Update: replace hash symlink with CA bundle for certificate verification

simple-ca.sh

@@ -22,19 +22,19 @@
 
 # These functions require Bash and OpenSSL to be installed on the system.
 
-function make_hash_link() {
-    local CERT_PATH="$1"
-    if [[ ! -f "$CERT_PATH" ]]; then
-        echo "ERROR: Certificate file $CERT_PATH does not exist." >&2
-        return 1
+function _rebuild_ca_bundle() {
+    local CA_DIR="$1"
+    local BUNDLE="$CA_DIR/ca_bundle.pem"
+    : > "$BUNDLE"
+    if [[ -f "$CA_DIR/ca_cert.pem" ]]; then
+        cat "$CA_DIR/ca_cert.pem" >> "$BUNDLE"
     fi
-    local CERT_DIR="$(dirname "$CERT_PATH")"
-    local HASH="$(openssl x509 -in "$CERT_PATH" -noout -hash 2>/dev/null)"
-    if [[ -z "$HASH" ]]; then
-        echo "ERROR: Failed to calculate hash for certificate $CERT_PATH." >&2
-        return 1
-    fi
-    ln -sf "$(basename "$CERT_PATH")" "$CERT_DIR/${HASH}.0"
+    local f
+    for f in "$CA_DIR"/*_cert.pem; do
+        [[ -f "$f" ]] || continue
+        [[ "$(basename "$f")" == "ca_cert.pem" ]] && continue
+        cat "$f" >> "$BUNDLE"
+    done
 }
 
 function make_ca() {
@@ -129,8 +129,8 @@ function make_ca() {
             return 1
         fi
 
-        # Make a "hash" symlink for the CA certificate to allow OpenSSL to find it when verifying other certificates
-        make_hash_link "$CA_DIR/$ROOT_CA_CERT"
+        # Rebuild the CA bundle (root + any issuing CAs) for use with `openssl verify -CAfile`
+        _rebuild_ca_bundle "$CA_DIR"
 
         if [[ -n "$AIA_BASE_URL" ]]; then
             echo "$AIA_BASE_URL" > "$CA_DIR/aia_base_url.txt"
@@ -162,8 +162,8 @@ function make_ca() {
         fi
     fi
 
-    # Make a "hash" symlink for the issuing CA certificate to allow OpenSSL to find it when verifying other certificates
-    make_hash_link "$CA_DIR/${CA_CERT}"
+    # Rebuild the CA bundle (root + any issuing CAs) for use with `openssl verify -CAfile`
+    _rebuild_ca_bundle "$CA_DIR"
 
     if [[ -n "$AIA_BASE_URL" ]]; then
         echo "$AIA_BASE_URL" > "$CA_DIR/aia_base_url.txt"