重新生成https证书

创建mkdir genHttpsCert.sh文件并插入以下内容。

执行方式 sh genHttpsCert.sh [ip1,ip2……ipn]

#!/bin/bash

cur_dir=$(cd `dirname $0`; pwd)
ssl_dir=$cur_dir"/ssl"
mkdir "$ssl_dir"
caConf=$ssl_dir"/ca.cnf"
consulConf=$ssl_dir"/consul.cnf"
serverConf=$ssl_dir"/server.cnf"
clientConf=$ssl_dir"/client.cnf"
caKey=$ssl_dir"/ca.key"
consulKey=$ssl_dir"/consul.key"
serverKey=$ssl_dir"/server.key"
clientKey=$ssl_dir"/client.key"
caCsr=$ssl_dir"/ca.csr"
consulCsr=$ssl_dir"/consul.csr"
serverCsr=$ssl_dir"/server.csr"
clientCsr=$ssl_dir"/client.csr"
caCer=$ssl_dir"/ca.cer"
consulCer=$ssl_dir"/consul.cer"
serverCer=$ssl_dir"/server.cer"
clientCer=$ssl_dir"/client.cer"
caP12=$ssl_dir"/ca.p12"
caTrustP12=$ssl_dir"/ca_.p12"
consulP12=$ssl_dir"/consul.p12"
serverP12=$ssl_dir"/server.p12"
clientP12=$ssl_dir"/client.p12"
function genCaCnf(){
	str="[req]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[req_distinguished_name]\ncountryName = Country Name (2 letter code)\ncountryName_default = CN\nstateOrProvinceName = State or Province Name (full name)\nstateOrProvinceName_default = GD\nlocalityName = Locality Name (eg, city)\nlocalityName_default = SZ\norganizationalUnitName = Organizational Unit Name (eg, section)\norganizationalUnitName_default = audaque\ncommonName = ca\ncommonName_max = 64\n[ v3_req ]\nbasicConstraints = CA:TRUE\nkeyUsage = cRLSign,keyCertSign"
	echo -e $str > $caConf
	
}
function genClientCnf(){
	str="[req]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[req_distinguished_name]\ncountryName = Country Name (2 letter code)\ncountryName_default = CN\nstateOrProvinceName = State or Province Name (full name)\nstateOrProvinceName_default = GD\nlocalityName = Locality Name (eg, city)\nlocalityName_default = SZ\norganizationalUnitName = Organizational Unit Name (eg, section)\norganizationalUnitName_default = audaque\ncommonName = client\ncommonName_max = 64\n[ v3_req ]\n# Extensions to add to a certificate request\nextendedKeyUsage = clientAuth\nkeyUsage = digitalSignature,keyEncipherment"
	echo -e $str > $clientConf
}
function genServerCnf(){
	domains=(audaque.com audaque1.com audaque2.com www.audaqueproxy.com)
	str="[req]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[req_distinguished_name]\ncountryName = Country Name (2 letter code)\ncountryName_default = CN\nstateOrProvinceName = State or Province Name (full name)\nstateOrProvinceName_default = GD\nlocalityName = Locality Name (eg, city)\nlocalityName_default = SZ\norganizationalUnitName = Organizational Unit Name (eg,section)\norganizationalUnitName_default = audaque\ncommonName = server\ncommonName_max = 64\n[ v3_req ]\n# Extensions to add to a certificate request\nextendedKeyUsage = serverAuth\nkeyUsage = digitalSignature,keyEncipherment\nsubjectAltName = @alt_names\n[alt_names]\n"
	i=1
	for domain in "${domains[@]}"
	do 
		domainKeyValue="DNS."$i"="$domain"\n"
		str=$str""$domainKeyValue
		i=`expr $i + 1`
	done
	
	i=1
	for ip in $*
	do 
		ipKeyValue="IP."$i"="$ip"\n"
		str=$str""$ipKeyValue
		i=`expr $i + 1`
	done
	echo -e $str > $serverConf
}
function genConsulCnf(){
  domains=(adq-msp server.adq-msp.consul audaque.com audaque1.com audaque2.com www.audaqueproxy.com)
	
