-@Echo off
-rem
-rem unbound-control-setup.cmd - set up SSL certificates for unbound-control
-rem
-rem Copyright (c) 2008, NLnet Labs. All rights reserved.
-rem Modified for Windows by Y.Voinov (c) 2014
-rem
-rem This software is open source.
-rem
-rem Redistribution and use in source and binary forms, with or without
-rem modification, are permitted provided that the following conditions
-rem are met:
-rem
-rem Redistributions of source code must retain the above copyright notice,
-rem this list of conditions and the following disclaimer.
-rem
-rem Redistributions in binary form must reproduce the above copyright notice,
-rem this list of conditions and the following disclaimer in the documentation
-rem and/or other materials provided with the distribution.
-rem
-rem Neither the name of the NLNET LABS nor the names of its contributors may
-rem be used to endorse or promote products derived from this software without
-rem specific prior written permission.
-rem
-rem THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-rem "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-rem LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-rem A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-rem HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-rem SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
-rem TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-rem PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-rem LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-rem NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-rem SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-rem settings:
-
-rem directory for files
-set prefix="C:\Program Files (x86)"
-set DESTDIR=%prefix%\Unbound
-
-rem issuer and subject name for certificates
-set SERVERNAME=unbound
-set CLIENTNAME=unbound-control
-
-rem validity period for certificates
-set DAYS=7200
-
-rem size of keys in bits
-set BITS=1536
-
-rem hash algorithm
-set HASH=sha256
-
-rem base name for unbound server keys
-set SVR_BASE=unbound_server
-
-rem base name for unbound-control keys
-set CTL_BASE=unbound_control
-
-rem end of options
-
-rem Check OpenSSL installed
-for /f "delims=" %%a in ('where openssl') do @set SSL_PROGRAM=%%a
-if /I "%SSL_PROGRAM%"=="" echo SSL not found. If installed, add path to PATH environment variable. & exit 1
-echo SSL found: %SSL_PROGRAM%
-
-set arg=%1
-if /I "%arg%" == "-h" goto help
-if /I "%arg%"=="-d" set DESTDIR=%2
-
-rem go!:
-echo setup in directory %DESTDIR%
-cd %$DESTDIR%
-
-rem create certificate keys; do not recreate if they already exist.
-if exist $SVR_BASE.key (
-echo %SVR_BASE%.key exists
-goto next
-)
-echo generating %SVR_BASE%.key
-"%SSL_PROGRAM%" genrsa -out %SVR_BASE%.key %BITS% || echo could not genrsa && exit 1
-
-:next
-if exist %CTL_BASE%.key (
-echo %CTL_BASE%.key exists
-goto next2
-)
-echo generating %CTL_BASE%.key
-"%SSL_PROGRAM%" genrsa -out %CTL_BASE%.key %BITS% || echo could not genrsa && exit 1
-
-:next2
-rem create self-signed cert for server
-if exist request.cfg (del /F /Q /S request.cfg)
-echo [req]>>request.cfg
-echo default_bits=%BITS%>>request.cfg
-echo default_md=%HASH%>>request.cfg
-echo prompt=no>>request.cfg
-echo distinguished_name=req_distinguished_name>>request.cfg
-echo.>>request.cfg
-echo [req_distinguished_name]>>request.cfg
-echo commonName=%SERVERNAME%>>request.cfg
-
-if not exist request.cfg (
-echo could not create request.cfg
-exit 1
-)
-
-echo create %SVR_BASE%.pem (self signed certificate)
-"%SSL_PROGRAM%" req -key %SVR_BASE%.key -config request.cfg -new -x509 -days %DAYS% -out %SVR_BASE%.pem || echo could not create %SVR_BASE%.pem && exit 1
-rem create trusted usage pem
-"%SSL_PROGRAM%" x509 -in %SVR_BASE%.pem -addtrust serverAuth -out %SVR_BASE%_trust.pem
-
-rem create client request and sign it
-if exist request.cfg (del /F /Q /S request.cfg)
-echo [req]>>request.cfg
-echo default_bits=%BITS%>>request.cfg
-echo default_md=%HASH%>>request.cfg
-echo prompt=no>>request.cfg
-echo distinguished_name=req_distinguished_name>>request.cfg
-echo.>>request.cfg
-echo [req_distinguished_name]>>request.cfg
-echo commonName=%CLIENTNAME%>>request.cfg
-
-if not exist request.cfg (
-echo could not create request.cfg
-exit 1
-)
-
-echo create %CTL_BASE%.pem (signed client certificate)
-"%SSL_PROGRAM%" req -key %CTL_BASE%.key -config request.cfg -new | "%SSL_PROGRAM%" x509 -req -days %DAYS% -CA %SVR_BASE%_trust.pem -CAkey %SVR_BASE%.key -CAcreateserial -%HASH% -out %CTL_BASE%.pem
-
-if not exist %CTL_BASE%.pem (
-echo could not create %CTL_BASE%.pem
-exit 1
-)
-rem create trusted usage pem
-rem "%SSL_PROGRAM%" x509 -in %CTL_BASE%.pem -addtrust clientAuth -out %CTL_BASE%_trust.pem
-
-rem see details with "%SSL_PROGRAM%" x509 -noout -text < %SVR_BASE%.pem
-rem echo "create %CTL_BASE%_browser.pfx (web client certificate)"
-rem echo "create webbrowser PKCSrem12 .PFX certificate file. In Firefox import in:"
-rem echo "preferences - advanced - encryption - view certificates - your certs"
-rem echo "empty password is used, simply click OK on the password dialog box."
