You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
66 lines
1.8 KiB
66 lines
1.8 KiB
#!/bin/sh |
|
## |
|
## redis-tls.sh -- utility for Redis to generate SSL/TLS private-key/certificate files |
|
## Copyright (c) 2018 Ralf S. Engelschall <rse@engelschall.com> |
|
## |
|
|
|
# configure Certificate Authority (CA) certificate |
|
cat >redis-tls-ca.json <<EOT |
|
{ |
|
"key": { |
|
"algo": "rsa", |
|
"size": 4096 |
|
}, |
|
"names": [{ |
|
"C": "US", |
|
"ST": "California", |
|
"L": "San Francisco", |
|
"OU": "Certificate Authority", |
|
"O": "Example, Inc" |
|
}] |
|
} |
|
EOT |
|
|
|
# configure server certificate |
|
cat >redis-tls-sv.json <<EOT |
|
{ |
|
"key": { |
|
"algo": "rsa", |
|
"size": 2048 |
|
}, |
|
"CN": "server.example.com", |
|
"hosts": [ "server.example.com", "127.0.0.1" ], |
|
"names": [{ |
|
"C": "US", |
|
"ST": "California", |
|
"L": "San Francisco", |
|
"OU": "Server Administration", |
|
"O": "Example, Inc" |
|
}] |
|
} |
|
EOT |
|
|
|
# preparation |
|
echo "++ Redis SSL/TLS RSA private-key and X.509 certificate generation" |
|
|
|
# generate Certificate Authority (CA) private-key/certificate pair |
|
echo "-- generate Certificate Authority (CA) private-key/certificate pair" |
|
@l_prefix@/bin/cfssl genkey -loglevel 3 -initca redis-tls-ca.json | \ |
|
@l_prefix@/bin/cfssl-json -bare redis-tls-ca |
|
echo ".. redis-tls-ca.key" |
|
echo ".. redis-tls-ca.crt" |
|
|
|
# generate server private-key/certificate pair |
|
echo "-- generate server private-key/certificate pair" |
|
@l_prefix@/bin/cfssl gencert -loglevel 3 -ca redis-tls-ca.crt -ca-key redis-tls-ca.key redis-tls-sv.json | \ |
|
@l_prefix@/bin/cfssl-json -bare redis-tls-sv |
|
echo ".. redis-tls-sv.key" |
|
echo ".. redis-tls-sv.crt" |
|
|
|
# cleanup |
|
chown @l_rusr@:@l_rgrp@ redis-tls-ca.key redis-tls-ca.crt redis-tls-sv.key redis-tls-sv.crt |
|
chmod 600 redis-tls-ca.key redis-tls-sv.key |
|
chmod 644 redis-tls-ca.crt redis-tls-sv.crt |
|
rm -f redis-tls-ca.csr redis-tls-ca.json |
|
rm -f redis-tls-sv.csr redis-tls-sv.json |
|
|
|
|