jocay
49 lines
1.7 KiB
Bash
49 lines
1.7 KiB
Bash
#!/usr/bin/env bash
|
|
# ==============================================================================
|
|
# 模块：TLS 证书自动化生成与管理 (支持 ECDSA 现代自签与自定义证书)
|
|
# ==============================================================================
|
|
|
|
CERT_DIR="${INSTALL_DIR}/cert"
|
|
CERT_FILE="${CERT_DIR}/cert.pem"
|
|
KEY_FILE="${CERT_DIR}/private.key"
|
|
|
|
# 生成现代椭圆曲线 (prime256v1) 自签名证书
|
|
generate_self_signed_cert() {
|
|
local sni="${1:-www.bing.com}"
|
|
mkdir -p "${CERT_DIR}"
|
|
|
|
# 如果证书已存在且有效期超过30天，直接复用
|
|
if [[ -f "${CERT_FILE}" && -f "${KEY_FILE}" ]]; then
|
|
if openssl x509 -checkend 2592000 -noout -in "${CERT_FILE}" >/dev/null 2>&1; then
|
|
log_info "现有 TLS 证书有效，直接复用: ${CERT_FILE}"
|
|
return 0
|
|
fi
|
|
fi
|
|
|
|
log_info "正在为伪装域名 [${sni}] 自动化生成 ECDSA (P-256) 高性能自签名 TLS 证书..."
|
|
|
|
# 生成 EC 私钥
|
|
openssl ecparam -name prime256v1 -genkey -noout -out "${KEY_FILE}" 2>/dev/null
|
|
|
|
# 生成 10 年有效期的自签名证书
|
|
openssl req -new -x509 -days 3650 \
|
|
-key "${KEY_FILE}" \
|
|
-out "${CERT_FILE}" \
|
|
-subj "/CN=${sni}" \
|
|
-addext "subjectAltName=DNS:${sni}" 2>/dev/null || \
|
|
openssl req -new -x509 -days 3650 \
|
|
-key "${KEY_FILE}" \
|
|
-out "${CERT_FILE}" \
|
|
-subj "/CN=${sni}" 2>/dev/null
|
|
|
|
chmod 600 "${KEY_FILE}" "${CERT_FILE}"
|
|
|
|
if [[ ! -s "${CERT_FILE}" || ! -s "${KEY_FILE}" ]]; then
|
|
log_error "TLS 自签名证书生成失败，请检查 openssl 环境！"
|
|
return 1
|
|
fi
|
|
|
|
log_success "TLS 证书自动化生成完成！"
|
|
return 0
|
|
}
|