#!/bin/sh
# webcert.sh
# 05/20/2015 Michael Quelly, Phoenix Broadband Technologies, LLC.

# Create a self signed certificate that is valid for 22 years. This appears to
# be the maximum allowed by Internet Explorer.

# If the certificate file name changes edit httpd-ssl.conf
# Reboot after changing the certificate

# old Method
#openssl req -new -x509 -days 3650 -sha256 -newkey  rsa:2048 \
# -nodes -keyout /home/admin/www/sc4.key \
# -out /home/admin/www/sc4.crt \
# -subj '/CN=pbtsecure.com/C=US/ST=PA/L=Hatfield/O=Phoenix Broadband Technologies, LLC./OU=PBT' \
  


#new method
#openssl genrsa -out /home/admin/www/sc4.crt 2048 \
# -subj '/CN=pbtsecure.com/C=US/ST=PA/L=Hatfield/O=Phoenix Broadband Technologies, LLC./OU=PBT'

#openssl req -new -out /home/admin/www/sc4.csr -sha256 \
# -key /home/admin/www/sc4.key 

#openssl x509 -req -in /home/admin/www/sc4.csr -days 365 \
# -signkey /home/admin/www/sc4.key \
# -out /home/admin/www/sc4.crt -outform PEM


# Another new method
C=US ; ST=Pennsylvania ; L=Hatfield ; O=PBT ; EMAIL=mike@phoenixbroadband.com
BITS=2048
#CN=RFC1918
DOM=pbtsecure.com
SUBJ="/C=$C/ST=$ST/L=$L/O=$O/CN=$DOM"

openssl genrsa -out sc4.key $BITS

#SAN='\n[ SAN ]#\nsubjectAltName=IP.1:50.199.84.245,IP.2:50.199.84.244,IP.3:50.199.84.243,DNS.1:pbtsecure.com'

# cp /etc/ssl/openssl.cnf /home/admin/www/openssl.cnf
#echo -e "$SAN" >> /home/admin/www/openssl.cnf

openssl req -subj "$SUBJ" -new -x509 -days 3650 \
 -key sc4.key -out sc4.crt -batch \
 -set_serial 123456 \
 -config /home/admin/www/openssl.cnf 
 
#-extensions SAN

openssl x509 -in sc4.crt -noout -text



exit 0
