78 lines
2.1 KiB
Bash
78 lines
2.1 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
CERT_DIR="${SCRIPT_DIR}/../../deploy/telemetry/certs"
|
|
|
|
mkdir -p "${CERT_DIR}"
|
|
|
|
CA_KEY="${CERT_DIR}/ca.key"
|
|
CA_CRT="${CERT_DIR}/ca.crt"
|
|
COL_KEY="${CERT_DIR}/collector.key"
|
|
COL_CSR="${CERT_DIR}/collector.csr"
|
|
COL_CRT="${CERT_DIR}/collector.crt"
|
|
CLIENT_KEY="${CERT_DIR}/client.key"
|
|
CLIENT_CSR="${CERT_DIR}/client.csr"
|
|
CLIENT_CRT="${CERT_DIR}/client.crt"
|
|
|
|
echo "[*] Generating OpenTelemetry dev CA and certificates in ${CERT_DIR}"
|
|
|
|
# Root CA
|
|
if [[ ! -f "${CA_KEY}" ]]; then
|
|
openssl genrsa -out "${CA_KEY}" 4096 >/dev/null 2>&1
|
|
fi
|
|
openssl req -x509 -new -key "${CA_KEY}" -days 365 -sha256 \
|
|
-out "${CA_CRT}" -subj "/CN=StellaOps Dev Telemetry CA" \
|
|
-config <(cat <<'EOF'
|
|
[req]
|
|
distinguished_name = req_distinguished_name
|
|
prompt = no
|
|
[req_distinguished_name]
|
|
EOF
|
|
) >/dev/null 2>&1
|
|
|
|
# Collector certificate (server + client auth)
|
|
openssl req -new -nodes -newkey rsa:4096 \
|
|
-keyout "${COL_KEY}" \
|
|
-out "${COL_CSR}" \
|
|
-subj "/CN=stellaops-otel-collector" >/dev/null 2>&1
|
|
|
|
openssl x509 -req -in "${COL_CSR}" -CA "${CA_CRT}" -CAkey "${CA_KEY}" \
|
|
-CAcreateserial -out "${COL_CRT}" -days 365 -sha256 \
|
|
-extensions v3_req -extfile <(cat <<'EOF'
|
|
[v3_req]
|
|
subjectAltName = @alt_names
|
|
extendedKeyUsage = serverAuth, clientAuth
|
|
[alt_names]
|
|
DNS.1 = stellaops-otel-collector
|
|
DNS.2 = localhost
|
|
IP.1 = 127.0.0.1
|
|
EOF
|
|
) >/dev/null 2>&1
|
|
|
|
# Client certificate
|
|
openssl req -new -nodes -newkey rsa:4096 \
|
|
-keyout "${CLIENT_KEY}" \
|
|
-out "${CLIENT_CSR}" \
|
|
-subj "/CN=stellaops-otel-client" >/dev/null 2>&1
|
|
|
|
openssl x509 -req -in "${CLIENT_CSR}" -CA "${CA_CRT}" -CAkey "${CA_KEY}" \
|
|
-CAcreateserial -out "${CLIENT_CRT}" -days 365 -sha256 \
|
|
-extensions v3_req -extfile <(cat <<'EOF'
|
|
[v3_req]
|
|
extendedKeyUsage = clientAuth
|
|
subjectAltName = @alt_names
|
|
[alt_names]
|
|
DNS.1 = stellaops-otel-client
|
|
DNS.2 = localhost
|
|
IP.1 = 127.0.0.1
|
|
EOF
|
|
) >/dev/null 2>&1
|
|
|
|
rm -f "${COL_CSR}" "${CLIENT_CSR}"
|
|
rm -f "${CERT_DIR}/ca.srl"
|
|
|
|
echo "[✓] Certificates ready:"
|
|
ls -1 "${CERT_DIR}"
|