3 # unbound-control-setup.sh - set up SSL certificates for unbound-control
5 # Copyright (c) 2008, NLnet Labs. All rights reserved.
7 # This software is open source.
9 # Redistribution and use in source and binary forms, with or without
10 # modification, are permitted provided that the following conditions
13 # Redistributions of source code must retain the above copyright notice,
14 # this list of conditions and the following disclaimer.
16 # Redistributions in binary form must reproduce the above copyright notice,
17 # this list of conditions and the following disclaimer in the documentation
18 # and/or other materials provided with the distribution.
20 # Neither the name of the NLNET LABS nor the names of its contributors may
21 # be used to endorse or promote products derived from this software without
22 # specific prior written permission.
24 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25 # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
26 # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
27 # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
28 # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29 # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30 # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31 # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
32 # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34 # POSSIBILITY OF SUCH DAMAGE.
40 DESTDIR=@sysconfdir@/unbound
42 # issuer and subject name for certificates
44 CLIENTNAME=unbound-control
46 # validity period for certificates
49 # size of keys in bits
55 # base name for unbound server keys
56 SVR_BASE=unbound_server
58 # base name for unbound-control keys
59 CTL_BASE=unbound_control
61 # we want -rw-r----- access (say you run this as root: grp=yes (server), all=no).
68 echo "$0 fatal error: $1"
73 while test $# -ne 0; do
76 if test $# -eq 1; then error "need argument for -d"; fi
81 echo "unbound-control-setup.sh - setup SSL keys for unbound-control"
82 echo " -d dir use directory to store keys and certificates."
83 echo " default: $DESTDIR"
84 echo "please run this command using the same user id that the "
85 echo "unbound daemon uses, it needs read privileges."
93 echo "setup in directory $DESTDIR"
94 cd "$DESTDIR" || error "could not cd to $DESTDIR"
96 # create certificate keys; do not recreate if they already exist.
97 if test -f $SVR_BASE.key; then
98 echo "$SVR_BASE.key exists"
100 echo "generating $SVR_BASE.key"
101 openssl genrsa -out $SVR_BASE.key $BITS || error "could not genrsa"
103 if test -f $CTL_BASE.key; then
104 echo "$CTL_BASE.key exists"
106 echo "generating $CTL_BASE.key"
107 openssl genrsa -out $CTL_BASE.key $BITS || error "could not genrsa"
110 # create self-signed cert for server
111 cat >request.cfg <<EOF
116 distinguished_name=req_distinguished_name
118 [req_distinguished_name]
119 commonName=$SERVERNAME
121 test -f request.cfg || error "could not create request.cfg"
123 echo "create $SVR_BASE.pem (self signed certificate)"
124 openssl req -key $SVR_BASE.key -config request.cfg -new -x509 -days $DAYS -out $SVR_BASE.pem || error "could not create $SVR_BASE.pem"
125 # create trusted usage pem
126 openssl x509 -in $SVR_BASE.pem -addtrust serverAuth -out $SVR_BASE"_trust.pem"
128 # create client request and sign it, piped
129 cat >request.cfg <<EOF
134 distinguished_name=req_distinguished_name
136 [req_distinguished_name]
137 commonName=$CLIENTNAME
139 test -f request.cfg || error "could not create request.cfg"
141 echo "create $CTL_BASE.pem (signed client certificate)"
142 openssl req -key $CTL_BASE.key -config request.cfg -new | openssl x509 -req -days $DAYS -CA $SVR_BASE"_trust.pem" -CAkey $SVR_BASE.key -CAcreateserial -$HASH -out $CTL_BASE.pem
143 test -f $CTL_BASE.pem || error "could not create $CTL_BASE.pem"
144 # create trusted usage pem
145 # openssl x509 -in $CTL_BASE.pem -addtrust clientAuth -out $CTL_BASE"_trust.pem"
147 # see details with openssl x509 -noout -text < $SVR_BASE.pem
148 # echo "create $CTL_BASE""_browser.pfx (web client certificate)"
149 # echo "create webbrowser PKCS#12 .PFX certificate file. In Firefox import in:"
150 # echo "preferences - advanced - encryption - view certificates - your certs"
151 # echo "empty password is used, simply click OK on the password dialog box."
152 # openssl pkcs12 -export -in $CTL_BASE"_trust.pem" -inkey $CTL_BASE.key -name "unbound remote control client cert" -out $CTL_BASE"_browser.pfx" -password "pass:" || error "could not create browser certificate"
154 # remove unused permissions
155 chmod o-rw $SVR_BASE.pem $SVR_BASE.key $CTL_BASE.pem $CTL_BASE.key
159 rm -f $CTL_BASE"_trust.pem" $SVR_BASE"_trust.pem" $SVR_BASE"_trust.srl"
161 echo "Setup success. Certificates created. Enable in unbound.conf file to use"