Sign inSign up

godofkebab/tls-cert-generator

By godofkebab

ā€¢Updated 9 months ago

A simple tool with Docker-support to generate TLS certificates

Image
Networking
Security
Developer tools
0

863

godofkebab/tls-cert-generator repository overview

ā tls-cert-generator: Self-Signed TLS Certificate Generator

Release Docker Docker Static Badge

No bloat. No complexity. Just one command.

āœ… Root CA + Server Certificates ā€” automatically generated
šŸŽÆ Target specific hosts or auto-discover all addresses
āš” Pure shell script ā€” only requires openssl
šŸ³ macOS ā€¢ Linux ā€¢ Docker

ā Features

  • Creates and stores a reusable Root CA in certs/root/.

  • Issues server certificates into certs/servers/<name>/.

  • Supports:

    • Individual hostnames, IPs, or FQDNs.

    • Bulk generation:

      • all ā€“ all hostnames + IPv4 + IPv6 addresses.
      • all-hostname ā€“ only system hostnames.
      • all-ipv4 ā€“ only system IPv4 addresses.
      • all-ipv6 ā€“ only system IPv6 addresses.

  • Works on Linux and macOS (LibreSSL-compatible).

  • Automatically uses host networking to detect system IPs when run via Docker on Linux.

  • Optional flags:

    • -f ā€“ force overwrite existing keys/certs.
    • -o <dir> ā€“ specify the output certs directory (default ./certs).

  • Automatically maintains a .env file with the current configuration.

ā Configuration

The script needs a set of certificate identity fields. You can provide them in four ways (priority order):

  1. CLI arguments (--country, --state, etc.)
  2. Environment variables (COUNTRY, STATE, etc.) from the current shell
  3. Environment variables (COUNTRY, STATE, etc.) from the $CERTS/.env file (automatically generated from a previous run)
  4. Interactive prompt (script will ask if missing)

ā Options

CLI FlagEnv VarDescriptionExample
-fN/AFlag for overwriting existing files-f
-oN/AOutput directory for certs-o ./my-certs
--countryCOUNTRY2-letter country code--country TR
--stateSTATEState or province--state Istanbul
--localityLOCALITYCity/locality--locality Fatih
--orgORGANIZATIONOrganization name--org "God Of Kebab Labs"
--ouORGANIZATIONAL_UNITDepartment/unit--ou "God Of Kebab's Guide to the WWW"
--cnROOT_CNRoot CA Common Name--cn tls-cert-generator@kebabnet

Note: Interactive prompts doesn't work when the script is piped into sh

ā Ways to Run

ā 1. Direct Execution (Recommended)

Make sure you have OpenSSL installed (default on Linux/macOS).

Clone the repo and run the script directly:

export COUNTRY="TR"
export STATE="Istanbul"
export LOCALITY="Fatih"
export ORGANIZATION="God Of Kebab Labs"
export ORGANIZATIONAL_UNIT="God Of Kebab's Guide to the WWW"
export ROOT_CN="tls-cert-generator@kebabnet"

# Note: Interactive prompts doesn't work when the script is piped into sh 
wget -qO- https://github.com/GodOfKebab/tls-cert-generator/releases/latest/download/tls-cert-generator.sh | sh -s -- \
all 1.2.3.4 example.com

# OR use CLI arguments
wget -qO- https://github.com/GodOfKebab/tls-cert-generator/releases/latest/download/tls-cert-generator.sh | sh -s -- \
-f -o another-certs-folder \
--country "TR" \
--state "Istanbul" \
--locality "Fatih" \
--org "God Of Kebab Labs" \
--ou "God Of Kebab's Guide to the WWW" \
--cn "tls-cert-generator@kebabnet" \
all 1.2.3.4 example.com

# OR save the file before running
# wget https://github.com/GodOfKebab/tls-cert-generator/releases/latest/download/tls-cert-generator.sh -O tls-cert-generator.sh
# sh tls-cert-generator.sh all 1.2.3.4 example.com
Example Output 
Enter COUNTRY (2-letter country code) [XX]: 
Enter STATE (State or province) [XX]: 
Enter LOCALITY (City/locality) [XX]: 
Enter ORGANIZATION (Organization name) [XX]: 
Enter ORGANIZATIONAL_UNIT (Department/unit) [XX]: 
Enter ROOT_CN (Root CA Common Name) [tls-cert-generator@XX]: 
āœØ  Welcome to tls-cert-generator!
šŸ“‹ Current configuration:
   FORCE               (-f)         = 1
   CERTS_DIR           (-o)         = /Users/username/make-tls-certs
   COUNTRY             (--country)  = XX
   STATE               (--state)    = XX
   LOCALITY            (--locality) = XX
   ORGANIZATION        (--org)      = XX
   ORGANIZATIONAL_UNIT (--ou)       = XX
   ROOT_CN             (--cn)       = tls-cert-generator@XX

