bin/setup, lib/func.tcl: Move root key generation into the library.

[ca] / lib / func.tcl

diff --git a/lib/func.tcl b/lib/func.tcl
index 3dd35c31efd74fd6b0522b886d5da90d45e5be33..1b53f2f113d842e00579820d592df19328b91a24 100644 (file)
--- a/lib/func.tcl
+++ b/lib/func.tcl
@@ -495,6 +495,26 @@ proc cert-seq {file} {
   return [expr 0x$serial + 0]
 }
 
+###--------------------------------------------------------------------------
+### Generating the root key.
+
+proc generate-root-key {} {
+  global C
+
+  set subject ""
+  foreach {attr value} $C(ca-name) { append subject "/$attr=$value" }
+  exec >@stdout 2>@stderr openssl req -config "etc/openssl.conf"  \
+      -text -out "ca.cert" -keyout "private/ca.key" \
+      -new -x509 -days $C(ca-period) \
+      -subj $subject
+  file attributes "private/ca.key" \
+      -owner $C(ca-owner) -group $C(ca-group) \
+      -permissions 0640
+  file attributes "ca.cert" \
+      -owner $C(ca-owner) -group $C(ca-group) \
+      -permissions 0644
+}
+
 ###--------------------------------------------------------------------------
 ### Certificate requests.