1*2175Sjp161948 2*2175Sjp161948=pod 3*2175Sjp161948 4*2175Sjp161948=head1 NAME 5*2175Sjp161948 6*2175Sjp161948CA.pl - friendlier interface for OpenSSL certificate programs 7*2175Sjp161948 8*2175Sjp161948=head1 SYNOPSIS 9*2175Sjp161948 10*2175Sjp161948B<CA.pl> 11*2175Sjp161948[B<-?>] 12*2175Sjp161948[B<-h>] 13*2175Sjp161948[B<-help>] 14*2175Sjp161948[B<-newcert>] 15*2175Sjp161948[B<-newreq>] 16*2175Sjp161948[B<-newreq-nodes>] 17*2175Sjp161948[B<-newca>] 18*2175Sjp161948[B<-xsign>] 19*2175Sjp161948[B<-sign>] 20*2175Sjp161948[B<-signreq>] 21*2175Sjp161948[B<-signcert>] 22*2175Sjp161948[B<-verify>] 23*2175Sjp161948[B<files>] 24*2175Sjp161948 25*2175Sjp161948=head1 DESCRIPTION 26*2175Sjp161948 27*2175Sjp161948The B<CA.pl> script is a perl script that supplies the relevant command line 28*2175Sjp161948arguments to the B<openssl> command for some common certificate operations. 29*2175Sjp161948It is intended to simplify the process of certificate creation and management 30*2175Sjp161948by the use of some simple options. 31*2175Sjp161948 32*2175Sjp161948=head1 COMMAND OPTIONS 33*2175Sjp161948 34*2175Sjp161948=over 4 35*2175Sjp161948 36*2175Sjp161948=item B<?>, B<-h>, B<-help> 37*2175Sjp161948 38*2175Sjp161948prints a usage message. 39*2175Sjp161948 40*2175Sjp161948=item B<-newcert> 41*2175Sjp161948 42*2175Sjp161948creates a new self signed certificate. The private key and certificate are 43*2175Sjp161948written to the file "newreq.pem". 44*2175Sjp161948 45*2175Sjp161948=item B<-newreq> 46*2175Sjp161948 47*2175Sjp161948creates a new certificate request. The private key and request are 48*2175Sjp161948written to the file "newreq.pem". 49*2175Sjp161948 50*2175Sjp161948=item B<-newreq-nodes> 51*2175Sjp161948 52*2175Sjp161948is like B<-newreq> except that the private key will not be encrypted. 53*2175Sjp161948 54*2175Sjp161948=item B<-newca> 55*2175Sjp161948 56*2175Sjp161948creates a new CA hierarchy for use with the B<ca> program (or the B<-signcert> 57*2175Sjp161948and B<-xsign> options). The user is prompted to enter the filename of the CA 58*2175Sjp161948certificates (which should also contain the private key) or by hitting ENTER 59*2175Sjp161948details of the CA will be prompted for. The relevant files and directories 60*2175Sjp161948are created in a directory called "demoCA" in the current directory. 61*2175Sjp161948 62*2175Sjp161948=item B<-pkcs12> 63*2175Sjp161948 64*2175Sjp161948create a PKCS#12 file containing the user certificate, private key and CA 65*2175Sjp161948certificate. It expects the user certificate and private key to be in the 66*2175Sjp161948file "newcert.pem" and the CA certificate to be in the file demoCA/cacert.pem, 67*2175Sjp161948it creates a file "newcert.p12". This command can thus be called after the 68*2175Sjp161948B<-sign> option. The PKCS#12 file can be imported directly into a browser. 69*2175Sjp161948If there is an additional argument on the command line it will be used as the 70*2175Sjp161948"friendly name" for the certificate (which is typically displayed in the browser 71*2175Sjp161948list box), otherwise the name "My Certificate" is used. 72*2175Sjp161948 73*2175Sjp161948=item B<-sign>, B<-signreq>, B<-xsign> 74*2175Sjp161948 75*2175Sjp161948calls the B<ca> program to sign a certificate request. It expects the request 76*2175Sjp161948to be in the file "newreq.pem". The new certificate is written to the file 77*2175Sjp161948"newcert.pem" except in the case of the B<-xsign> option when it is written 78*2175Sjp161948to standard output. 79*2175Sjp161948 80*2175Sjp161948 81*2175Sjp161948=item B<-signCA> 82*2175Sjp161948 83*2175Sjp161948this option is the same as the B<-signreq> option except it uses the configuration 84*2175Sjp161948file section B<v3_ca> and so makes the signed request a valid CA certificate. This 85*2175Sjp161948is useful when creating intermediate CA from a root CA. 86*2175Sjp161948 87*2175Sjp161948=item B<-signcert> 88*2175Sjp161948 89*2175Sjp161948this option is the same as B<-sign> except it expects a self signed certificate 90*2175Sjp161948to be present in the file "newreq.pem". 