1*e99f9620SSascha Wildner#!/bin/sh 2*e99f9620SSascha Wildner# 3*e99f9620SSascha Wildner# See uefisign(8) manual page for usage instructions. 4*e99f9620SSascha Wildner# 5*e99f9620SSascha Wildner# $FreeBSD: head/share/examples/uefisign/uefikeys 279321 2015-02-26 14:22:27Z trasz $ 6*e99f9620SSascha Wildner# 7*e99f9620SSascha Wildner 8*e99f9620SSascha Wildnerdie() { 9*e99f9620SSascha Wildner echo "$*" > /dev/stderr 10*e99f9620SSascha Wildner exit 1 11*e99f9620SSascha Wildner} 12*e99f9620SSascha Wildner 13*e99f9620SSascha Wildnerif [ $# -ne 1 ]; then 14*e99f9620SSascha Wildner echo "usage: $0 common-name" 15*e99f9620SSascha Wildner exit 1 16*e99f9620SSascha Wildnerfi 17*e99f9620SSascha Wildner 18*e99f9620SSascha Wildnercertfile="${1}.pem" 19*e99f9620SSascha Wildnerefifile="${1}.cer" 20*e99f9620SSascha Wildnerkeyfile="${1}.key" 21*e99f9620SSascha Wildner# XXX: Set this to ten years; we don't want system to suddenly stop booting 22*e99f9620SSascha Wildner# due to certificate expiration. Better way would be to use Authenticode 23*e99f9620SSascha Wildner# Timestamp. That said, the rumor is UEFI implementations ignore it anyway. 24*e99f9620SSascha Wildnerdays="3650" 25*e99f9620SSascha Wildnersubj="/CN=${1}" 26*e99f9620SSascha Wildner 27*e99f9620SSascha Wildner[ ! -e "${certfile}" ] || die "${certfile} already exists" 28*e99f9620SSascha Wildner[ ! -e "${efifile}" ] || die "${efifile} already exists" 29*e99f9620SSascha Wildner[ ! -e "${keyfile}" ] || die "${keyfile} already exists" 30*e99f9620SSascha Wildner 31*e99f9620SSascha Wildnerumask 077 || die "umask 077 failed" 32*e99f9620SSascha Wildner 33*e99f9620SSascha Wildneropenssl genrsa -out "${keyfile}" 2048 2> /dev/null || die "openssl genrsa failed" 34*e99f9620SSascha Wildneropenssl req -new -x509 -sha256 -days "${days}" -subj "${subj}" -key "${keyfile}" -out "${certfile}" || die "openssl req failed" 35*e99f9620SSascha Wildneropenssl x509 -inform PEM -outform DER -in "${certfile}" -out "${efifile}" || die "openssl x509 failed" 36*e99f9620SSascha Wildner 37*e99f9620SSascha Wildnerecho "certificate: ${certfile}; private key: ${keyfile}; certificate to enroll in UEFI: ${efifile}" 38