create-codesign

#!/usr/bin/env bash

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

# Derek Moore <derek.moore@gmail.com>
# Christian Göttsche <cgzones@googlemail.com>
# Tom Bereknyei <tomberek@gmail.com>

set -eu
set -o pipefail

umask 0077

BIN_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
source "${BIN_DIR}/functions"
source "${BIN_DIR}/defaults.conf"

usage() {
    echo "Usage: $0 -c CERT_NAME"
    echo "Issues a code signing certificate named CERT_NAME"
    echo
    echo "Options:"
    echo "    -c CERT_NAME  Certificate name (commonName) for the new cert"
    echo
}

if [ ! -f ca/ca.crt ]; then
    echo -e "$ERR Must be run inside a CA directory!"
    exit 2
fi

CERT_NAME=

while getopts c:h FLAG; do
    case $FLAG in
        c) CERT_NAME=${OPTARG} ;;
        h) echo -e -n "$SUCC " && usage && exit 0 ;;
        *) echo -e -n "$ERR " && usage && exit 2 ;;
    esac
done

if [ $OPTIND -le $# ]; then
    echo -e -n "$ERR " && usage && exit 2
elif [ "${CERT_NAME}" = "" ]; then
    echo -e -n "$ERR " && usage && exit 1
fi

SAFE_NAME=$(echo "${CERT_NAME}" | sed 's/\*/star/g' | sed 's/[^A-Za-z0-9-]/-/g')

echo -e "$NOTE Creating new code signing certificate named '$CERT_NAME'" >&2

pushd "${BIN_DIR}/.." > /dev/null

if [ -d "certs/codesign/$SAFE_NAME" ]; then
    echo -e "$ERR Configuration already exists for '$CERT_NAME' ($SAFE_NAME), exiting." >&2
    exit 1
fi


echo
if [ -n "$CA_ENABLE_ENGINE" ]; then
    echo -e "$NOTE Your CA key is on PKCS11 device, enter PIN." >&2
fi
PASS=`ask -s "$INPUT Enter passphrase for signing CA key: " CA_SIGN_PASS_DEFAULT "${SIGN_PASS:-""}"`
echo >&2
export CA_PASS="${PASS}"

openssl_engine_cmd='
    -engine pkcs11 
    -inform engine
    -in pkcs11:object=SIGN%20key'
openssl rsa \
            ${CA_ENABLE_ENGINE:+$openssl_engine_cmd} \
            $( [ -z $CA_ENABLE_ENGINE ] && echo "-check -in ca/private/ca.key") \
            -noout \
            -passin env:CA_PASS

trap 'rm -Rf "certs/codesign/$SAFE_NAME"' 0
mkdir -p "certs/codesign/$SAFE_NAME"

# Generate the code signing cert openssl config
export CA_USERNAME="${CERT_NAME}"
export CA_CERT_MAIL=""
ask_client_cert_questions
template "${BIN_DIR}/templates/codesign.tpl" "certs/codesign/$SAFE_NAME/$SAFE_NAME.conf"

SURE=`ask "$INPUT Create csr on pkcs11 device? (key must be in \"PIV AUTH key\" or 9a) [y/N]: " CA_USE_PKCS11 "N"`
if [ "${SURE}" != "y" ] && [ "${SURE}" != "Y" ]; then
    ENABLE_ENGINE=
else
    export PIV_PASS=$(ask_pass_once "Enter PIN for PIV key:" "" "${USER_PASS:-""}")
    ENABLE_ENGINE=1
    CA_PASS=$PIV_PASS init_slot 9a "certs/codesign/$SAFE_NAME/$SAFE_NAME.pub" "pkcs11:object=PIV%20AUTH%20key"
fi

