Shell脚本自动生成整套证书

#!/usr/bin/expect
spawn openssl genrsa -aes256  -out ca.key.pem 2048

expect "Enter pass phrase for ca.key.pem:"
send "Password1\r"
expect "Verifying - Enter pass phrase for ca.key.pem:"
send "Password1\r"
interact

spawn openssl req -new -key ca.key.pem -out ca.csr -subj "/C=CN/ST=BJ/L=BJ/O=zlex/OU=zlex/CN=*.iot.org"
expect "Enter pass phrase for ca.key.pem:"
send "Password1\r"
interact

spawn openssl x509 -req -days 360 -sha1 -extensions v3_ca -signkey ca.key.pem -in ca.csr -out ca.cer
expect "Enter pass phrase for ca.key.pem:"
send "Password1\r"
interact

#根证书转换
spawn openssl pkcs12 -export -cacerts -inkey ca.key.pem -in ca.cer -out ca.p12
expect "Enter pass phrase for ca.key.pem:"
send "Password1\r"
expect "Enter Export Password:"
send "Password2\r"
expect "Verifying - Enter Export Password:"
send "Password2\r"
interact

#构建服务器证书
spawn openssl genrsa -aes256 -out server.key.pem 2048
expect "Enter pass phrase for server.key.pem:"
send "Password3\r"
expect "Verifying - Enter pass phrase for server.key.pem:"
send "Password3\r"
interact

#生成服务器证书签发申请
spawn openssl req -new -key server.key.pem -out server.csr -subj "/C=CN/ST=BJ/L=BJ/O=zlex/OU=zlex/CN=www.iot.org"
expect "Enter pass phrase for server.key.pem::"
send "Password3\r"
interact

#使用ca对服务器证书进行签发
spawn openssl x509 -req -days 360 -sha1 -extensions v3_req -CA ca.cer -CAkey ca.key.pem -CAserial ca.srl -CAcreateserial -in server.csr -out server.cer
expect "Enter pass phrase for ca.key.pem:"
send "Password1\r"
interact

#服务器证书转换
spawn openssl pkcs12 -export -clcerts -inkey server.key.pem -in server.cer -out server.p12
expect "Enter pass phrase for server.key.pem:"
send "Password3\r"
expect "Enter Export Password:"
send "Export_server\r"
expect "Verifying - Enter Export Password:"
send "Export_server\r"
interact

#创建根客户端密钥
spawn openssl genrsa -aes256 -out client.key.pem 2048
expect "Enter pass phrase for client.key.pem:"
send "client_key\r"
expect "Verifying - Enter pass phrase for client.key.pem"
send "client_key\r"
interact

#创建根客户端签发申请
spawn openssl req -new -key client.key.pem -out client.csr -subj "/C=CN/ST=BJ/L=BJ/O=zlex/OU=zlex/CN=iot"
expect "Enter pass phrase for client.key.pem:"
send "client_key\r"
interact

#签发客户端证书
spawn openssl ca -days 360 -in client.csr -out client.cer -cert ca.cer -keyfile ca.key.pem
expect "Enter pass phrase for ca.key.pem:"
send "Password1\r"
expect "Sign the certificat"
send "y"
expect "1 out of 1 certificate requests certified, commit"
send "Y"
interact

将该文件转换为可执行文件,直接./运行即可