118 lines
3.2 KiB
Batchfile
118 lines
3.2 KiB
Batchfile
@echo off
|
|
REM Generate self-signed TLS certificates for Overlord (Windows)
|
|
REM Requires OpenSSL to be installed and in PATH
|
|
|
|
setlocal EnableDelayedExpansion
|
|
|
|
set "SCRIPT_DIR=%~dp0"
|
|
for %%I in ("%SCRIPT_DIR%..") do set "ROOT=%%~fI\"
|
|
|
|
set "CERT_DIR=%ROOT%certs"
|
|
set DAYS=3650
|
|
set COUNTRY=US
|
|
set STATE=State
|
|
set CITY=City
|
|
set ORG=Overlord
|
|
set ORG_UNIT=IT
|
|
|
|
if "%~1"=="" (
|
|
set COMMON_NAME=localhost
|
|
) else (
|
|
set COMMON_NAME=%~1
|
|
)
|
|
|
|
echo =========================================
|
|
echo Generating TLS Certificates for Overlord
|
|
echo =========================================
|
|
echo Common Name: %COMMON_NAME%
|
|
echo Certificate Directory: %CERT_DIR%
|
|
echo Validity: %DAYS% days
|
|
echo.
|
|
|
|
REM Check if OpenSSL is available
|
|
where openssl >nul 2>nul
|
|
if %ERRORLEVEL% neq 0 (
|
|
echo ERROR: OpenSSL is not installed or not in PATH
|
|
echo.
|
|
echo Please install OpenSSL from:
|
|
echo - https://slproweb.com/products/Win32OpenSSL.html
|
|
echo - Or use Chocolatey: choco install openssl
|
|
echo - Or use Git Bash which includes OpenSSL
|
|
exit /b 1
|
|
)
|
|
|
|
REM Create certs directory if it doesn't exist
|
|
if not exist "%CERT_DIR%" mkdir "%CERT_DIR%"
|
|
|
|
REM Generate private key
|
|
echo [1/3] Generating private key...
|
|
openssl genrsa -out "%CERT_DIR%\server.key" 2048
|
|
|
|
REM Generate certificate signing request
|
|
echo [2/3] Generating certificate signing request...
|
|
openssl req -new -key "%CERT_DIR%\server.key" -out "%CERT_DIR%\server.csr" -subj "/C=%COUNTRY%/ST=%STATE%/L=%CITY%/O=%ORG%/OU=%ORG_UNIT%/CN=%COMMON_NAME%"
|
|
|
|
REM Generate self-signed certificate with SAN
|
|
echo [3/3] Generating self-signed certificate...
|
|
(
|
|
echo [req]
|
|
echo default_bits = 2048
|
|
echo prompt = no
|
|
echo default_md = sha256
|
|
echo distinguished_name = dn
|
|
echo req_extensions = req_ext
|
|
echo.
|
|
echo [dn]
|
|
echo C=%COUNTRY%
|
|
echo ST=%STATE%
|
|
echo L=%CITY%
|
|
echo O=%ORG%
|
|
echo OU=%ORG_UNIT%
|
|
echo CN=%COMMON_NAME%
|
|
echo.
|
|
echo [req_ext]
|
|
echo subjectAltName = @alt_names
|
|
echo.
|
|
echo [alt_names]
|
|
echo DNS.1 = %COMMON_NAME%
|
|
echo DNS.2 = localhost
|
|
echo DNS.3 = *.local
|
|
echo IP.1 = 127.0.0.1
|
|
echo IP.2 = ::1
|
|
) > "%CERT_DIR%\san.cnf"
|
|
|
|
if not "%~2"=="" (
|
|
echo IP.3 = %~2>> "%CERT_DIR%\san.cnf"
|
|
echo Added IP: %~2
|
|
)
|
|
|
|
openssl x509 -req -in "%CERT_DIR%\server.csr" -signkey "%CERT_DIR%\server.key" -out "%CERT_DIR%\server.crt" -days %DAYS% -sha256 -extfile "%CERT_DIR%\san.cnf" -extensions req_ext
|
|
|
|
REM Clean up
|
|
del "%CERT_DIR%\server.csr"
|
|
del "%CERT_DIR%\san.cnf"
|
|
|
|
echo.
|
|
echo =========================================
|
|
echo ✓ Certificates generated successfully!
|
|
echo =========================================
|
|
echo Certificate: %CERT_DIR%\server.crt
|
|
echo Private Key: %CERT_DIR%\server.key
|
|
echo.
|
|
echo To use these certificates:
|
|
echo 1. Set environment variable: set OVERLORD_TLS=true
|
|
echo 2. Optionally set custom paths:
|
|
echo set OVERLORD_TLS_CERT=%CERT_DIR%\server.crt
|
|
echo set OVERLORD_TLS_KEY=%CERT_DIR%\server.key
|
|
echo.
|
|
echo ⚠️ NOTE: Self-signed certificates require clients to:
|
|
echo - Skip certificate verification (insecure), OR
|
|
echo - Trust the server.crt certificate manually
|
|
echo.
|
|
echo For production, use proper certificates from:
|
|
echo - Let's Encrypt (free, automated)
|
|
echo - Your organization's certificate authority
|
|
echo =========================================
|
|
|
|
endlocal
|