Public Access
135 lines
4.0 KiB
Bash
Executable File
135 lines
4.0 KiB
Bash
Executable File
#!/bin/bash
|
||
set -e
|
||
|
||
# Charybdis Development Certificate Generation Script
|
||
# This script generates self-signed certificates for local development and testing
|
||
|
||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
CERT_DIR="${SCRIPT_DIR}/../certs"
|
||
DAYS_VALID=365
|
||
|
||
echo "🔐 Charybdis Certificate Generation"
|
||
echo "===================================="
|
||
echo ""
|
||
|
||
# Create certs directory
|
||
mkdir -p "${CERT_DIR}"
|
||
cd "${CERT_DIR}"
|
||
|
||
# Function to generate certificate
|
||
generate_cert() {
|
||
local name=$1
|
||
local cn=$2
|
||
local ou=$3
|
||
local cert_type=$4 # "server" or "client"
|
||
|
||
echo "📝 Generating ${name}..."
|
||
|
||
# Generate private key
|
||
openssl genrsa -out "${name}-key.pem" 2048 2>/dev/null
|
||
|
||
# Generate CSR
|
||
openssl req -new \
|
||
-key "${name}-key.pem" \
|
||
-out "${name}.csr" \
|
||
-subj "/CN=${cn}/OU=${ou}/O=Charybdis-Dev/C=US" \
|
||
2>/dev/null
|
||
|
||
# Generate certificate
|
||
if [ "${cert_type}" = "server" ]; then
|
||
openssl x509 -req \
|
||
-days ${DAYS_VALID} \
|
||
-in "${name}.csr" \
|
||
-CA ca.pem \
|
||
-CAkey ca-key.pem \
|
||
-CAcreateserial \
|
||
-out "${name}-cert.pem" \
|
||
-extfile <(echo "extendedKeyUsage=serverAuth
|
||
subjectAltName=DNS:localhost,DNS:charybdis,DNS:charybdis.local,IP:127.0.0.1") \
|
||
2>/dev/null
|
||
else
|
||
openssl x509 -req \
|
||
-days ${DAYS_VALID} \
|
||
-in "${name}.csr" \
|
||
-CA ca.pem \
|
||
-CAkey ca-key.pem \
|
||
-CAcreateserial \
|
||
-out "${name}-cert.pem" \
|
||
-extfile <(echo "extendedKeyUsage=clientAuth") \
|
||
2>/dev/null
|
||
fi
|
||
|
||
# Clean up CSR
|
||
rm "${name}.csr"
|
||
|
||
echo " ✅ Generated ${name}-cert.pem and ${name}-key.pem"
|
||
}
|
||
|
||
# 1. Generate Root CA
|
||
echo "🏛️ Generating Root CA..."
|
||
if [ ! -f ca.pem ]; then
|
||
openssl genrsa -out ca-key.pem 4096 2>/dev/null
|
||
openssl req -new -x509 \
|
||
-days 3650 \
|
||
-key ca-key.pem \
|
||
-out ca.pem \
|
||
-subj "/CN=Charybdis Dev Root CA/O=Charybdis-Dev/C=US" \
|
||
2>/dev/null
|
||
echo " ✅ Generated ca.pem (Root CA)"
|
||
else
|
||
echo " ℹ️ Root CA already exists, skipping"
|
||
fi
|
||
echo ""
|
||
|
||
# 2. Generate Server Certificate
|
||
echo "🖥️ Generating Server Certificate..."
|
||
generate_cert "server" "localhost" "platform" "server"
|
||
echo ""
|
||
|
||
# 3. Generate Client Certificates
|
||
echo "👥 Generating Client Certificates..."
|
||
echo ""
|
||
|
||
# Admin client
|
||
generate_cert "admin" "admin-user" "platform-team" "client"
|
||
|
||
# CI/CD Pipeline client
|
||
generate_cert "ci-pipeline" "ci-pipeline" "automation" "client"
|
||
|
||
# Backstage client
|
||
generate_cert "backstage" "backstage" "platform" "client"
|
||
|
||
# DefectDojo plugin client
|
||
generate_cert "defectdojo-plugin" "defectdojo-plugin" "plugins" "client"
|
||
|
||
# DependencyTrack plugin client
|
||
generate_cert "dependencytrack-plugin" "dependencytrack-plugin" "plugins" "client"
|
||
|
||
echo ""
|
||
echo "✅ Certificate Generation Complete!"
|
||
echo ""
|
||
echo "📂 Certificates generated in: ${CERT_DIR}"
|
||
echo ""
|
||
echo "📋 Summary:"
|
||
echo " - Root CA: ca.pem, ca-key.pem"
|
||
echo " - Server: server-cert.pem, server-key.pem"
|
||
echo " - Clients:"
|
||
echo " • admin-cert.pem, admin-key.pem (role: admin)"
|
||
echo " • ci-pipeline-cert.pem, ci-pipeline-key.pem (role: service-writer)"
|
||
echo " • backstage-cert.pem, backstage-key.pem (role: catalog-reader)"
|
||
echo " • defectdojo-plugin-cert.pem, defectdojo-plugin-key.pem (role: plugin)"
|
||
echo " • dependencytrack-plugin-cert.pem, dependencytrack-plugin-key.pem (role: plugin)"
|
||
echo ""
|
||
echo "🔍 Verify certificates:"
|
||
echo " openssl x509 -in ${CERT_DIR}/server-cert.pem -text -noout"
|
||
echo ""
|
||
echo "🚀 Use with Charybdis:"
|
||
echo " export SECURITY_MTLS_ENABLED=true"
|
||
echo " export SECURITY_MTLS_SERVER_CERT=${CERT_DIR}/server-cert.pem"
|
||
echo " export SECURITY_MTLS_SERVER_KEY=${CERT_DIR}/server-key.pem"
|
||
echo " export SECURITY_MTLS_CLIENT_CA=${CERT_DIR}/ca.pem"
|
||
echo ""
|
||
echo "⚠️ These are DEVELOPMENT certificates only!"
|
||
echo " Do NOT use in production. Generate proper certificates from a trusted CA."
|
||
echo ""
|