91*2175Sjp161948 92*2175Sjp161948=item B<-verify> 93*2175Sjp161948 94*2175Sjp161948verifies certificates against the CA certificate for "demoCA". If no certificates 95*2175Sjp161948are specified on the command line it tries to verify the file "newcert.pem". 96*2175Sjp161948 97*2175Sjp161948=item B<files> 98*2175Sjp161948 99*2175Sjp161948one or more optional certificate file names for use with the B<-verify> command. 100*2175Sjp161948 101*2175Sjp161948=back 102*2175Sjp161948 103*2175Sjp161948=head1 EXAMPLES 104*2175Sjp161948 105*2175Sjp161948Create a CA hierarchy: 106*2175Sjp161948 107*2175Sjp161948 CA.pl -newca 108*2175Sjp161948 109*2175Sjp161948Complete certificate creation example: create a CA, create a request, sign 110*2175Sjp161948the request and finally create a PKCS#12 file containing it. 111*2175Sjp161948 112*2175Sjp161948 CA.pl -newca 113*2175Sjp161948 CA.pl -newreq 114*2175Sjp161948 CA.pl -signreq 115*2175Sjp161948 CA.pl -pkcs12 "My Test Certificate" 116*2175Sjp161948 117*2175Sjp161948=head1 DSA CERTIFICATES 118*2175Sjp161948 119*2175Sjp161948Although the B<CA.pl> creates RSA CAs and requests it is still possible to 120*2175Sjp161948use it with DSA certificates and requests using the L<req(1)|req(1)> command 121*2175Sjp161948directly. The following example shows the steps that would typically be taken. 122*2175Sjp161948 123*2175Sjp161948Create some DSA parameters: 124*2175Sjp161948 125*2175Sjp161948 openssl dsaparam -out dsap.pem 1024 126*2175Sjp161948 127*2175Sjp161948Create a DSA CA certificate and private key: 128*2175Sjp161948 129*2175Sjp161948 openssl req -x509 -newkey dsa:dsap.pem -keyout cacert.pem -out cacert.pem 130*2175Sjp161948 131*2175Sjp161948Create the CA directories and files: 132*2175Sjp161948 133*2175Sjp161948 CA.pl -newca 134*2175Sjp161948 135*2175Sjp161948enter cacert.pem when prompted for the CA file name. 136*2175Sjp161948 137*2175Sjp161948Create a DSA certificate request and private key (a different set of parameters 138*2175Sjp161948can optionally be created first): 139*2175Sjp161948 140*2175Sjp161948 openssl req -out newreq.pem -newkey dsa:dsap.pem 141*2175Sjp161948 142*2175Sjp161948Sign the request: 143*2175Sjp161948 144*2175Sjp161948 CA.pl -signreq 145*2175Sjp161948 146*2175Sjp161948=head1 NOTES 147*2175Sjp161948 148*2175Sjp161948Most of the filenames mentioned can be modified by editing the B<CA.pl> script. 149*2175Sjp161948 150*2175Sjp161948If the demoCA directory already exists then the B<-newca> command will not 151*2175Sjp161948overwrite it and will do nothing. This can happen if a previous call using 152*2175Sjp161948the B<-newca> option terminated abnormally. To get the correct behaviour 153*2175Sjp161948delete the demoCA directory if it already exists. 154*2175Sjp161948 155*2175Sjp161948Under some environments it may not be possible to run the B<CA.pl> script 156*2175Sjp161948directly (for example Win32) and the default configuration file location may 157*2175Sjp161948be wrong. In this case the command: 158*2175Sjp161948 159*2175Sjp161948 perl -S CA.pl 160*2175Sjp161948 161*2175Sjp161948can be used and the B<OPENSSL_CONF> environment variable changed to point to 162*2175Sjp161948the correct path of the configuration file "openssl.cnf". 163*2175Sjp161948 164*2175Sjp161948The script is intended as a simple front end for the B<openssl> program for use 165*2175Sjp161948by a beginner. Its behaviour isn't always what is wanted. For more control over the 166*2175Sjp161948behaviour of the certificate commands call the B<openssl> command directly. 167*2175Sjp161948 168*2175Sjp161948=head1 ENVIRONMENT VARIABLES 169*2175Sjp161948 170*2175Sjp161948The variable B<OPENSSL_CONF> if defined allows an alternative configuration 171*2175Sjp161948file location to be specified, it should contain the full path to the 172*2175Sjp161948configuration file, not just its directory. 173*2175Sjp161948 174*2175Sjp161948=head1 SEE ALSO 175*2175Sjp161948 176*2175Sjp161948L<x509(1)|x509(1)>, L<ca(1)|ca(1)>, L<req(1)|req(1)>, L<pkcs12(1)|pkcs12(1)>, 177*2175Sjp161948L<config(5)|config(5)> 178*2175Sjp161948 179*2175Sjp161948=cut 180