1#!/bin/sh 2 3# Build a new PKI which is rooted on an intermediate certificate generated 4# by ./build-inter or ./pkitool --inter from a parent PKI. The new PKI should 5# have independent vars settings, and must use a different KEY_DIR directory 6# from the parent. This tool can be used to generate arbitrary depth 7# certificate chains. 8# 9# To build an intermediate CA, follow the same steps for a regular PKI but 10# replace ./build-key or ./pkitool --initca with this script. 11 12# The EXPORT_CA file will contain the CA certificate chain and should be 13# referenced by the OpenVPN "ca" directive in config files. The ca.crt file 14# will only contain the local intermediate CA -- it's needed by the easy-rsa 15# scripts but not by OpenVPN directly. 16EXPORT_CA="export-ca.crt" 17 18if [ $# -ne 2 ]; then 19 echo "usage: $0 <parent-key-dir> <common-name>" 20 echo "parent-key-dir: the KEY_DIR directory of the parent PKI" 21 echo "common-name: the common name of the intermediate certificate in the parent PKI" 22 exit 1; 23fi 24 25if [ "$KEY_DIR" ]; then 26 cp "$1/$2.crt" "$KEY_DIR/ca.crt" 27 cp "$1/$2.key" "$KEY_DIR/ca.key" 28 29 if [ -e "$1/$EXPORT_CA" ]; then 30 PARENT_CA="$1/$EXPORT_CA" 31 else 32 PARENT_CA="$1/ca.crt" 33 fi 34 cp "$PARENT_CA" "$KEY_DIR/$EXPORT_CA" 35 cat "$KEY_DIR/ca.crt" >> "$KEY_DIR/$EXPORT_CA" 36else 37 echo 'Please source the vars script first (i.e. "source ./vars")' 38 echo 'Make sure you have edited it to reflect your configuration.' 39fi 40