Self-signed RSA Certificate Authority generation script using strongswan-pki

rsa.ca.gen.sh

#!/usr/bin/env bash

CA_NAME="Swan CA"
ROOT_NAME="Swan Root Cert"
# File path to save to
CA_DIR="self-signed.CA"
CA_KEY_FP="$CA_DIR/swan.key.pem"
CA_CRT_FP="$CA_DIR/swan.crt.pem"
CA_P12CRT_FP="$CA_DIR/swan.p12"
mkdir -p "$CA_DIR"

# create private key for self-signed root CA
pki --gen --type ecdsa --outform pem > "$CA_KEY_FP"
# create the certificate file from existing private key
pki --self --ca --lifetime 1200 --in "$CA_KEY_FP" \
    --type ecdsa --digest sha256 \
    --dn "C=CH, O=$CA_NAME, CN=$ROOT_NAME" \
    --outform pem > "$CA_CRT_FP"

pki --print --in "$CA_CRT_FP"
printf '\nEnter password for saving p12 key pair for %s\n' "$CA_NAME"
openssl pkcs12 -aes128 -export -inkey "$CA_KEY_FP" \
    -in "$CA_CRT_FP" -out "$CA_P12CRT_FP"
chmod 600 "$CA_KEY_FP" "$CA_P12CRT_FP"

printf '\nSelf-signed cert %s saved at %s\n' "$CA_NAME" "$CA_CRT_FP"
printf    'Private key for %s saved at %s\n' "$CA_NAME" "$CA_KEY_FP"
printf   'p12 key pair for %s saved at %s\n' "$CA_NAME" "$CA_P12CRT_FP"

user.rsa.cert.gen.sh

#!/usr/bin/env bash

# Required CA cert before generate client cert
CA_DIR="self-signed.CA"
CA_KEY_FP="$CA_DIR/swan.key.pem"
CA_CRT_FP="$CA_DIR/swan.crt.pem"

DOC="Generate RSA certificate, you need strongswan-pki on Debian 9+
Usage:
  Generate "$CA_KEY_FP" and "$CA_CRT_FP" first.
  Then run script with required username and optional email as argument
"
cmd_example="    $0 vpn.user1 [user1@example.net]"

if [ $# -lt 1 ] || [ $# -gt 2 ]; then
  printf '\n%s\n%s\n\n' "$DOC" "$cmd_example"
  exit 1
else
  if [ $# -eq 1 ]; then
    NAME="$1"
    EMAIL="$NAME"
  fi
  if [ $# -eq 2 ]; then
    NAME="$1"
    EMAIL="$2"
  fi
fi

if [ ! -f "$CA_KEY_FP" ] || [ ! -f "$CA_CRT_FP" ]; then
  printf 'File %s or %s not exist\n' "$CA_KEY_FP" "$CA_CRT_FP"
  exit 1
fi

CA_NAME="Swan CA"
# File path to save to
USER_KEY_FP="$CA_DIR/$NAME.key.pem"
USER_CRT_FP="$CA_DIR/$NAME.crt.pem"
USER_P12CRT_FP="$CA_DIR/$NAME.p12"

printf 'Generate certificate for %s\n\n' "$NAME"

pki --gen --type rsa --size 2048 --outform pem > "$USER_KEY_FP"
pki --pub --in "$USER_KEY_FP" --type rsa | \
    pki --issue --lifetime 360 \
    --cakey "$CA_KEY_FP" --cacert "$CA_CRT_FP" \
    --dn "C=CH, O=$CA_NAME, CN=$EMAIL" \
    --san "$EMAIL" \
    --outform pem > "$USER_CRT_FP"

pki --print --in "$USER_CRT_FP"

printf '\nEnter password for saving p12 key pair for %s\n' "$NAME"
openssl pkcs12 -aes128 -export -inkey "$USER_KEY_FP" \
    -in "$USER_CRT_FP" -out "$USER_P12CRT_FP"
chmod 600 "$USER_KEY_FP" "$USER_P12CRT_FP"

printf '\nPrivate key for %s saved at %s\n' "$NAME" "$USER_KEY_FP"
printf   'Certificate for %s saved at %s\n' "$NAME" "$USER_CRT_FP"
printf  'p12 key pair for %s saved at %s\n' "$NAME" "$USER_P12CRT_FP"

Bash script to generate self-signed RSA certificate for CA, gateway and user, for use with strongswan VPN. You need strongswan-pki on Debian 9+

Recommend to use ECDSA CA when supported.

Simplify the script, delete gateway certificate generation in CA script, instead consider gateway to be one of the "user" of the CA.