2 CURRENT_DIR := ${CURDIR}
3 DOCKER_CONTAINER = generate-certs
4 DOCKER_EXEC = docker exec ${DOCKER_CONTAINER}
9 root_create_certificate \
10 root_self_sign_certificate \
11 client_generate_keys \
13 client_sign_certificate_by_root \
14 client_import_root_certificate \
15 client_convert_certificate_to_jks \
16 server_generate_keys \
18 server_sign_certificate_by_root \
19 server_import_root_certificate \
20 server_convert_certificate_to_jks \
21 server_convert_certificate_to_p12 \
22 convert_truststore_to_p12 \
23 convert_truststore_to_pem \
24 server_export_certificate_to_pem \
25 server_export_key_to_pem \
31 # Starts docker container for generating certificates - deletes first, if already running
34 $(eval REPOSITORY := $(shell cat ./values.yaml | grep -i "^[ \t]*repository" -m1 | xargs | cut -d ' ' -f2))
35 $(eval JAVA_IMAGE := $(shell cat ./values.yaml | grep -i "^[ \t]*certificateGenerationImage" -m1 | xargs | cut -d ' ' -f2))
36 $(eval FULL_JAVA_IMAGE := $(REPOSITORY)/$(JAVA_IMAGE))
37 $(eval USERNAME :=$(shell id -u))
38 $(eval GROUP :=$(shell id -g))
39 docker run --rm --name ${DOCKER_CONTAINER} --user "$(USERNAME):$(GROUP)" --mount type=bind,source=${CURRENT_DIR}/${CERTS_DIR},target=/certs -w /certs --entrypoint "sh" -td $(FULL_JAVA_IMAGE)
41 # Stops docker container for generating certificates. 'true' is used to return 0 status code, if container is already deleted
43 docker rm ${DOCKER_CONTAINER} -f 1>/dev/null || true
45 #Clear all files related to certificates
47 @make clear_existing_certificates
48 @make clear_unused_files
51 clear_existing_certificates:
52 @echo "Clear certificates"
53 ${DOCKER_EXEC} rm -f certServiceClient-keystore.jks certServiceServer-keystore.jks root.crt truststore.jks certServiceServer-keystore.p12 truststore.pem certServiceServer-cert.pem certServiceServer-key.pem
54 @echo "#####done#####"
56 #Generate root private and public keys
58 @echo "Generate root private and public keys"
59 ${DOCKER_EXEC} keytool -genkeypair -v -alias root -keyalg RSA -keysize 4096 -validity 3650 -keystore root-keystore.jks \
60 -dname "CN=root.com, OU=Root Org, O=Root Company, L=Wroclaw, ST=Dolny Slask, C=PL" -keypass secret \
61 -storepass secret -ext BasicConstraints:critical="ca:true"
62 @echo "#####done#####"
64 #Export public key as certificate
65 root_create_certificate:
66 @echo "(Export public key as certificate)"
67 ${DOCKER_EXEC} keytool -exportcert -alias root -keystore root-keystore.jks -storepass secret -file root.crt -rfc
68 @echo "#####done#####"
70 #Self-signed root (import root certificate into truststore)
71 root_self_sign_certificate:
72 @echo "(Self-signed root (import root certificate into truststore))"
73 ${DOCKER_EXEC} keytool -importcert -alias root -keystore truststore.jks -file root.crt -storepass secret -noprompt
74 @echo "#####done#####"
76 #Generate certService's client private and public keys
78 @echo "Generate certService's client private and public keys"
79 ${DOCKER_EXEC} keytool -genkeypair -v -alias certServiceClient -keyalg RSA -keysize 2048 -validity 365 \
80 -keystore certServiceClient-keystore.jks -storetype JKS \
81 -dname "CN=certServiceClient.com,OU=certServiceClient company,O=certServiceClient org,L=Wroclaw,ST=Dolny Slask,C=PL" \
82 -keypass secret -storepass secret
85 #Generate certificate signing request for certService's client
87 @echo "Generate certificate signing request for certService's client"
88 ${DOCKER_EXEC} keytool -certreq -keystore certServiceClient-keystore.jks -alias certServiceClient -storepass secret -file certServiceClient.csr
91 #Sign certService's client certificate by root CA
92 client_sign_certificate_by_root:
93 @echo "Sign certService's client certificate by root CA"
94 ${DOCKER_EXEC} keytool -gencert -v -keystore root-keystore.jks -storepass secret -alias root -infile certServiceClient.csr \
95 -outfile certServiceClientByRoot.crt -rfc -ext bc=0 -ext ExtendedkeyUsage="serverAuth,clientAuth"
98 #Import root certificate into client
99 client_import_root_certificate:
100 @echo "Import root certificate into intermediate"
101 ${DOCKER_EXEC} sh -c "cat root.crt >> certServiceClientByRoot.crt"
