Self Signed Post-Quantum ML-DSA-44 Certificate Generator Bash Script

tls-ML-DSA-44.sh

#!/bin/bash

# Define variables
SUBJECT_ROOT="/C=US/O=Saud Iqbal/CN=Saud Iqbal Root ML-DSA-44 CA"
DAYS_VALID=3650
CONFIG_FILE="leaf_ext.cfg"
SUBJECT_LEAF="/"

RD=$(echo "\033[01;31m")
YW=$(echo "\033[33m")
GN=$(echo "\033[1;92m")
CL=$(echo "\033[m")
BFR="\\r\\033[K"
HOLD="${YW}+${CL}"
CM="${GN}✓${CL}"
CROSS="${RD}✗${CL}"

msg_ok() {
local msg="$1"
echo -e "${BFR} ${CM} ${GN}${msg}${CL}"
}
msg_error() {
local msg="$1"
echo -e "${BFR} ${CROSS} ${RD}${msg}${CL}"
}
msg_info() {
local msg="$1"
echo -e " ${HOLD} ${YW}${msg}${CL}"
}

msg_info "------------------------------------------------"
msg_info "- Self Signed ML-DSA-44 Certificate Generator --"
msg_info "------------------------------------------------"

# Root CA
function GenerateRootPair() {
mkdir -p root/{certs,private}
echo -e "\033[0;41m Generate the Root Pair \033[m"
# Generate Root Private Key:
openssl genpkey -algorithm mldsa44 -out root/private/rootCA.key.pem
# Generate Self-Signed Root Certificate (10 years):
openssl req -new -x509 -key root/private/rootCA.key.pem -out root/certs/rootCA.crt -days "$DAYS_VALID" -subj "$SUBJECT_ROOT"
msg_ok "Root pair setup done!"
sleep 1
}

# Leaf Certificate
function GenerateLeafPair() {
mkdir -p leaf/{newcerts,private,csr}
echo -e "\033[0;41m Generate Leaf Certificate \033[m"
echo -n "Enter hostname for creating new leaf certificate: "
read DOMAIN
if [[ -n $DOMAIN ]]; then
#Generate Leaf Private Key:
openssl genpkey -algorithm mldsa44 -out leaf/private/${DOMAIN}.leaf.key.pem
#Generate Leaf CSR:
openssl req -new -key leaf/private/${DOMAIN}.leaf.key.pem -out leaf/csr/${DOMAIN}.leaf.csr -subj "$SUBJECT_LEAF"
# Create a temporary config file to handle Subject Alternative Names (SAN)
cat > "$CONFIG_FILE" <<EOF
#authorityKeyIdentifier=keyid,issuer
basicConstraints=critical,CA:FALSE
keyUsage=critical,digitalSignature
extendedKeyUsage=serverAuth
subjectAltName=critical,@alt_names
[alt_names]
DNS.1 = $DOMAIN
EOF
rootexpirationdate=$(( ( $(date -d "$(openssl x509 -in root/certs/rootCA.crt -noout -enddate | cut -d= -f2-)" +%s) - $(date +%s) ) / 86400 ))
rootexpirationdate=$((rootexpirationdate - 1))
openssl x509 -req -in leaf/csr/${DOMAIN}.leaf.csr -CA root/certs/rootCA.crt -CAkey root/private/rootCA.key.pem -CAcreateserial -out leaf/newcerts/${DOMAIN}.leaf.crt -days "$rootexpirationdate" -sha256 -extfile leaf_ext.cfg
cat leaf/newcerts/${DOMAIN}.leaf.crt root/certs/rootCA.crt > leaf/newcerts/${DOMAIN}.fullchain.pem
msg_ok "Leaf CA setup done!"
# Clean up the configuration file
rm "$CONFIG_FILE"
else
msg_error "No response received!"
fi
sleep 1
}

if [ -d "root" ]; then
msg_info "Root CA found, using it for leaf certificate!"
else
printf 'Generate the Root Pair [y/N]? '
read answer
if [ "$answer" != "${answer#[Yy]}" ] ;then
GenerateRootPair
fi
fi
printf 'Generate New Leaf Certificate [y/N]? '
read answer
if [ "$answer" != "${answer#[Yy]}" ] ;then
GenerateLeafPair
fi

msg_info "------------------------------------------------"
msg_info "- Self Signed ML-DSA-44 Certificate Setup Done -"
msg_info "------------------------------------------------"
exit 0