Added manual certificate creation examples.

README.md

@@ -262,19 +262,6 @@ python3 generate-mobileconfig.py \
     --output alice-vpn.mobileconfig
 ```
 
----
+## Example commands
 
-## Self-signed certificate
-
-The following command creates a full-featured self-signed certificate usable as a CA and for client/server authentication:
-
-```bash
-openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-    -keyout "key.pem" \
-    -out "cert.pem" \
-    -subj "/CN=<user name>/O=<user organization>/C=<CC>" \
-    -addext "basicConstraints=critical,CA:TRUE" \
-    -addext "keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign,cRLSign" \
-    -addext "extendedKeyUsage=serverAuth,clientAuth" \
-    -addext "subjectAltName=DNS:<computer_name>"
-```
+Sometimes it is necessary to use customized scripts for a specific environment. Look at ready  to customize and use examples in `make_certs.sh`. `show_certs.sh` displays essential certifcate information for all PEM files in the current working directory.

make_certs.sh

@@ -0,0 +1,124 @@
+# Root CA certificate
+openssl req \
+    -x509 \
+    -newkey rsa:4096 \
+    -keyout ca_key.pem \
+    -out ca_cert.pem \
+    -days 3650 \
+    -noenc \
+    -subj "/CN=Test CA $(date +"%Y-%m-%d")" \
+    -text \
+    -addext "basicConstraints=critical,CA:TRUE,pathlen:1" \
+    -addext "keyUsage=critical,keyCertSign,cRLSign"
+
+# Issuing CA certificate
+openssl req \
+    -newkey rsa:4096 \
+    -keyout issuing_ca_key.pem \
+    -noenc \
+    -subj "/CN=Issuing Test CA $(date +"%Y-%m-%d")" \
+    -addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
+    -addext "keyUsage=critical,keyCertSign,cRLSign" |
+    openssl x509 \
+        -req \
+        -CA ca_cert.pem \
+        -CAkey ca_key.pem \
+        -copy_extensions copyall \
+        -days 3650 \
+        -text \
+        -out issuing_ca_cert.pem
+
+# Client signing request
+openssl req \
+    -newkey rsa:4096 \
+    -keyout client_key.pem \
+    -out client_req.pem \
+    -noenc \
+    -subj "/CN=Test Client" \
+    -addext "basicConstraints=critical,CA:FALSE" \
+    -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
+    -addext "extendedKeyUsage=clientAuth"
+
+# Server signing request
+openssl req \
+    -newkey rsa:4096 \
+    -keyout server_key.pem \
+    -out server_req.pem \
+    -noenc \
+    -subj "/CN=test.example.com" \
+    -addext "basicConstraints=critical,CA:FALSE" \
+    -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
+    -addext "extendedKeyUsage=serverAuth" \
+    -addext "subjectAltName=DNS:test.example.com,DNS:test,IP:127.0.0.1"
+
+# User signing request
+openssl req \
+    -newkey rsa:4096 \
+    -keyout user_key.pem \
+    -out user_req.pem \
+    -noenc \
+    -subj "/CN=Test User/emailAddress=testuser@example.com" \
+    -addext "basicConstraints=critical,CA:FALSE" \
+    -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
+    -addext "extendedKeyUsage=clientAuth,emailProtection,codeSigning" \
+    -addext "subjectAltName=email:alias@example.com"
+
+# Sign client certificate with issuing CA
+openssl x509 \
+    -req \
+    -in client_req.pem \
+    -CA issuing_ca_cert.pem \
+    -CAkey issuing_ca_key.pem \
+    -copy_extensions copyall \
+    -days 365 \
+    -out client_cert.pem
+
+# Sign server certificate with issuing CA
+openssl x509 \
+    -req \
+    -in server_req.pem \
+    -CA issuing_ca_cert.pem \
+    -CAkey issuing_ca_key.pem \
+    -copy_extensions copyall \
+    -days 365 \
+    -out server_cert.pem
+
+# Sign user certificate with issuing CA
+openssl x509 \
+    -req \
+    -in user_req.pem \
+    -CA issuing_ca_cert.pem \
+    -CAkey issuing_ca_key.pem \
+    -copy_extensions copyall \
+    -days 365 \
+    -out user_cert.pem
+
+# Certificate chain for PKCS#12 bundles
+cat issuing_ca_cert.pem ca_cert.pem > ca_chain.pem
+
+# Client PKCS#12 bundle
+openssl pkcs12 \
+    -export \
+    -out client.pfx \
+    -inkey client_key.pem \
+    -in client_cert.pem \
+    -certfile ca_chain.pem \
+    -passout pass:changeit
+
+# Server PKCS#12 bundle
+openssl pkcs12 \
+    -export \
+    -out server.pfx \
+    -inkey server_key.pem \
+    -in server_cert.pem \
+    -certfile ca_chain.pem \
+    -passout pass:changeit
+
+# User PKCS#12 bundle
+openssl pkcs12 \
+    -export \
+    -out user.pfx \
+    -inkey user_key.pem \
+    -in user_cert.pem \
+    -certfile ca_chain.pem \
+    -passout pass:changeit

show_certs.sh

@@ -0,0 +1,6 @@
+# Show all certificates
+for cert in *_cert.pem; do
+    echo "Certificate: $cert"
+    openssl x509 -noout -subject -issuer -fingerprint -email -ext subjectAltName -in $cert
+    echo ""
+done