-
Notifications
You must be signed in to change notification settings - Fork 88
/
create_ecdsa_cert
executable file
·32 lines (27 loc) · 977 Bytes
/
create_ecdsa_cert
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
#!/bin/bash
# SPDX-License-Identifier: Apache-2.0
set -e
_puppetmaster="puppetmaster1001.eqiad.wmnet"
_dir=$(cd `dirname $0` && pwd)
function usage {
echo "${0} CERT_NAME SAN1 [SAN2 .. SANN]"
exit 1
}
function commasep { local IFS=","; shift; echo "$*"; }
# Find out the SAN list we need to sign with
if [ $# -lt 1 ]; then
usage
fi
name=$1
SAN=$(commasep $@)
if ssh $_puppetmaster sudo puppet cert list $name > /dev/null 2>&1; then
echo "Skipping ${name}, already signed";
exit 1;
fi
echo "Generating cert for ${name}"
echo "with SubjectAltNames ${SAN}"
ssh $_puppetmaster sudo /usr/local/bin/puppet-ecdsacert -a "${SAN}" "${name}";
ssh $_puppetmaster sudo cp -ax "/var/lib/puppet/ssl/private_keys/${name}.key" \
"/srv/private/modules/secret/secrets/ssl/${name}.key"
ssh $_puppetmaster sudo git -C /srv/private add "modules/secret/secrets/ssl/${name}.key"
echo "Private key generated and added to the private git repo. Don't forget to commit it!"