From e5fc654f50e2b99bcae186962b29c8754f382f3b Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 9 Dec 2021 11:21:06 +0100 Subject: add ACME ca via ca.r --- .../generate-krebs-intermediate-ca/default.nix | 29 ++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix (limited to 'krebs/5pkgs/simple/generate-krebs-intermediate-ca') diff --git a/krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix b/krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix new file mode 100644 index 000000000..8cec54327 --- /dev/null +++ b/krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix @@ -0,0 +1,29 @@ +{ pkgs }: +pkgs.writers.writeDashBin "generate-intermediate-ca" '' + TMPDIR=$(mktemp -d) + trap "rm -rf $TMPDIR;" INT TERM EXIT + mkdir -p "$TMPDIR/krebs" + brain show ca/ca.key > "$TMPDIR/krebs/ca.key" + brain show ca/ca.crt > "$TMPDIR/krebs/ca.crt" + export STEPPATH="$TMPDIR/step" + cat << EOF > "$TMPDIR/intermediate.tpl" + { + "subject": {{ toJson .Subject }}, + "keyUsage": ["certSign", "crlSign"], + "basicConstraints": { + "isCA": true, + "maxPathLen": 0 + }, + "nameConstraints": { + "critical": true, + "permittedDNSDomains": ["r" ,"w"] + } + } + EOF + + ${pkgs.step-cli}/bin/step certificate create "Krebs ACME CA" intermediate_ca.crt intermediate_ca.key \ + --template "$TMPDIR/intermediate.tpl" \ + --ca "$TMPDIR/krebs/ca.crt" \ + --ca-key "$TMPDIR/krebs/ca.key" \ + --no-password --insecure +'' -- cgit v1.2.3 From e4384e10e94bc01507834568f2dfb4bd8255311f Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 10 Dec 2021 09:55:47 +0100 Subject: pkgs.generate-krebs-intermediate-ca: set vailidy to 1y --- krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'krebs/5pkgs/simple/generate-krebs-intermediate-ca') diff --git a/krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix b/krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix index 8cec54327..5055a78aa 100644 --- a/krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix +++ b/krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix @@ -23,6 +23,7 @@ pkgs.writers.writeDashBin "generate-intermediate-ca" '' ${pkgs.step-cli}/bin/step certificate create "Krebs ACME CA" intermediate_ca.crt intermediate_ca.key \ --template "$TMPDIR/intermediate.tpl" \ + --not-after 8760h \ --ca "$TMPDIR/krebs/ca.crt" \ --ca-key "$TMPDIR/krebs/ca.key" \ --no-password --insecure -- cgit v1.2.3