diff options
Diffstat (limited to 'dkim/mkcert')
| -rwxr-xr-x | dkim/mkcert | 71 |
1 files changed, 43 insertions, 28 deletions
diff --git a/dkim/mkcert b/dkim/mkcert index 96c1637..a41f842 100755 --- a/dkim/mkcert +++ b/dkim/mkcert @@ -1,24 +1,30 @@ #!/bin/rc # This script generates and stores DKIM keypair, using the correct user -# It outputs all paths generated in the following order: +# It outputs all paths generated in the following order for each algorithm: # - privkey -# - pubkey # - txt record to be used in dns # # Example/intended usage: # dkimfiles = `$nl{dkim/mkcert <selector>} -# privkey = $dkimfiles(1) -# txtfile = $dkimfiles(2) -# -# There is no real need for the pubkey to be stored as its own file. +# rsakey = $dkimfiles(1) +# rsatxt = $dkimfiles(2) +# edkey = $dkimfiles(3) +# edtxt = $dkimfiles(4) + +dir = /etc/mail/dkim +user =_dkimsign_ +selector = $1 +ed = ed25519 +rsaprivkey = $dir/$selector.rsa.priv.key +rsapubkey = $dir/$selector.rsa.pub.key +rsatxt = $dir/$selector.rsa.txt +edprivkey = $dir/$selector.$ed.priv.key +edpubkey = $dir/$selector.$ed.pub.key +edtxt = $dir/$selector.$ed.txt -dir = /etc/mail/dkim -user =_dkimsign_ -selector = $1 -privkey = $dir/$selector.priv.key -pubkey = $dir/$selector.pub.key -txt = $dir/$selector.txt +files = ( $rsaprivkey $rsapubkey $rsatxt \ + $edprivkey $edpubkey $edtxt ) fn err { echo $* >[1=2] @@ -38,9 +44,9 @@ fn mustsucceed { } fn cleanupfailed { - as rm $privkey - as rm $pubkey - as rm $txt + for (f in $files) { + as rm $f [2]>/dev/null + } } fn as { @@ -52,21 +58,30 @@ if (!~ $#* 1) { exit 2 } - -as test -e $privkey && die $privkey already exists -as test -e $pubkey && die $pubkey already exists -as test -e $txt && die $txt already exists +for (f in $files) { + as test -e $f && die $f already exists +} mustsucceed as mkdir -p $dir -mustsucceed as openssl genrsa -out $privkey -mustsucceed as openssl rsa -in $privkey -pubout | \ - mustsucceed as tee $pubkey >/dev/null -mustsucceed as cat $pubkey | \ +# RSA +mustsucceed as openssl genrsa -out $rsaprivkey +mustsucceed as openssl rsa -in $rsaprivkey -pubout | \ + mustsucceed as tee $rsapubkey >/dev/null +mustsucceed as cat $rsapubkey | \ mustsucceed as sed '1s/.*/v=DKIM1;p=/;:nl;${s/-----.*//;q;};N;s/\n//g;b nl;' | \ - mustsucceed as tee $txt >/dev/null + mustsucceed as tee $rsatxt >/dev/null + +# ED25519 +mustsucceed as openssl genpkey -algorithm $ed -out $edprivkey +mustsucceed as openssl pkey -outform DER -pubout -in $edprivkey | \ + mustsucceed tail -c +13 | mustsucceed openssl base64 | \ + mustsucceed as tee $edpubkey >/dev/null +mustsucceed printf 'v=DKIM1;k=%s;p=%s\n' $ed `$nl{mustsucceed as cat $edpubkey} | \ + mustsucceed as tee $edtxt >/dev/null -err 'Paths generated (privkey, pubkey, txt dns record):' -echo $privkey -echo $pubkey -echo $txt +err 'Paths generated (rsa privkey, rsa dns record, ed25519 privkey, ed25519 dns record):' +echo $rsaprivkey +echo $rsatxt +echo $edprivkey +echo $edtxt |