \
  -CAcreateserial \
  -out opensearch_bpc.pem \
  -days 3650 \
  -extfile opensearch_bpc.extfile

openssl pkcs12 -export \
  -name opensearch_bpc \
  -in opensearch_bpc.pem \
  -inkey opensearch_bpc-key.pem \
  -out opensearch_bpc.p12 \
  -password pass:virtimo

keytool \
  -importkeystore \
  -destkeystore virtimo_keystore.jks \
  -deststoretype jks \
  -deststorepass virtimo \
  -srckeystore opensearch_bpc.p12 \
  -srcstoretype pkcs12 \
  -srcstorepass virtimo \
  -alias opensearch_bpc

rm opensearch_bpc.csr
rm opensearch_bpc.extfile