112fe6c35SEdward Tomasz Napierala#!/bin/sh 212fe6c35SEdward Tomasz Napierala# 312fe6c35SEdward Tomasz Napierala# See uefisign(8) manual page for usage instructions. 412fe6c35SEdward Tomasz Napierala# 512fe6c35SEdward Tomasz Napierala# 612fe6c35SEdward Tomasz Napierala 712fe6c35SEdward Tomasz Napieraladie() { 812fe6c35SEdward Tomasz Napierala echo "$*" > /dev/stderr 912fe6c35SEdward Tomasz Napierala exit 1 1012fe6c35SEdward Tomasz Napierala} 1112fe6c35SEdward Tomasz Napierala 1212fe6c35SEdward Tomasz Napieralaif [ $# -ne 1 ]; then 1312fe6c35SEdward Tomasz Napierala echo "usage: $0 common-name" 1412fe6c35SEdward Tomasz Napierala exit 1 1512fe6c35SEdward Tomasz Napieralafi 1612fe6c35SEdward Tomasz Napierala 1712fe6c35SEdward Tomasz Napieralacertfile="${1}.pem" 1812fe6c35SEdward Tomasz Napieralaefifile="${1}.cer" 1912fe6c35SEdward Tomasz Napieralakeyfile="${1}.key" 2012fe6c35SEdward Tomasz Napierala# XXX: Set this to ten years; we don't want system to suddenly stop booting 2112fe6c35SEdward Tomasz Napierala# due to certificate expiration. Better way would be to use Authenticode 2212fe6c35SEdward Tomasz Napierala# Timestamp. That said, the rumor is UEFI implementations ignore it anyway. 2312fe6c35SEdward Tomasz Napieraladays="3650" 2412fe6c35SEdward Tomasz Napieralasubj="/CN=${1}" 2512fe6c35SEdward Tomasz Napierala 2612fe6c35SEdward Tomasz Napierala[ ! -e "${certfile}" ] || die "${certfile} already exists" 2712fe6c35SEdward Tomasz Napierala[ ! -e "${efifile}" ] || die "${efifile} already exists" 2812fe6c35SEdward Tomasz Napierala[ ! -e "${keyfile}" ] || die "${keyfile} already exists" 2912fe6c35SEdward Tomasz Napierala 3012fe6c35SEdward Tomasz Napieralaumask 077 || die "umask 077 failed" 3112fe6c35SEdward Tomasz Napierala 3212fe6c35SEdward Tomasz Napieralaopenssl genrsa -out "${keyfile}" 2048 2> /dev/null || die "openssl genrsa failed" 3312fe6c35SEdward Tomasz Napieralaopenssl req -new -x509 -sha256 -days "${days}" -subj "${subj}" -key "${keyfile}" -out "${certfile}" || die "openssl req failed" 3412fe6c35SEdward Tomasz Napieralaopenssl x509 -inform PEM -outform DER -in "${certfile}" -out "${efifile}" || die "openssl x509 failed" 3512fe6c35SEdward Tomasz Napierala 36*984a1cbfSEdward Tomasz Napieralaecho "certificate: ${certfile}; private key: ${keyfile}; certificate to enroll in UEFI: ${efifile}" 37