(Zwischen-)Zertifikat Key und Zertifikatsrequest per Script auf Plausibilität prüfen

Dieses Script prüft folgende Punkte:

• mind. 4096 Bit Key
• Passen CSR, CRT, KEY zusammen (openssl modulus / md5)?
• Signatur-Hash prüfen
• Passt das Intermediate-CRT zum CRT

Namenskonvention der Dateien:

• meine-domain.de.key
• meine-domain.de.crt
• meine-domain.de.csr
• meine-domain.de.intermediates

#!/bin/bash
#
# check if certificate, signing request and key match
#
# $Id: check-certificate.sh 524 2016-01-15 11:30:11Z magenbrot $
# zlFamous added intermediate and key size check
#

if [ "x$1" = "x" ]; then
  echo "Usage: $0 <filename without .key, .crt, .csr or .intermediates>"
  exit 1
fi

if [ -e $1.key ]; then
  output="$1.key: `openssl rsa -noout -modulus -in $1.key | openssl md5 | cut -d" " -f2`"
  key_size=`openssl rsa -noout -text -in $1.key | grep "Private-Key" | cut -d" " -f2 | cut -d"(" -f2`
  if [ $key_size -lt 4096 ]; then
    output="$output \e[39m(key size: \e[33m$key_size\e[39m bit)"
  else
    output="$output \e[39m(key size: \e[32m$key_size\e[39m bit)"
  fi
  echo -e $output
else
  echo "$1.key: file not found"
fi

if [ -e $1.csr ]; then
  echo -n "$1.csr: "
  openssl req -noout -modulus -in $1.csr | openssl md5 | cut -d" " -f2
else
  echo "$1.csr: file not found"
fi

if [ -e $1.crt ]; then
  echo -n "$1.crt: "
  openssl x509 -noout -modulus -in $1.crt | openssl md5 | cut -d" " -f2
else
  echo "$1.crt: file not found"
fi

if [ -e $1.intermediates ]; then
  echo -n "$1.intermediates: "
  subject=`openssl x509 -noout -subject_hash -in $1.intermediates`
  issuer=`openssl x509 -noout -issuer_hash -in $1.crt`
  if [ "$subject" != "" -o "$issuer" != "" ]; then
    if [ "$subject" == "$issuer" ]; then
      signature=`openssl x509 -noout -text -in $1.intermediates | grep "Signature Algorithm:" | cut -d" " -f7 | head -n1`
      echo -e "\e[32missuer matches subject \e[39m- signature hash: \e[32m$signature\e[39m"
    else
      echo -e "\e[31missuer doesn't match subject"
    fi
  fi
  chown root:root $1.intermediates
  chmod 0600 $1.key $1.csr $1.crt $1.intermediates
else
  echo "$1.intermediates: file not found"
fi