Update: add AIA URL support in make_ca and make_cert functions

simple-ca.sh

@@ -42,6 +42,7 @@ function make_ca() {
 
     # CA defaults to the main CA if not specified, but can be overridden with --issuing-ca
     local CA_FILE_PREFIX="ca"
+    local AIA_BASE_URL=""
 
     while [[ $# -gt 0 ]]; do
         case "$1" in
@@ -65,6 +66,14 @@ function make_ca() {
                 CA_FILE_PREFIX="$2"
                 shift 2
                 ;;
+            --aia-base-url)
+                if [[ -z "$2" ]]; then
+                    echo "ERROR: Missing value for --aia-base-url." >&2
+                    return 1
+                fi
+                AIA_BASE_URL="$2"
+                shift 2
+                ;;
             *)
                 break
                 ;;
@@ -81,6 +90,10 @@ function make_ca() {
         return 1
     fi
 
+    if [[ -z "$AIA_BASE_URL" && -f "$CA_DIR/aia_base_url.txt" ]]; then
+        AIA_BASE_URL="$(cat "$CA_DIR/aia_base_url.txt")"
+    fi
+
     local ROOT_CA_CERT="ca_cert.pem"
     local ROOT_CA_KEY="ca_key.pem"
     local CA_CERT="${CA_FILE_PREFIX}_cert.pem"
@@ -113,6 +126,10 @@ function make_ca() {
         # Make a "hash" symlink for the CA certificate to allow OpenSSL to find it when verifying other certificates
         make_hash_link "$CA_DIR/$ROOT_CA_CERT"
 
+        if [[ -n "$AIA_BASE_URL" ]]; then
+            echo "$AIA_BASE_URL" > "$CA_DIR/aia_base_url.txt"
+        fi
+
         return 0
     fi
 
@@ -124,6 +141,7 @@ function make_ca() {
             -noenc \
             -subj "/CN=${CA_NAME}" \
             -addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
+            ${AIA_BASE_URL:+-addext "authorityInfoAccess=caIssuers;URI:${AIA_BASE_URL}/ca_cert.crt"} \
         | openssl x509 \
             -req \
             -CA "$CA_DIR/$ROOT_CA_CERT" \
@@ -140,6 +158,10 @@ function make_ca() {
     # Make a "hash" symlink for the issuing CA certificate to allow OpenSSL to find it when verifying other certificates
     make_hash_link "$CA_DIR/${CA_CERT}"
 
+    if [[ -n "$AIA_BASE_URL" ]]; then
+        echo "$AIA_BASE_URL" > "$CA_DIR/aia_base_url.txt"
+    fi
+
     return 0
 }
 
@@ -204,6 +226,12 @@ function make_cert() {
 
     CA_DIR="${CA_DIR:-$CERT_DIR}"
 
+    local AIA_BASE_URL_FILE="$CA_DIR/aia_base_url.txt"
+    local AIA_URL=""
+    if [[ -f "$AIA_BASE_URL_FILE" ]]; then
+        AIA_URL="$(cat "$AIA_BASE_URL_FILE")/${CA_FILE_PREFIX}_cert.crt"
+    fi
+
     local CA_CERT="${CA_FILE_PREFIX}_cert.pem"
     local CA_KEY="${CA_FILE_PREFIX}_key.pem"
 
@@ -271,6 +299,7 @@ function make_cert() {
             -addext "keyUsage=digitalSignature,keyEncipherment" \
             -addext "extendedKeyUsage=serverAuth,clientAuth" \
             -addext "$SANS_EXT" \
+            ${AIA_URL:+-addext "authorityInfoAccess=caIssuers;URI:${AIA_URL}"} \
         | openssl x509 \
             -req \
             -CA "$CA_DIR/$CA_CERT" \
@@ -401,3 +430,4 @@ function make_pfx() {
 
     return 0
 }
+