P12_PASSWORD=`ask -s "$INPUT Enter P12 export password (empty to not export): " CA_P12_PASSWORD ""`
echo >&2

echo -e "$NOTE Creating the code signing key and csr" >&2

# Create the code signing key and csr
openssl_engine_cmd='
    -engine pkcs11 
    -keyform engine
    -key pkcs11:object=PIV%20AUTH%20key
    -passin env:PIV_PASS'
openssl req -new -batch \
            ${ENABLE_ENGINE:+$openssl_engine_cmd} \
            -config "certs/codesign/$SAFE_NAME/$SAFE_NAME.conf" \
            -out "certs/codesign/$SAFE_NAME/$SAFE_NAME.csr" \
            $( [ -z $ENABLE_ENGINE ] && echo "
            -nodes
            -keyout certs/codesign/$SAFE_NAME/$SAFE_NAME.key")

openssl_engine_cmd='
    -engine pkcs11 
    -inform engine
    -in pkcs11:object=PIV%20AUTH%20key
    -passin env:PIV_PASS'
openssl rsa \
            ${ENABLE_ENGINE:+$openssl_engine_cmd} \
            $( [ -z $ENABLE_ENGINE ] && echo "-check -in certs/codesign/$SAFE_NAME/$SAFE_NAME.key") \
            -noout

if [ -z "$ENABLE_ENGINE" ]; then
    chmod 0400 "certs/codesign/$SAFE_NAME/$SAFE_NAME.key"
    openssl rsa -in "certs/codesign/$SAFE_NAME/$SAFE_NAME.key" \
        -pubout -out "certs/codesign/$SAFE_NAME/$SAFE_NAME.pub"
fi

echo -e "$NOTE Creating the code signing certificate" >&2

# Create the code signing certificate
openssl_engine_cmd="\
    -engine pkcs11 \
    -keyform engine \
    -keyfile pkcs11:object=SIGN%20key"
openssl ca -batch -notext \
           ${CA_ENABLE_ENGINE:+$openssl_engine_cmd} \
           -config ca/ca.conf \
           -in "certs/codesign/$SAFE_NAME/$SAFE_NAME.csr" \
           -out "certs/codesign/$SAFE_NAME/$SAFE_NAME.crt" \
           -extensions codesign_ext \
           -passin env:CA_PASS

if [[ -n "$ENABLE_ENGINE" ]]; then
    replace_crt 9a certs/codesign/"$SAFE_NAME"/"$SAFE_NAME".crt
fi

echo -e "$NOTE Verifying certificate/key pair" >&2

openssl_engine_cmd="\
    -engine pkcs11 \
    -inform engine \
    -in pkcs11:object=PIV%20AUTH%20key \
    -passin env:PIV_PASS"
key_mod=$(openssl rsa \
    ${ENABLE_ENGINE:+$openssl_engine_cmd} -noout -modulus \
    $( [ -z $ENABLE_ENGINE ] && echo "-in certs/codesign/$SAFE_NAME/$SAFE_NAME.key")
)

cert_mod=$(openssl x509 -noout -modulus -in "certs/codesign/$SAFE_NAME/$SAFE_NAME.crt")

if [ ! "$key_mod" = "$cert_mod" ];then
    echo -e "$ERR Certificate/Key pair invalid:"
    echo -e "$ERR     <>$cert_mod<>"
    echo -e "$ERR     <>$key_mod<>"
    echo
    exit 2
fi

echo -e "$NOTE Verifying trusted chain" >&2

openssl verify -CAfile ca/chain.pem "certs/codesign/$SAFE_NAME/$SAFE_NAME.crt"

echo -e "$NOTE Exporting to a p12 file" >&2

export P12_PASSWORD
openssl pkcs12 -export \
    -password env:P12_PASSWORD \
    -in certs/codesign/$SAFE_NAME/$SAFE_NAME.crt \
    -inkey certs/codesign/$SAFE_NAME/$SAFE_NAME.key \
    -certfile ca/ca.crt \
    -out certs/codesign/$SAFE_NAME/$SAFE_NAME.p12

popd > /dev/null

unset CA_PASS

trap 0

echo -e "$SUCC Code Signing certificate named '${CERT_NAME}' created."