Skip to content

Instantly share code, notes, and snippets.

@dobesv

dobesv/dev_signed_cert.sh

Last active August 26, 2025 20:29
Show Gist options
  • Save dobesv/13d4cb3cbd0fc4710fa55f89d1ef69be to your computer and use it in GitHub Desktop.
Save dobesv/13d4cb3cbd0fc4710fa55f89d1ef69be to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. dobesv revised this gist Feb 26, 2020. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions dev_signed_cert.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -20,7 +20,7 @@ CA_KEY=$DIR/dev_cert_ca.key.pem

    CA_CERT=$DIR/dev_cert_ca.cert.pem

    [ -f $CA_CERT ] || openssl req -x509 -new -nodes -key $CA_KEY -sha256 -days 1825 -out $CA_CERT
    [ -f $CA_CERT ] || openssl req -x509 -new -nodes -key $CA_KEY -sha256 -days 365 -out $CA_CERT

    HOST_KEY=$DIR/$NAME.key.pem

    @@ -47,7 +47,7 @@ if ! [ -f $HOST_CERT ] ; then
    done

    openssl x509 -req -in $HOST_CSR -CA $CA_CERT -CAkey $CA_KEY -CAcreateserial \
    -out $HOST_CERT -days 1825 -sha256 -extfile $HOST_EXT
    -out $HOST_CERT -days 365 -sha256 -extfile $HOST_EXT

    rm $HOST_EXT
    fi
  2. dobesv created this gist May 18, 2018.
    55 changes: 55 additions & 0 deletions dev_signed_cert.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,55 @@
    #!/usr/bin/env bash
    #
    # Usage: dev_signed_cert.sh HOSTNAME
    #
    # Creates a CA cert and then generates an SSL certificate signed by that CA for the
    # given hostname.
    #
    # After running this, add the generated dev_cert_ca.cert.pem to the trusted root
    # authorities in your browser / client system.
    #

    set -x

    DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
    NAME=${1:-localhost}

    CA_KEY=$DIR/dev_cert_ca.key.pem

    [ -f $CA_KEY ] || openssl genrsa -des3 -out $CA_KEY 2048

    CA_CERT=$DIR/dev_cert_ca.cert.pem

    [ -f $CA_CERT ] || openssl req -x509 -new -nodes -key $CA_KEY -sha256 -days 1825 -out $CA_CERT

    HOST_KEY=$DIR/$NAME.key.pem

    [ -f $HOST_KEY ] || openssl genrsa -out $HOST_KEY 2048

    HOST_CERT=$DIR/$NAME.cert.pem

    if ! [ -f $HOST_CERT ] ; then
    HOST_CSR=$DIR/$NAME.csr.pem
    [ -f $HOST_CSR ] || openssl req -new -key $HOST_KEY -out $HOST_CSR
    HOST_EXT=$DIR/$NAME.ext
    echo >$HOST_EXT
    echo >>$HOST_EXT authorityKeyIdentifier=keyid,issuer
    echo >>$HOST_EXT basicConstraints=CA:FALSE
    echo >>$HOST_EXT keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
    echo >>$HOST_EXT subjectAltName = @alt_names
    echo >>$HOST_EXT
    echo >>$HOST_EXT [alt_names]

    NAME_N=1
    for ALT_NAME in "$@" ; do
    echo >>$HOST_EXT DNS.$NAME_N = $NAME
    NAME_N=$(( NAME_N + 1 ))
    done

    openssl x509 -req -in $HOST_CSR -CA $CA_CERT -CAkey $CA_KEY -CAcreateserial \
    -out $HOST_CERT -days 1825 -sha256 -extfile $HOST_EXT

    rm $HOST_EXT
    fi