1.PHONY: all root-ssl server-ssl client-ssl
2
3# Rebuilds self-signed root/server/client certs/keys in a consistent way
4all: root-ssl server-ssl client-ssl
5 rm -f .srl
6
7root-ssl:
8 openssl req -new -sha256 -nodes -newkey rsa:2048 \
9 -config ./certs/root.cnf \
10 -keyout /tmp/root.key \
11 -out /tmp/root.csr
12 openssl x509 -req -days 3653 -sha256 \
13 -in /tmp/root.csr \
14 -extfile /etc/ssl/openssl.cnf -extensions v3_ca \
15 -signkey /tmp/root.key \
16 -out ./certs/root.crt
17
18server-ssl:
19 openssl req -new -sha256 -nodes -newkey rsa:2048 \
20 -config ./certs/server.cnf \
21 -keyout ./certs/server.key \
22 -out /tmp/server.csr
23 openssl x509 -req -days 3653 -sha256 \
24 -extfile ./certs/server.cnf -extensions req_ext \
25 -CA ./certs/root.crt -CAkey /tmp/root.key -CAcreateserial \
26 -in /tmp/server.csr \
27 -out ./certs/server.crt
28
29client-ssl:
30 openssl req -new -sha256 -nodes -newkey rsa:2048 \
31 -config ./certs/postgresql.cnf \
32 -keyout ./certs/postgresql.key \
33 -out /tmp/postgresql.csr
34 openssl x509 -req -days 3653 -sha256 \
35 -CA ./certs/root.crt -CAkey /tmp/root.key -CAcreateserial \
36 -in /tmp/postgresql.csr \
37 -out ./certs/postgresql.crt
View as plain text