Shell script to create multiple OpenSSL Certificates

Shell Programming and Scripting
1

I need to create a script that will generate a bunch of OpenSSL Certificates signed by my own CA. The certificates being generated are for testing purposes only. But what I need is the following

Root CA
512
768
1024
1280
1536
1792
2048
4096

I need basically 64 combinations. Each root CA must sign each possible client CA of 512, 768, 1024, 1280, 1536, 1792, 2048 and 4096. for example

ROOT CA 512 to Client CA 512, 768, etc
ROOT CA 768 to Client CA 512, 768 etc

I'm not sure how to go about the script. Suggestions at this point would be of great help. Bash, or Perl would be fine.

Thanks for any and all help on this.

2

Can you give an example for step by step certification creation in normal scenario without any script? That would help better to understand requirement and feasibility of script.
Thanks

3

Request Client Certificate

openssl genrsa -out client512.key 512 openssl req -new -key client.key -out client512.csr -config openssl.cnf Sign Certifiicate

openssl x509 -req -days 365 -CA ca512.crt -CAkey ca512.key -CAcreateserial -in client512.csr -out client512512.crt

openssl x509 -req -days 365 -CA ca768.crt -CAkey ca768.key -CAcreateserial -in client512.csr -out client768512.crt

openssl x509 -req -days 365 -CA ca1024.crt -CAkey ca1024.key -CAcreateserial -in client512.csr -out client1024512.crt

And ETC down the list.
Then do the next client Cert of 768 and follow the same procedure and so on.

Hope that helps some.

4 
for RootCA in 512 768 1024 1280 1536 1792 2048 4096
  openssl genrsa -out client${RootCA}.key ${RootCA} openssl req -new -key client.key -out client${RootCA}.csr -config openssl.cnf Sign Certifiicate
  for ClientCA in 512 768 1024 1280 1536 1792 2048 4096
  do
     openssl x509 -req -days 365 -CA ca${ClientCA}.crt -CAkey ca${ClientCA}.key -CAcreateserial -in client${RootCA}.csr -out client${ClientCA}${RootCA}.crt
  done
done
5

Ok thanks for the reply. So I decided to try and automate the creation of the ROOT CA as well. Then I will continue on with the Clients Certs. Please take a look below its almost there but not quite working.

#!/bin/bash
RootCA={512 768 1024 1280 1536 1792 2048 4096}
ClientCA={512 768 1024 1280 1536 192 2048 4096}
Days=7300
OfRootKey= ~/Certs/Root-CA/private
OfRootCA= ~/Certs/Root-CA
OfClientKey= ~/Certs/Client/private
OfClient= ~/Certs/Client
Config= ~/Certs/Root-CA/conf

#Create ROOT CA 
for $RootCA 
do
openssl req -newe -x509 -days $Days -extensions v3_ca -keyout $OfRootKey/cakey${RootCA}.key -out $OfRootCA/cacert${RootCA}.pem -config $Config/openssl${RootCA}.conf
done
done

There errors are
./Root_CA_Create.sh
./Root_CA_Create.sh: line 2: 768: command not found
./Root_CA_Create.sh: line 3: 768: command not found
./Root_CA_Create.sh: line 5: /home/kris/Certs/Root-CA/private: Is a directory
./Root_CA_Create.sh: line 6: /home/kris/Certs/Root-CA: Is a directory
./Root_CA_Create.sh: line 7: /home/kris/Certs/Client/private: Is a directory
./Root_CA_Create.sh: line 8: /home/kris/Certs/Client: Is a directory
./Root_CA_Create.sh: line 9: /home/kris/Certs/Root-CA/conf: Is a directory
./Root_CA_Create.sh: line 15: `$RootCA': not a valid identifier
./Root_CA_Create.sh: line 16: syntax error near unexpected token `done'
./Root_CA_Create.sh: line 16: `done'

---------- Post updated at 02:47 PM ---------- Previous update was at 12:23 PM ----------

Ok I'm very close here. The script is now creating all the RootCA certificates but it only creats 8 of the client certificates. Because its only signing them with the last RootCA of 4096. I need it to sign each one with each RootCA as well. I see why its happening just not sure how to fix it. I followed the logic so I get why it happens just not sure how to correct yet.

#!/bin/bash
# RootCA={512 768 1024 1280 1536 1792 2048 4096}
# ClientCA={512 768 1024 1280 1536 192 2048 4096}
Days=7300
OfRootKey=~/Certs/Root-CA/private
OfRootCA=~/Certs/Root-CA
OfClientKey=~/Certs/Client/private
OfClient=~/Certs/Client
OfClientReq=~/Certs/Requests
Config=~/Certs/Root-CA/conf


function Create_Root_CA {
#Create ROOT CA 
Echo Creating Root Certificates
for RootCA in 512 768 1024 1280 1536 1792 2048 4096
do
openssl req -new -x509 -days $Days -extensions v3_ca -keyout $OfRootKey/cakey${RootCA}.key -out $OfRootCA/cacert${RootCA}.pem -config $Config/openssl${RootCA}.conf
done
}

function Create_Client_Req {
echo Creating Clients Requests
for RootCA in 512 768 1024 1280 1536 1792 2048 4096
do
openssl req -new -newkey rsa:$RootCA -nodes -keyout $OfClientReq/client${RootCA}.key -out $OfClientReq/client${RootCA}.csr -config $Config/openssl$RootCA.conf
done
}

function Sign_Client_Certs {
echo Signing Clients Certificates
for ClientCA in 512 768 1024 1280 1536 1792 2048 4096
  do
     openssl x509 -req -days $Days -CA $OfRootCA/cacert${ClientCA}.pem -CAkey $OfRootKey/cakey${ClientCA}.key -CAcreateserial -in $OfClientReq/client${RootCA}.csr -out $OfClient/client${ClientCA}${RootCA}.pem
done
}

Create_Root_CA
Create_Client_Req
Sign_Client_Certs