	str="[req]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[req_distinguished_name]\ncountryName = Country Name (2 letter code)\ncountryName_default = CN\nstateOrProvinceName = State or Province Name (full name)\nstateOrProvinceName_default = GD\nlocalityName = Locality Name (eg, city)\nlocalityName_default = SZ\norganizationalUnitName = Organizational Unit Name (eg, section)\norganizationalUnitName_default = audaque\ncommonName = consul_server\ncommonName_max = 64\n[ v3_req ]\n# Extensions to add to a certificate request\nextendedKeyUsage = serverAuth,clientAuth\nkeyUsage = digitalSignature,keyEncipherment\nsubjectAltName = @alt_names\n[alt_names]\n"
	domainKeyValue="DNS.1="$domain"\n"
	str=$str""$domainKeyValue
	i=1
  for domain in "${domains[@]}"
	do 
		domainKeyValue="DNS."$i"="$domain"\n"
		str=$str""$domainKeyValue
		i=`expr $i + 1`
	done
  i=1
	for ip in $*
	do 
		ipKeyValue="IP."$i"="$ip"\n"
		str=$str""$ipKeyValue
		i=`expr $i + 1`
	done
	echo -e $str > $consulConf
}


#genCaCnf
genClientCnf
genServerCnf $*
genConsulCnf $*

#openssl genrsa -out $caKey -aes256 -passout pass:Audaque@123 3072
openssl genrsa -out $serverKey -aes256 -passout pass:audaque@123 3072
openssl genrsa -out $clientKey -aes256 -passout pass:audaque@123 3072
openssl genrsa -out $consulKey -aes256 -passout pass:audaque@123 3072
#oem版本使用
#openssl genpkey -out $caKey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -pass pass:Audaque@123
#openssl genpkey -out $serverKey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -pass pass:Audaque@123
#openssl genpkey -out $clientKey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -pass pass:Audaque@123
#openssl genpkey -out $consulKey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -pass pass:Audaque@123
#生成证书
#openssl req -new -key $caKey -passin pass:Audaque@123 -out $caCsr -config $caConf -subj /C=cn/ST=gd/L=sz/O=audaque/OU=audaque/CN=ca/emailAddress=adqcloud@audaque.com
#openssl x509 -sha256 -req -in $caCsr -signkey $caKey -passin pass:Audaque@123 -out $caCer -days 3650 -extfile $caConf -extensions v3_req
openssl req -new -key $serverKey -passin pass:audaque@123 -out $serverCsr -config $serverConf -subj /C=cn/ST=gd/L=sz/O=audaque/OU=audaque/CN=server/emailAddress=adqcloud@audaque.com
openssl x509 -sha256 -req -CA $caCer -CAkey $caKey  -passin pass:audaque@123 -CAcreateserial -in $serverCsr -out $serverCer -days 3650 -extfile $serverConf -extensions v3_req
openssl req -new -key $clientKey -passin pass:audaque@123 -out $clientCsr -config $clientConf -subj /C=cn/ST=gd/L=sz/O=audaque/OU=audaque/CN=client/emailAddress=adqcloud@audaque.com
openssl x509 -sha256 -req -CA $caCer -CAkey $caKey  -passin pass:audaque@123 -CAcreateserial -in $clientCsr -out $clientCer -days 3650 -extfile $clientConf -extensions v3_req
openssl req -new -key $consulKey -passin pass:audaque@123 -out $consulCsr -config $consulConf -subj /C=cn/ST=gd/L=sz/O=audaque/OU=audaque/CN=consul/emailAddress=adqcloud@audaque.com
openssl x509 -sha256 -req -CA $caCer -CAkey $caKey  -passin pass:audaque@123 -CAcreateserial -in $consulCsr -out $consulCer -days 3650 -extfile $consulConf -extensions v3_req

#导出证书
openssl pkcs12 -export -in $serverCer -inkey $serverKey  -passin pass:audaque@123 -out $serverP12 -name server -CAfile $caCer -caname ca -passout pass:audaque@123
openssl pkcs12 -export -in $clientCer -inkey $clientKey  -passin pass:audaque@123 -out $clientP12 -name client -CAfile $caCer -caname ca -passout pass:audaque@123
openssl pkcs12 -export -in $consulCer -inkey $consulKey  -passin pass:audaque@123 -out $consulP12 -name consul -CAfile $caCer -caname ca -passout pass:audaque@123
#openssl pkcs12 -export -in $caCer -inkey $caKey  -passin pass:Audaque@123 -out $caP12 -name ca -passout pass:Audaque@123
#/data/adqcloud/jre/bin/keytool -import -alias ca -trustcacerts -file $caCer -storetype PKCS12 -storepass Audaque@123 -keystore $caTrustP12 -noprompt


rm -rf $ssl_dir/*.cnf
rm -rf $ssl_dir/*.csr
rm -rf $ssl_dir/*.srl