This repository has no description
904 B
30 lines
1{ pkgs }:
2pkgs.writers.writeDashBin "generate-intermediate-ca" ''
3 TMPDIR=$(mktemp -d)
4 trap "rm -rf $TMPDIR;" INT TERM EXIT
5 mkdir -p "$TMPDIR/krebs"
6 pass show brain/ca/ca.key > "$TMPDIR/krebs/ca.key"
7 pass show brain/ca/ca.crt > "$TMPDIR/krebs/ca.crt"
8 export STEPPATH="$TMPDIR/step"
9 cat << EOF > "$TMPDIR/intermediate.tpl"
10 {
11 "subject": {{ toJson .Subject }},
12 "keyUsage": ["certSign", "crlSign"],
13 "basicConstraints": {
14 "isCA": true,
15 "maxPathLen": 0
16 },
17 "nameConstraints": {
18 "critical": true,
19 "permittedDNSDomains": ["r" ,"w"]
20 }
21 }
22 EOF
23
24 ${pkgs.step-cli}/bin/step certificate create "Krebs ACME CA" intermediate_ca.crt intermediate_ca.key \
25 --template "$TMPDIR/intermediate.tpl" \
26 --not-after 8760h \
27 --ca "$TMPDIR/krebs/ca.crt" \
28 --ca-key "$TMPDIR/krebs/ca.key" \
29 --no-password --insecure
30''