76 lines
1.9 KiB
Bash
Executable File
76 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Generate a self-signed TLS cert for local HTTPS (Vite on :4308).
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
CERT_DIR="${CERT_DIR:-$ROOT/certs}"
|
|
DAYS="${CERT_DAYS:-825}"
|
|
KEY="$CERT_DIR/key.pem"
|
|
CERT="$CERT_DIR/cert.pem"
|
|
CNF="$CERT_DIR/openssl.cnf"
|
|
|
|
mkdir -p "$CERT_DIR"
|
|
|
|
# Extra hostnames / IPs: ./scripts/generate-cert.sh 192.168.188.22 myhost.local
|
|
EXTRA=("$@")
|
|
|
|
SAN="DNS:localhost,IP:127.0.0.1"
|
|
for entry in "${EXTRA[@]}"; do
|
|
if [[ "$entry" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
|
SAN+=",IP:$entry"
|
|
else
|
|
SAN+=",DNS:$entry"
|
|
fi
|
|
done
|
|
|
|
# Include non-loopback IPv4 addresses so LAN / WebView origins work.
|
|
while read -r ip; do
|
|
[[ -n "$ip" ]] || continue
|
|
[[ "$SAN" == *",$ip"* || "$SAN" == *"IP:$ip"* ]] && continue
|
|
SAN+=",IP:$ip"
|
|
done < <(hostname -I 2>/dev/null | tr ' ' '\n' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' || true)
|
|
|
|
cat >"$CNF" <<EOF
|
|
[req]
|
|
default_bits = 2048
|
|
prompt = no
|
|
default_md = sha256
|
|
distinguished_name = dn
|
|
x509_extensions = v3_req
|
|
|
|
[dn]
|
|
CN = localhost
|
|
|
|
[v3_req]
|
|
subjectAltName = $SAN
|
|
keyUsage = digitalSignature, keyEncipherment
|
|
extendedKeyUsage = serverAuth
|
|
EOF
|
|
|
|
openssl req -x509 -newkey rsa:2048 -sha256 -days "$DAYS" -nodes \
|
|
-keyout "$KEY" \
|
|
-out "$CERT" \
|
|
-config "$CNF"
|
|
|
|
chmod 600 "$KEY"
|
|
rm -f "$CNF"
|
|
|
|
# Base64(DER) — preferred QR payload (plain text, no JSON/URL/PEM wrappers).
|
|
DER_B64="$(openssl x509 -in "$CERT" -outform DER | base64 -w0)"
|
|
printf '%s\n' "$DER_B64" >"$CERT_DIR/cert.der.b64"
|
|
|
|
echo "Wrote $CERT"
|
|
echo "Wrote $KEY"
|
|
echo "Wrote $CERT_DIR/cert.der.b64"
|
|
echo "SAN: $SAN"
|
|
echo "Valid for $DAYS days."
|
|
echo
|
|
echo "=== certificate ==="
|
|
openssl x509 -in "$CERT" -noout -subject -issuer -dates -fingerprint -sha256 -ext subjectAltName
|
|
echo
|
|
echo "=== QR (base64 DER, raw payload) ==="
|
|
printf '%s' "$DER_B64" | node "$ROOT/scripts/qr-cert.mjs"
|
|
echo
|
|
echo "Start HTTPS: npm run dev:https"
|
|
echo "URL: https://localhost:4308/"
|