-rem "%SSL_PROGRAM%" pkcs12 -export -in %CTL_BASE%_trust.pem -inkey %CTL_BASE%.key -name "unbound remote control client cert" -out %CTL_BASE%_browser.pfx -password "pass:" || echo could not create browser certificate && exit 1
-
-rem remove crap
-del /F /Q /S request.cfg
-del /F /Q /S %CTL_BASE%_trust.pem
-del /F /Q /S %SVR_BASE%_trust.pem
-del /F /Q /S %SVR_BASE%_trust.srl
-
-echo Setup success. Certificates created. Enable in unbound.conf file to use
-
-exit 0
-
-:help
-echo unbound-control-setup.cmd - setup SSL keys for unbound-control
-echo -d dir use directory to store keys and certificates.
-echo default: %DESTDIR%
-echo please run this command using the same user id that the
-echo unbound daemon uses, it needs read privileges.
-exit 1
+@Echo off\r
+rem\r
+rem unbound-control-setup.cmd - set up SSL certificates for unbound-control\r
+rem\r
+rem Copyright (c) 2008, NLnet Labs. All rights reserved.\r
+rem Modified for Windows by Y.Voinov (c) 2014\r
+rem\r
+rem This software is open source.\r
+rem \r
+rem Redistribution and use in source and binary forms, with or without\r
+rem modification, are permitted provided that the following conditions\r
+rem are met:\r
+rem \r
+rem Redistributions of source code must retain the above copyright notice,\r
+rem this list of conditions and the following disclaimer.\r
+rem \r
+rem Redistributions in binary form must reproduce the above copyright notice,\r
+rem this list of conditions and the following disclaimer in the documentation\r
+rem and/or other materials provided with the distribution.\r
+rem \r
+rem Neither the name of the NLNET LABS nor the names of its contributors may\r
+rem be used to endorse or promote products derived from this software without\r
+rem specific prior written permission.\r
+rem \r
+rem THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\r
+rem "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\r
+rem LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\r
+rem A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\r
+rem HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\r
+rem SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED\r
+rem TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR\r
+rem PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF\r
+rem LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING\r
+rem NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r
+rem SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r
+\r
+rem settings:\r
+\r
+rem directory for files\r
+set prefix="C:\Program Files (x86)"\r
+set DESTDIR=%prefix%\Unbound\r
+\r
+rem issuer and subject name for certificates\r
+set SERVERNAME=unbound\r
+set CLIENTNAME=unbound-control\r
+\r
+rem validity period for certificates\r
+set DAYS=7200\r
+\r
+rem size of keys in bits\r
+set BITS=1536\r
+\r
+rem hash algorithm\r
+set HASH=sha256\r
+\r
+rem base name for unbound server keys\r
+set SVR_BASE=unbound_server\r
+\r
+rem base name for unbound-control keys\r
+set CTL_BASE=unbound_control\r
+\r
+rem end of options\r
+\r
+rem Check OpenSSL installed\r
+for /f "delims=" %%a in ('where openssl') do @set SSL_PROGRAM=%%a\r
+if /I "%SSL_PROGRAM%"=="" echo SSL not found. If installed, add path to PATH environment variable. & exit 1\r
+echo SSL found: %SSL_PROGRAM%\r
+\r
+set arg=%1\r
+if /I "%arg%" == "-h" goto help\r
+if /I "%arg%"=="-d" set DESTDIR=%2\r
+\r
+rem go!:\r
+echo setup in directory %DESTDIR%\r
+cd %$DESTDIR%\r
+\r
+rem create certificate keys; do not recreate if they already exist.\r
