|
@@ -7,33 +7,39 @@ This is the command line version, which can be installed locally and run securel
|
|
Install
|
|
Install
|
|
=======
|
|
=======
|
|
|
|
|
|
-git clone http://gitlab.perpetual.name/doctor/certgencli.git CertGenCLI
|
|
|
|
|
|
+<code>git clone http://gitlab.perpetual.name/doctor/certgencli.git CertGenCLI</code>
|
|
|
|
|
|
-cd CertGenCLI
|
|
|
|
|
|
+<code>cd CertGenCLI</code>
|
|
|
|
|
|
Either install the python cryptography package
|
|
Either install the python cryptography package
|
|
|
|
|
|
-apt-get install python-cryptography
|
|
|
|
|
|
+<code>apt-get install python-cryptography</code>
|
|
|
|
|
|
or
|
|
or
|
|
|
|
|
|
-pip install -r requirements.txt
|
|
|
|
|
|
+<code>pip install -r requirements.txt</code>
|
|
|
|
|
|
The latter doesn't appear to work too well on Debian.
|
|
The latter doesn't appear to work too well on Debian.
|
|
|
|
|
|
Run
|
|
Run
|
|
===
|
|
===
|
|
|
|
|
|
-cli.py -c <County> -s <State> -l <Location> -o <Organisation> -ou <Organisation Unit> -n <CN> -r <CRLDP> -p <password> -d <Output Directory>
|
|
|
|
|
|
+<code>cli.py -c <County> -s <State> -l <Location> -o <Organisation> -u <Organisation Unit> -n <CN> -r <CRLDP> -p <password> -d <Output Directory></code>
|
|
|
|
|
|
-e.g. ./cli.py -d /tmp -n fred.site.com -cGB -sWales -lCardiff -oSomewhere -uSomething -pakjdslfasd
|
|
|
|
|
|
+e.g.
|
|
|
|
+
|
|
|
|
+<code>cli.py -d /tmp -n fred.site.com -cGB -sWales -lCardiff -oSomewhere -uSomething -pakjdslfasd</code>
|
|
|
|
|
|
This will create all the necessary certificates in /tmp
|
|
This will create all the necessary certificates in /tmp
|
|
|
|
|
|
rootca.pem
|
|
rootca.pem
|
|
|
|
+
|
|
server-cert.pem
|
|
server-cert.pem
|
|
|
|
+
|
|
server-key.pem
|
|
server-key.pem
|
|
|
|
+
|
|
list.crl
|
|
list.crl
|
|
|
|
+
|
|
root-key.pem
|
|
root-key.pem
|
|
|
|
|
|
RootCA
|
|
RootCA
|
|
@@ -65,15 +71,15 @@ Notes
|
|
|
|
|
|
You can check the certificates by running:
|
|
You can check the certificates by running:
|
|
|
|
|
|
-openssl x509 -noout -text -in <certname>
|
|
|
|
|
|
+<code>openssl x509 -noout -text -in <certname></code>
|
|
|
|
|
|
which will work for rootca.pem and server-cert.pem
|
|
which will work for rootca.pem and server-cert.pem
|
|
|
|
|
|
-openssl rsa -in <keyname> -check
|
|
|
|
|
|
+<code>openssl rsa -in <keyname> -check</code>
|
|
|
|
|
|
which will work for server-key.pem and root-key.pem
|
|
which will work for server-key.pem and root-key.pem
|
|
|
|
|
|
-openssl crl -noout -text -in <crlfile>
|
|
|
|
|
|
+<code>openssl crl -noout -text -in <crlfile></code>
|
|
|
|
|
|
which will work for list.crl
|
|
which will work for list.crl
|
|
|
|
|