portainer-devtool/custom_tls_cert_gen/generate-custom-tls.sh

#!/bin/bash

set -eu

ERROR_COLOR='\033[0;31m';
HIGHLIGHT_COLOR='\033[0;32m';
INPUT_COLOR='\033[0;33m';
NO_COLOR='\033[0m';


read -p "$(echo -e ${INPUT_COLOR}Specify the output path: ${NO_COLOR})" OUTPUT_PATH

if [ -z "$OUTPUT_PATH" ]; then
  OUTPUT_PATH="$(pwd)/output"

  if [[ ! -e "$OUTPUT_PATH" ]]; then 
    mkdir "$OUTPUT_PATH"
  fi 
fi

if [[ ! -e "$OUTPUT_PATH" ]]; then 
  printf "${ERROR_COLOR}${OUTPUT_PATH} doesn't exist.\n";
  exit;
fi

read -p "Do you have cfssl installed?(y/n): " is_cfssl_installed

CFSSLEXE=${OUTPUT_PATH}/cfssl
CFSSLJSONEXE=${OUTPUT_PATH}/cfssljson

if [[ "${is_cfssl_installed}" == "y" || "${is_cfssl_installed}" == "Y" ]]; then 
  read -p "Specify the path where the cfssl and cfssljson are placed: " TOOL_PATH

  CFSSLEXE=${TOOL_PATH}/cfssl
  CFSSLJSONEXE=${TOOL_PATH}/cfssljson

  printf "${HIGHLIGHT_COLOR}Your cfssl binary path is ${CFSSLEXE}${NO_COLOR}\n"

  if [ ! -e "$CFSSLEXE" ]; then
      printf "${ERROR_COLOR}no cfssl found.\n";
      exit;
  fi

  if [ ! -e "$CFSSLJSONEXE" ]; then
      printf "${ERROR_COLOR}no cfssljson found.\n";
      exit;
  fi

else
  # Download the cfssl for users
  read -p "Specify your platform(darwin/linux/windows): " PLATFORM  

  if [ -Z "$PLATFORM" ]; then 
    printf "${ERROR_COLOR}Platform must be provided.\n";
    exit;
  fi

  printf "${HIGHLIGHT_COLOR}Only amd64 is supported${NO_COLOR}\n"

  wget "https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssl_1.6.1_${PLATFORM}_amd64" -O "${OUTPUT_PATH}/cfssl"
  chmod +x "${OUTPUT_PATH}/cfssl"
  wget "https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssljson_1.6.1_${PLATFORM}_amd64" -O "${OUTPUT_PATH}/cfssljson"
  chmod +x "${OUTPUT_PATH}/cfssljson"

  printf "${HIGHLIGHT_COLOR}Download the cfssl bundle successfully.${NO_COLOR}\n"
fi

cd $OUTPUT_PATH

${CFSSLEXE} print-defaults csr | ${CFSSLEXE} gencert -initca - | ${CFSSLJSONEXE} -bare ldap-ca 

CONFIG_CFSSL_JSON=${OUTPUT_PATH}/cfssl.json

cat <<EOF >> ${CONFIG_CFSSL_JSON}
{
  "signing": {
    "default": {
      "expiry": "87600h",
      "usages": ["signing", "key encipherment", "server auth"]
    }
  }
}
EOF

read -p "Give a name to the certificate: " CERT_NAME

read -p "Input the hostname(example.org,127.0.0.1): " CERT_HOSTNAME

echo '{}' | ${CFSSLEXE} gencert -ca=ldap-ca.pem -ca-key=ldap-ca-key.pem -config=${CONFIG_CFSSL_JSON} \
    -hostname="${CERT_HOSTNAME}" - | ${CFSSLJSONEXE} -bare ${CERT_NAME}

printf "${HIGHLIGHT_COLOR}The custom TLS certificates are successfully generated in the path ${OUTPUT_PATH}.${NO_COLOR}\n"