ā³ Generating key for rootCA ...
    āœ… Success: /Users/username/make-tls-certs/root/rootCA.key
ā³ Generating cert for rootCA ...
    āœ… Success: /Users/username/make-tls-certs/root/rootCA.crt
ā³ Generating cert/key for HOSTNAME ...
    āœ… Success: /Users/username/make-tls-certs/servers/HOSTNAME/key.pem
    āœ… Success: /Users/username/make-tls-certs/servers/HOSTNAME.csr
    āœ… Success: /Users/username/make-tls-certs/servers/HOSTNAME/cert.pem
ā³ Generating cert/key for HOSTNAME.local ...
    āœ… Success: /Users/username/make-tls-certs/servers/HOSTNAME.local/key.pem
    āœ… Success: /Users/username/make-tls-certs/servers/HOSTNAME.local.csr
    āœ… Success: /Users/username/make-tls-certs/servers/HOSTNAME.local/cert.pem
ā³ Generating cert/key for HOSTNAME.local ...
    āœ… Success: /Users/username/make-tls-certs/servers/HOSTNAME.local/key.pem
    āœ… Success: /Users/username/make-tls-certs/servers/HOSTNAME.local.csr
    āœ… Success: /Users/username/make-tls-certs/servers/HOSTNAME.local/cert.pem
ā³ Generating cert/key for XX.XX.XX.XX ...
    āœ… Success: /Users/username/make-tls-certs/servers/XX.XX.XX.XX/key.pem
    āœ… Success: /Users/username/make-tls-certs/servers/XX.XX.XX.XX.csr
    āœ… Success: /Users/username/make-tls-certs/servers/XX.XX.XX.XX/cert.pem
ā³ Generating cert/key for 127.0.0.1 ...
    āœ… Success: /Users/username/make-tls-certs/servers/127.0.0.1/key.pem
    āœ… Success: /Users/username/make-tls-certs/servers/127.0.0.1.csr
    āœ… Success: /Users/username/make-tls-certs/servers/127.0.0.1/cert.pem
ā³ Generating cert/key for ::1 ...
    āœ… Success: /Users/username/make-tls-certs/servers/::1/key.pem
    āœ… Success: /Users/username/make-tls-certs/servers/::1.csr
    āœ… Success: /Users/username/make-tls-certs/servers/::1/cert.pem

Certificates will be created in ./certs. A .env file will be written in ./certs/.env with the chosen values.

ā 2. Using the Prebuilt Docker Image (from Docker Hub)

You can pull and run the prebuilt image without cloning the repo:

Known issues: Dockerized method is not good at detecting the interfaces of your host system (only matters if you run the commands like all, etc.).

docker run --rm \
  -v $(pwd)/certs:/app/certs \
  -e COUNTRY="TR" \
  -e STATE="Istanbul" \
  -e LOCALITY="Fatih" \
  -e ORGANIZATION="God Of Kebab Labs" \
  -e ORGANIZATIONAL_UNIT="God Of Kebab's Guide to the WWW" \
  -e ROOT_CN="tls-cert-generator@kebabnet" \
  godofkebab/tls-cert-generator \
  all 1.2.3.4 example.com

Certificates will be written into ./certs (or wherever you set with -o).

ā 3. Building and Running the Docker Image Yourself

Clone the repo, build the Docker image, and run it:

Known issues: Dockerized method is not good at detecting the interfaces of your host system (only matters if you run the commands like all, etc.).

git clone https://github.com/GodOfKebab/tls-cert-generator.git
cd tls-cert-generator

docker build -t tls-cert-generator .
docker run --rm \
  -v $(pwd)/certs:/app/certs \
  -e COUNTRY="TR" \
  -e STATE="Istanbul" \
  -e LOCALITY="Fatih" \
  -e ORGANIZATION="God Of Kebab Labs" \
  -e ORGANIZATIONAL_UNIT="God Of Kebab's Guide to the WWW" \
  -e ROOT_CN="tls-cert-generator@kebabnet" \
  tls-cert-generator \
  all 1.2.3.4 example.com

Tag summary

Content type

Image

Digest

sha256:dd45d6012ā€¦

Size

4 MB

Last updated

9 months ago

docker pull godofkebab/tls-cert-generator