Create mTLS certs for your application

create_mtls_certs.sh

# Setup
CUSTOMER="customer-name"
COUNTRY="NO"
CACHE_SERVER_FQDN="remote-cache.example.com"

# CA Certificate
# Step 1: Create CA private key
openssl genpkey -algorithm RSA -out ca_private_key.pem -pkeyopt rsa_keygen_bits:4096

# Step 2: Create CA certificate
openssl req -x509 -new -nodes -key ca_private_key.pem -sha256 -days 3650 -out ca_certificate.pem -subj "/C=$COUNTRY/O=$CUSTOMER/CN=$CUSTOMER" -addext "keyUsage=digitalSignature,keyEncipherment,keyCertSign"

# Server certificate
# Step 1: Create server private key
openssl genpkey -algorithm RSA -out remote-cache-server-private-key.pem -pkeyopt rsa_keygen_bits:4096

# Step 2: Create a Certificate Signing Request (CSR) for the server certificate
openssl req -new -key remote-cache-server-private-key.pem -out remote-cache-server-csr.pem -subj "/C=$COUNTRY/O=$CUSTOMER/CN=$CACHE_SERVER_FQDN"

# Step 3: Generate a self-signed server certificate
echo "[v3_ca]\nkeyUsage=keyEncipherment,digitalSignature\nextendedKeyUsage=serverAuth,clientAuth\nsubjectAltName=DNS:$CACHE_SERVER_FQDN" > opensslserver.cnf
openssl x509 -req -days $((24 * 365 * 10)) -in remote-cache-server-csr.pem -CA ca_certificate.pem -CAkey ca_private_key.pem -CAcreateserial -out remote-cache-server-certificate.pem -extensions v3_ca -extfile opensslserver.cnf

# Client certificate
# Step 1: Generate a private key
openssl genpkey -algorithm RSA -out remote-cache-client-private-key.pem -pkeyopt rsa_keygen_bits:4096

# Step 2: Create a Certificate Signing Request (CSR)
openssl req -new -key remote-cache-client-private-key.pem -out remote-cache-client.csr -subj "/CN=$CACHE_SERVER_FQDN/O=$CUSTOMER/C=$COUNTRY" -addext "subjectAltName=DNS:$CACHE_SERVER_FQDN"

# Step 3: Sign the CSR to create a certificate
echo "keyUsage=digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth,clientAuth" > opensslclient.cnf
openssl x509 -req -in remote-cache-client.csr -CA ca_certificate.pem -CAkey ca_private_key.pem -CAcreateserial -out remote-cache-client-certificate.pem -days 3650 -extfile opensslclient.cnf