自签名证书：将值提取到 conf 文件中

Question

I'm creating self signed certificate. It is one ssl sertificate for several local domains:

• local.dev.lat.com
• local.dev.bet.com
• local.dev.cat.com
• local.dev.mon.com
• local.dev.pop.com
• ...

I have this command for creating that:

openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
  -keyout server.key \
  -out server.crt \
  -subj "/CN=*.local.dev.lat.com,*.local.dev.bet.com" \
  -addext "subjectAltName=DNS:*.local.dev.bet.com,DNS:local.dev.bet.com,DNS:*.local.dev.bet.com,DNS:local.dev.bet.com,IP:127.0.0.1"

My question is: as I have around 30 domains I would like to extract -subj and -addext params to conf file somehow. Is it possible?

Answer 1

Let's call your certificate server.crt ${CERT} .

You can easily get all of the requested info in one command openssl x509 -noout -in ${CERT} -text . You can parse that, but it's not ideal. Look at the man page for x509 for better options.

Note I am using bash to do variable substitution. You should too.

To get the serial:

serial=$(openssl x509 -serial -noout -in ${CERT}); #get only the serial
serial=${serial#*=}; #strip the 'serial=' header

To get the subject:

subject=$(openssl x509 -subject -noout -in ${CERT}); #get only the subject
subject=${subject#*=}; #strip the 'subject=' header

Now for the subjectAltName... It's an x509 extension, so it gets a bit trickier. But lets try anyways:

#use almost every certopt that exists to narrow display to X509v3 section
altname=$(openssl x509 -noout -in ${CERT} -text -certopt no_header,no_version,no_signame \
 -certopt no_validity,no_subject,no_issuer,no_pubkey,no_sigdump,no_aux,no_serial)

#remove previous extensions, headers, and leading spaces
altname=${altname#*X509v3 Subject Alternative Name: $'\n'                };

#remove any possible sections after
altname=${altname%%$'\n'*}

#unset the variable if subjectAltName didn't exist
[[ "${altname}" == "        X509v3 extensions:" ]] && unset altname

Your mileage may vary whilst parsing altname. I just whipped this up in a few minutes, so I'm sure i missed some edge cases. Anyways...

Now you have three variables you can throw at anything however you want;

echo -e "${CERT}:\n  Serial:\n    ${serial}\n  Subject:\n    ${subject}\n  subjectAltName:\n    ${altname}"

That's it. Job done...

#there seems to be a pattern forming here
openssl ec     -text -noout -check  -in private.key #check private key
openssl req    -text -noout -verify -in CSR.csr #check signing request
openssl x509   -text -noout         -in public.crt #check public key
openssl pkcs12 -info -noout         -in keyStore.p12 #check client cert
openssl crl    -text -noout         -in revocation.crl #check certificate revocation list