+if exist $SVR_BASE.key (\r
+echo %SVR_BASE%.key exists\r
+goto next\r
+)\r
+echo generating %SVR_BASE%.key\r
+"%SSL_PROGRAM%" genrsa -out %SVR_BASE%.key %BITS% || echo could not genrsa && exit 1\r
+\r
+:next\r
+if exist %CTL_BASE%.key (\r
+echo %CTL_BASE%.key exists\r
+goto next2\r
+)\r
+echo generating %CTL_BASE%.key\r
+"%SSL_PROGRAM%" genrsa -out %CTL_BASE%.key %BITS% || echo could not genrsa && exit 1\r
+\r
+:next2\r
+rem create self-signed cert for server\r
+if exist request.cfg (del /F /Q /S request.cfg)\r
+echo [req]>>request.cfg\r
+echo default_bits=%BITS%>>request.cfg\r
+echo default_md=%HASH%>>request.cfg\r
+echo prompt=no>>request.cfg\r
+echo distinguished_name=req_distinguished_name>>request.cfg\r
+echo.>>request.cfg\r
+echo [req_distinguished_name]>>request.cfg\r
+echo commonName=%SERVERNAME%>>request.cfg\r
+\r
+if not exist request.cfg (\r
+echo could not create request.cfg\r
+exit 1\r
+)\r
+\r
+echo create %SVR_BASE%.pem (self signed certificate)\r
+"%SSL_PROGRAM%" req -key %SVR_BASE%.key -config request.cfg -new -x509 -days %DAYS% -out %SVR_BASE%.pem || echo could not create %SVR_BASE%.pem && exit 1\r
+rem create trusted usage pem\r
+"%SSL_PROGRAM%" x509 -in %SVR_BASE%.pem -addtrust serverAuth -out %SVR_BASE%_trust.pem\r
+\r
+rem create client request and sign it\r
+if exist request.cfg (del /F /Q /S request.cfg)\r
+echo [req]>>request.cfg\r
+echo default_bits=%BITS%>>request.cfg\r
+echo default_md=%HASH%>>request.cfg\r
+echo prompt=no>>request.cfg\r
+echo distinguished_name=req_distinguished_name>>request.cfg\r
+echo.>>request.cfg\r
+echo [req_distinguished_name]>>request.cfg\r
+echo commonName=%CLIENTNAME%>>request.cfg\r
+\r
+if not exist request.cfg (\r
+echo could not create request.cfg\r
+exit 1\r
+)\r
+\r
+echo create %CTL_BASE%.pem (signed client certificate)\r
+"%SSL_PROGRAM%" req -key %CTL_BASE%.key -config request.cfg -new | "%SSL_PROGRAM%" x509 -req -days %DAYS% -CA %SVR_BASE%_trust.pem -CAkey %SVR_BASE%.key -CAcreateserial -%HASH% -out %CTL_BASE%.pem\r
+\r
+if not exist %CTL_BASE%.pem (\r
+echo could not create %CTL_BASE%.pem\r
+exit 1\r
+)\r
+rem create trusted usage pem\r
+rem "%SSL_PROGRAM%" x509 -in %CTL_BASE%.pem -addtrust clientAuth -out %CTL_BASE%_trust.pem\r
+\r
+rem see details with "%SSL_PROGRAM%" x509 -noout -text < %SVR_BASE%.pem\r
+rem echo "create %CTL_BASE%_browser.pfx (web client certificate)"\r
+rem echo "create webbrowser PKCSrem12 .PFX certificate file. In Firefox import in:"\r
+rem echo "preferences - advanced - encryption - view certificates - your certs"\r
+rem echo "empty password is used, simply click OK on the password dialog box."\r
+rem "%SSL_PROGRAM%" pkcs12 -export -in %CTL_BASE%_trust.pem -inkey %CTL_BASE%.key -name "unbound remote control client cert" -out %CTL_BASE%_browser.pfx -password "pass:" || echo could not create browser certificate && exit 1\r
+\r
+rem remove crap\r
+del /F /Q /S request.cfg\r
+del /F /Q /S %CTL_BASE%_trust.pem \r
+del /F /Q /S %SVR_BASE%_trust.pem \r
+del /F /Q /S %SVR_BASE%_trust.srl\r
+\r
+echo Setup success. Certificates created. Enable in unbound.conf file to use\r
+\r
+exit 0\r
+\r
+:help\r
+echo unbound-control-setup.cmd - setup SSL keys for unbound-control\r
+echo -d dir use directory to store keys and certificates.\r
+echo default: %DESTDIR%\r
+echo please run this command using the same user id that the \r
+echo unbound daemon uses, it needs read privileges.\r
+exit 1\r
projects / thirdparty / unbound.git / commitdiff