104 #Import signed certificate into certService's client
105 client_convert_certificate_to_jks:
106 @echo "Import signed certificate into certService's client"
107 ${DOCKER_EXEC} keytool -importcert -file certServiceClientByRoot.crt -destkeystore certServiceClient-keystore.jks -alias certServiceClient -storepass secret -noprompt
110 #Generate certService private and public keys
111 server_generate_keys:
112 @echo "Generate certService private and public keys"
113 ${DOCKER_EXEC} keytool -genkeypair -v -alias oom-cert-service -keyalg RSA -keysize 2048 -validity 365 \
114 -keystore certServiceServer-keystore.jks -storetype JKS \
115 -dname "CN=oom-cert-service,OU=certServiceServer company,O=certServiceServer org,L=Wroclaw,ST=Dolny Slask,C=PL" \
116 -keypass secret -storepass secret -ext BasicConstraints:critical="ca:false"
119 #Generate certificate signing request for certService
121 @echo "Generate certificate signing request for certService"
122 ${DOCKER_EXEC} keytool -certreq -keystore certServiceServer-keystore.jks -alias oom-cert-service -storepass secret -file certServiceServer.csr
125 #Sign certService certificate by root CA
126 server_sign_certificate_by_root:
127 @echo "Sign certService certificate by root CA"
128 ${DOCKER_EXEC} keytool -gencert -v -keystore root-keystore.jks -storepass secret -alias root -infile certServiceServer.csr \
129 -outfile certServiceServerByRoot.crt -rfc -ext bc=0 -ext ExtendedkeyUsage="serverAuth,clientAuth" \
130 -ext SubjectAlternativeName:="DNS:oom-cert-service,DNS:localhost"
133 #Import root certificate into server
134 server_import_root_certificate:
135 @echo "Import root certificate into intermediate(server)"
136 ${DOCKER_EXEC} sh -c "cat root.crt >> certServiceServerByRoot.crt"
139 #Import signed certificate into certService
140 server_convert_certificate_to_jks:
141 @echo "Import signed certificate into certService"
142 ${DOCKER_EXEC} keytool -importcert -file certServiceServerByRoot.crt -destkeystore certServiceServer-keystore.jks -alias oom-cert-service \
143 -storepass secret -noprompt
146 #Convert certServiceServer-keystore(.jks) to PCKS12 format(.p12)
147 server_convert_certificate_to_p12:
148 @echo "Convert certServiceServer-keystore(.jks) to PCKS12 format(.p12)"
149 ${DOCKER_EXEC} keytool -importkeystore -srckeystore certServiceServer-keystore.jks -srcstorepass secret \
150 -destkeystore certServiceServer-keystore.p12 -deststoretype PKCS12 -deststorepass secret
151 @echo "#####done#####"
153 #Convert truststore(.jks) to PCKS12 format(.p12)
154 convert_truststore_to_p12:
155 @echo "Convert certServiceServer-keystore(.jks) to PCKS12 format(.p12)"
156 ${DOCKER_EXEC} keytool -importkeystore -srckeystore truststore.jks -srcstorepass secret \
157 -destkeystore truststore.p12 -deststoretype PKCS12 -deststorepass secret
158 @echo "#####done#####"
160 #Convert truststore(.p12) to PEM format(.pem)
161 convert_truststore_to_pem:
162 @echo "Convert certServiceServer-keystore(.p12) to PEM format(.pem)"
163 ${DOCKER_EXEC} openssl pkcs12 -nodes -in truststore.p12 -out truststore.pem -passin pass:secret
164 @echo "#####done#####"
166 #Export certificates from certServiceServer-keystore(.p12) to PEM format(.pem)
167 server_export_certificate_to_pem:
168 @echo "Export certificates from certServiceClient-keystore(.p12) to PEM format(.pem)"
169 ${DOCKER_EXEC} openssl pkcs12 -in certServiceServer-keystore.p12 -passin 'pass:secret' -nodes -nokeys -out certServiceServer-cert.pem
170 @echo "#####done#####"
172 #Export keys from certServiceServer-keystore(.p12) to PEM format(.pem)
173 server_export_key_to_pem:
174 @echo "Export keys from certServiceClient-keystore(.p12) to PEM format(.pem)"
175 ${DOCKER_EXEC} openssl pkcs12 -in certServiceServer-keystore.p12 -passin 'pass:secret' -nodes -nocerts -out certServiceServer-key.pem
176 @echo "#####done#####"
179 #Clear unused certificates
181 @echo "Clear unused certificates"
182 ${DOCKER_EXEC} rm -f certServiceClientByRoot.crt certServiceClient.csr root-keystore.jks certServiceServerByRoot.crt certServiceServer.csr truststore.p12
183 @echo "#####done#####"