1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
|
#
# InspIRCd -- Internet Relay Chat Daemon
#
# Copyright (C) 2007 Dennis Friis <peavey@inspircd.org>
# Copyright (C) 2007 Craig Edwards <craigedwards@brainbox.cc>
#
# This file is part of InspIRCd. InspIRCd is free software: you can
# redistribute it and/or modify it under the terms of the GNU General Public
# License as published by the Free Software Foundation, version 2.
#
# This program is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
# details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
package make::gnutlscert;
require 5.8.0;
use strict;
use warnings FATAL => qw(all);
use Exporter 'import';
use make::configure;
our @EXPORT = qw(make_gnutls_cert);
# On OS X the GnuTLS certtool is prefixed to avoid collision with the system certtool.
my $certtool = $^O eq 'darwin' ? 'gnutls-certtool' : 'certtool';
sub make_gnutls_cert()
{
if (system "$certtool --version >/dev/null 2>&1")
{
print "\e[1;31mError:\e[0m unable to find '$certtool' in the PATH!\n";
return 1;
}
open (FH, ">certtool.template");
my $timestr = time();
my $commonname = promptstring_s('What is the hostname of your server?', 'irc.example.com');
my $email = promptstring_s('What email address can you be contacted at?', 'example@example.com');
my $unit = promptstring_s('What is the name of your unit?', 'Server Admins');
my $org = promptstring_s('What is the name of your organization?', 'Example IRC Network');
my $city = promptstring_s('What city are you located in?', 'Example City');
my $state = promptstring_s('What state are you located in?', 'Example State');
my $country = promptstring_s('What is the ISO 3166-1 code for the country you are located in?', 'XZ');
my $days = promptstring_s('How many days do you want your certificate to be valid for?', '365');
print FH <<__END__;
# X.509 Certificate options
#
# DN options
# The organization of the subject.
organization = "$org"
# The organizational unit of the subject.
unit = "$unit"
# The locality of the subject.
locality = "$city"
# The state of the certificate owner.
state = "$state"
# The country of the subject. Two letter code.
country = "$country"
# The common name of the certificate owner.
cn = "$commonname"
# A user id of the certificate owner.
#uid = "clauper"
# If the supported DN OIDs are not adequate you can set
# any OID here.
# For example set the X.520 Title and the X.520 Pseudonym
# by using OID and string pairs.
#dn_oid = "2.5.4.12" "Dr." "2.5.4.65" "jackal"
# This is deprecated and should not be used in new
# certificates.
# pkcs9_email = "none\@none.org"
# The serial number of the certificate
serial = $timestr
# In how many days, counting from today, this certificate will expire.
expiration_days = $days
# X.509 v3 extensions
# A dnsname in case of a WWW server.
#dns_name = "www.none.org"
# An IP address in case of a server.
#ip_address = "192.168.1.1"
# An email in case of a person
email = "$email"
# An URL that has CRLs (certificate revocation lists)
# available. Needed in CA certificates.
#crl_dist_points = "http://www.getcrl.crl/getcrl/"
# Whether this is a CA certificate or not
#ca
# Whether this certificate will be used for a TLS client
tls_www_client
# Whether this certificate will be used for a TLS server
tls_www_server
# Whether this certificate will be used to sign data (needed
# in TLS DHE ciphersuites).
signing_key
# Whether this certificate will be used to encrypt data (needed
# in TLS RSA ciphersuites). Note that it is prefered to use different
# keys for encryption and signing.
encryption_key
# Whether this key will be used to sign other certificates.
cert_signing_key
# Whether this key will be used to sign CRLs.
crl_signing_key
# Whether this key will be used to sign code.
code_signing_key
# Whether this key will be used to sign OCSP data.
ocsp_signing_key
# Whether this key will be used for time stamping.
time_stamping_key
__END__
close(FH);
if ( (my $status = system("$certtool --generate-privkey --outfile key.pem")) ne 0) { return 1; }
if ( (my $status = system("$certtool --generate-self-signed --load-privkey key.pem --outfile cert.pem --template certtool.template")) ne 0) { return 1; }
unlink("certtool.template");
return 0;
}
1;
|
