Update: Fixes and updates to two-level CA handling. Updated tests.

cert-functions.sh

@@ -1,3 +1,18 @@
+function make_hash_link() {
+    local CERT_PATH="$1"
+    if [[ ! -f "$CERT_PATH" ]]; then
+        echo "ERROR: Certificate file $CERT_PATH does not exist." >&2
+        return 1
+    fi
+    local CERT_DIR="$(dirname "$CERT_PATH")"
+    local HASH="$(openssl x509 -in "$CERT_PATH" -noout -hash 2>/dev/null)"
+    if [[ -z "$HASH" ]]; then
+        echo "ERROR: Failed to calculate hash for certificate $CERT_PATH." >&2
+        return 1
+    fi
+    ln -sf "$(basename "$CERT_PATH")" "$CERT_DIR/${HASH}.0"
+}
+
 function make_ca() {
     local CA_DAYS=3650 # Default validity period for CA certificates
 
@@ -79,6 +94,9 @@ function make_ca() {
             return 1
         fi
 
+        # Make a "hash" symlink for the CA certificate to allow OpenSSL to find it when verifying other certificates
+        make_hash_link "$CA_DIR/$ROOT_CA_CERT"
+
         return 0
     fi
 
@@ -104,6 +122,9 @@ function make_ca() {
         fi
     fi
 
+    # Make a "hash" symlink for the issuing CA certificate to allow OpenSSL to find it when verifying other certificates
+    make_hash_link "$CA_DIR/${CA_CERT}"
+
     return 0
 }
 
@@ -126,9 +147,18 @@ function _is_dns() {
 function make_server_cert() {
     local CA_FILE_PREFIX="ca" # Default to CA if no issuing CA is used
     local CERT_DAYS=365 # Default validity period for leaf certificates
+    local CA_DIR="" # The CA directory will default to certificate directory if not specified with --ca-dir
 
     while [[ $# -gt 0 ]]; do
         case "$1" in
+            --ca-dir)
+                if [[ -z "$2" ]]; then
+                    echo "ERROR: Missing value for --ca-dir." >&2
+                    return 1
+                fi
+                CA_DIR="$2"
+                shift 2
+                ;;
             --issuing-ca)
                 if [[ -z "$2" ]]; then
                     echo "ERROR: Missing value for --issuing-ca." >&2
@@ -157,6 +187,8 @@ function make_server_cert() {
     local CERT_SUBJECT_NAME="$2"
     shift 2
 
+    CA_DIR="${CA_DIR:-$CERT_DIR}"
+
     local CA_CERT="${CA_FILE_PREFIX}_cert.pem"
     local CA_KEY="${CA_FILE_PREFIX}_key.pem"
 
@@ -165,6 +197,11 @@ function make_server_cert() {
         return 1
     fi
 
+    if [[ -z "$CA_DIR" || ! -d "$CA_DIR" ]]; then
+        echo "ERROR: CA directory $CA_DIR does not exist." >&2
+        return 1
+    fi
+
     if [[ -z "$CERT_SUBJECT_NAME" ]]; then
         echo "ERROR: Subject name is required." >&2
         return 1
@@ -175,8 +212,8 @@ function make_server_cert() {
         return 1
     fi
 
-    if [[ ! -f "$CERT_DIR/$CA_CERT" || ! -f "$CERT_DIR/$CA_KEY" ]]; then
-        echo "ERROR: Signing CA certificate and key not found in $CERT_DIR. Please call setup a signing CA first." >&2
+    if [[ ! -f "$CA_DIR/$CA_CERT" || ! -f "$CA_DIR/$CA_KEY" ]]; then
+        echo "ERROR: Signing CA certificate and key not found in $CA_DIR. Please call setup a signing CA first." >&2
         return 1
     fi
 
@@ -222,8 +259,8 @@ function make_server_cert() {
             -addext "$SANS_EXT" \
         | openssl x509 \
             -req \
-            -CA "$CERT_DIR/$CA_CERT" \
-            -CAkey "$CERT_DIR/$CA_KEY" \
+            -CA "$CA_DIR/$CA_CERT" \
+            -CAkey "$CA_DIR/$CA_KEY" \
             -copy_extensions copyall \
             -days $CERT_DAYS \
             -text \