diff options
| author | tv <tv@krebsco.de> | 2021-12-22 23:33:05 +0100 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2021-12-22 23:33:05 +0100 |
| commit | 448cd3b9af9e39980676f8ade7e5fb80dbb58b9f (patch) | |
| tree | ad3b7ccfb7107b0053ad2a80cbc2dd97a018e7a6 /krebs/5pkgs/simple/generate-krebs-intermediate-ca | |
| parent | 2656cbf2a91f1f350e29e2ee2faa0bbe90f9b717 (diff) | |
| parent | 576c05cf3a0ceddefa29c2d0073108177c3cfa52 (diff) | |
Merge remote-tracking branch 'prism/master'
Diffstat (limited to 'krebs/5pkgs/simple/generate-krebs-intermediate-ca')
| -rw-r--r-- | krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix b/krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix new file mode 100644 index 000000000..5055a78aa --- /dev/null +++ b/krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix @@ -0,0 +1,30 @@ +{ pkgs }: +pkgs.writers.writeDashBin "generate-intermediate-ca" '' + TMPDIR=$(mktemp -d) + trap "rm -rf $TMPDIR;" INT TERM EXIT + mkdir -p "$TMPDIR/krebs" + brain show ca/ca.key > "$TMPDIR/krebs/ca.key" + brain show ca/ca.crt > "$TMPDIR/krebs/ca.crt" + export STEPPATH="$TMPDIR/step" + cat << EOF > "$TMPDIR/intermediate.tpl" + { + "subject": {{ toJson .Subject }}, + "keyUsage": ["certSign", "crlSign"], + "basicConstraints": { + "isCA": true, + "maxPathLen": 0 + }, + "nameConstraints": { + "critical": true, + "permittedDNSDomains": ["r" ,"w"] + } + } + EOF + + ${pkgs.step-cli}/bin/step certificate create "Krebs ACME CA" intermediate_ca.crt intermediate_ca.key \ + --template "$TMPDIR/intermediate.tpl" \ + --not-after 8760h \ + --ca "$TMPDIR/krebs/ca.crt" \ + --ca-key "$TMPDIR/krebs/ca.key" \ + --no-password --insecure +'' |