mirror of
https://github.com/keymanapp/keyman.git
synced 2026-08-05 08:25:32 +00:00
109 lines
3.8 KiB
Bash
Executable file
109 lines
3.8 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
|
|
set -e
|
|
set -u
|
|
|
|
## START STANDARD BUILD SCRIPT INCLUDE
|
|
# adjust relative paths as necessary
|
|
THIS_SCRIPT="$(readlink -f "${BASH_SOURCE[0]}")"
|
|
. "$(dirname "$THIS_SCRIPT")/../../build/build-utils.sh"
|
|
## END STANDARD BUILD SCRIPT INCLUDE
|
|
|
|
. "$KEYMAN_ROOT/resources/shellHelperFunctions.sh"
|
|
|
|
echo_heading2() {
|
|
echo ""
|
|
builder_heading "$*"
|
|
}
|
|
|
|
if [[ $BUILDER_OS != win ]]; then
|
|
builder_die "This script can only be run on Windows to setup IIS."
|
|
fi
|
|
|
|
builder_warn "Warning: this script requires Administrator permissions to install certificates."
|
|
|
|
# Generate CA key
|
|
echo_heading2 "Generating CA key"
|
|
if [ ! -f rootCA.key ]; then
|
|
echo "Please create a password for the certification authority key"
|
|
echo "This should be unique to your setup."
|
|
winpty openssl genrsa -des3 -out rootCA.key 2048
|
|
else
|
|
echo "Skipping, rootCA.key already present"
|
|
fi
|
|
|
|
# Generate CA certificate
|
|
echo_heading2 "Generating CA certificate"
|
|
if [ ! -f rootCA.pem ]; then
|
|
winpty openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.pem
|
|
else
|
|
echo "Skipping, rootCA.pem already present"
|
|
fi
|
|
|
|
# Generate site certificate signing request
|
|
echo_heading2 "Generating site certificate signing request"
|
|
if [ ! -f server.csr ]; then
|
|
winpty openssl req -new -sha256 -nodes -out server.csr -newkey rsa:2048 -keyout server.key -config server.csr.cnf
|
|
else
|
|
echo "Skipping, server.csr already present"
|
|
fi
|
|
|
|
# Generate site certificate
|
|
echo_heading2 "Generating site certificate"
|
|
if [ ! -f server.crt ]; then
|
|
winpty openssl x509 -req -in server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out server.crt -days 500 -sha256 -extfile v3.ext
|
|
else
|
|
echo "Skipping, server.crt already present"
|
|
fi
|
|
|
|
# Convert site certificate to .pfx for IIS
|
|
echo_heading2 "Converting certificate to .pfx for IIS"
|
|
if [ ! -f server.pfx ]; then
|
|
winpty openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt
|
|
else
|
|
echo "Skipping, server.pfx already present"
|
|
fi
|
|
|
|
# Import the CA certificate into the Trusted Root Certification Authorities
|
|
echo_heading2 "Importing CA certificate to root store"
|
|
certutil -addstore Root rootCA.pem
|
|
|
|
# Import server.pfx to IIS certficate store
|
|
echo_heading2 "Importing site certificate to WebHosting store"
|
|
certutil -importPFX WebHosting server.pfx
|
|
|
|
# Add bindings to each site in IIS
|
|
echo_heading2 "Setup IIS bindings"
|
|
echo "Now, add a HTTPS binding for each site in IIS (this is painful to automate):"
|
|
echo "1. Open IIS Manager"
|
|
echo "2. For each site, click Bindings in Actions panel"
|
|
echo "3. Click Add:"
|
|
echo " Select Type='https'"
|
|
echo " Select Host name=per the existing binding (e.g. 'keymanweb.com.local')"
|
|
echo " Select SSL certificate='keyman.com.local'"
|
|
echo "4. Click OK, Close, and repeat for each site."
|
|
echo ""
|
|
echo "This certificate can be used for all keyman.com sites and localhost; see"
|
|
echo "README.md / v3.ext for list of matching domains."
|
|
|
|
# Update PHP CACert
|
|
echo_heading2 "Setup PHP certificate authority"
|
|
|
|
curl -s https://curl.se/ca/cacert.pem > cacert.pem
|
|
echo "" >> cacert.pem
|
|
echo "Keyman Localhost CA" >> cacert.pem
|
|
echo "===================" >> cacert.pem
|
|
echo "## This is a local CA for Keyman localhost websites generated by" >> cacert.pem
|
|
echo "## https://github.com/keymanapp/keyman/tree/master/build/devbox/iis-https/setup-iis-https.sh" >> cacert.pem
|
|
cat rootCA.pem >> cacert.pem
|
|
|
|
echo "We also need to add our CA certificate to PHP so we can access our local"
|
|
echo "https sites from PHP scripts."
|
|
echo "1. Locate php.ini (e.g. C:\\tools\\php74\\php.ini)"
|
|
echo "2. Copy cacert.pem from here and save it alongside your PHP.ini file"
|
|
echo "3. Set curl.cainfo and openssl.cafile in php.ini to cacert.pem location, e.g."
|
|
echo " curl.cainfo = \"C:\\tools\\php74\\cacert.pem\""
|
|
echo "4. Finally, you may need to restart IIS for changes to take effect."
|
|
|
|
echo_heading2 "Complete"
|
|
builder_warn "Please check logs above for errors and manual steps"
|