feat(deploy): device client-CA + issuance/revocation + frp/nginx mTLS templates (V2/V7)
Committable VPS artifacts for the native reverse-tunnel (no live-ops, no secrets):
- gen-device-ca.sh: EC P-256 self-signed device CA (CA:TRUE pathlen:0, keyCertSign+cRLSign),
openssl ca db + empty CRL, idempotent, --kind frp-client scaffolds the control-channel CA.
- issue-device-cert.sh: P-256 leaf, EKU=clientAuth only, 825d, emits .p12 (-legacy) + .pem/.key/.fullchain,
copy_extensions=none prevents CSR-injected serverAuth/CA:TRUE; CN traversal guard.
- revoke-device.sh: openssl ca revoke -> regenerate crl.pem (revocation enforced via -crl_check).
- frp/{frps.toml.example,frpc.example.toml}: control-channel mTLS+token, disableCustomTLSFirstByte=true.
- nginx/frp-mtls.conf: :8470 TLS-term, ssl_verify_client on + device-CA + ssl_crl, WS-upgrade proxy to :7080.
- nginx/stream-sni-additions.md: the two additive SNI map lines (merge-only, coexistence-safe).
Verified: gen->issue->openssl verify->revoke->CRL chain green in a tmp dir (OpenSSL 3.0.18).
This commit is contained in:
Yaojia Wang
163
deploy/scripts/gen-device-ca.sh
Executable file
163
deploy/scripts/gen-device-ca.sh
Executable file
@@ -0,0 +1,163 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# RELAY-PHASE1 · Native mTLS tunnel · V2 — Device client-CA (and frp-client control-CA).
|
||||
#
|
||||
# STAGING TEMPLATE. Mints a PRIVATE client-authentication CA whose leaves the native clients (iOS /
|
||||
# Android / desktop) present at nginx :8470 (`ssl_verify_client on`). This CA is the ONE AND ONLY
|
||||
# security gate for the tunnelled base app (the base app has no login of its own — PLAN §1), so it
|
||||
# MUST be a SEPARATE trust root from Let's Encrypt (the public :8470 SERVER cert) and from the
|
||||
# agent-enrollment CA (deploy/scripts/gen-agent-ca.sh). Mixing them would let a foreign leaf enroll.
|
||||
#
|
||||
# *** P-256 (prime256v1), NEVER Ed25519. *** nginx `ssl_verify_client` + iOS client-certificate
|
||||
# selection require ECDSA-P256/RSA; Ed25519 client certs are not universally accepted (PLAN V2).
|
||||
#
|
||||
# Two KINDs (same structure, different name/subject/default dir):
|
||||
# device → /etc/relay/device-ca (device-ca.cert.pem) leaves = client devices (V2/V4)
|
||||
# frp-client → /etc/relay/frp-client-ca (frp-client-ca.cert.pem) leaves = per-host frpc control mTLS (V1/V1b)
|
||||
#
|
||||
# Produces an OpenSSL `ca` database (index.txt / serial / crlnumber / newcerts / openssl.cnf) so that
|
||||
# deploy/scripts/issue-device-cert.sh can sign tracked leaves and deploy/scripts/revoke-device.sh can
|
||||
# revoke by serial and regenerate the CRL. An EMPTY crl.pem is initialised NOW so V4's `ssl_crl` has a
|
||||
# file to reference from day one.
|
||||
#
|
||||
# Outputs (0600 key, 0644 cert) under CA_DIR:
|
||||
# <CA_NAME>.key.pem <CA_NAME>.cert.pem crl.pem
|
||||
# index.txt serial crlnumber index.txt.attr newcerts/ openssl.cnf (the `openssl ca` db)
|
||||
#
|
||||
# Config via ENV or flags (no hardcoded secrets — this CA key is generated in place, never committed):
|
||||
# KIND device | frp-client (default device) — or --kind <k>
|
||||
# CA_DIR output dir (default per-KIND above) — or --dir <path>
|
||||
# CA_DAYS CA lifetime in days (default 3650)
|
||||
#
|
||||
# Idempotent: an existing CA (key+cert) is REUSED, never overwritten (delete the dir to rotate).
|
||||
#
|
||||
# Verify (syntax): bash -n deploy/scripts/gen-device-ca.sh
|
||||
set -euo pipefail
|
||||
|
||||
KIND="${KIND:-device}"
|
||||
CA_DIR="${CA_DIR:-}"
|
||||
CA_DAYS="${CA_DAYS:-3650}"
|
||||
|
||||
# ---- args (flags override env) --------------------------------------------------------------------
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--kind) KIND="${2:?--kind needs a value}"; shift 2 ;;
|
||||
--dir) CA_DIR="${2:?--dir needs a value}"; shift 2 ;;
|
||||
-h|--help)
|
||||
grep '^#' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
|
||||
*) echo "FATAL: unknown argument '$1' (see --help)" >&2; exit 2 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
case "${KIND}" in
|
||||
device) CA_NAME="device-ca"; CA_CN="web-terminal Device CA"; CA_OU="device-ca"
|
||||
CA_DIR="${CA_DIR:-/etc/relay/device-ca}" ;;
|
||||
frp-client) CA_NAME="frp-client-ca"; CA_CN="web-terminal frp-client CA"; CA_OU="frp-client-ca"
|
||||
CA_DIR="${CA_DIR:-/etc/relay/frp-client-ca}" ;;
|
||||
*) echo "FATAL: KIND must be 'device' or 'frp-client' (got '${KIND}')." >&2; exit 2 ;;
|
||||
esac
|
||||
|
||||
command -v openssl >/dev/null 2>&1 || { echo "FATAL: openssl not found on PATH." >&2; exit 3; }
|
||||
|
||||
umask 077
|
||||
mkdir -p "${CA_DIR}/newcerts"
|
||||
# Resolve to an absolute path so `openssl ca` (which we run cd'd into CA_DIR with dir=.) is stable.
|
||||
CA_DIR="$(cd "${CA_DIR}" && pwd)"
|
||||
|
||||
KEY="${CA_DIR}/${CA_NAME}.key.pem"
|
||||
CERT="${CA_DIR}/${CA_NAME}.cert.pem"
|
||||
|
||||
echo "== Device/frp-client CA (${KIND}, PRIVATE — not Let's Encrypt) into ${CA_DIR} =="
|
||||
|
||||
# ---- 1. CA keypair + self-signed cert (P-256, CA:TRUE, keyCertSign+cRLSign) -----------------------
|
||||
if [[ -f "${KEY}" && -f "${CERT}" ]]; then
|
||||
echo ">> CA already exists — reusing (delete ${CA_DIR} to rotate)."
|
||||
else
|
||||
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out "${KEY}"
|
||||
openssl req -x509 -new -key "${KEY}" -days "${CA_DAYS}" \
|
||||
-subj "/O=web-terminal-relay/OU=${CA_OU}/CN=${CA_CN}" \
|
||||
-addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
|
||||
-addext "keyUsage=critical,keyCertSign,cRLSign" \
|
||||
-addext "subjectKeyIdentifier=hash" \
|
||||
-out "${CERT}"
|
||||
fi
|
||||
|
||||
# ---- 2. OpenSSL `ca` database (so leaves are tracked → revocable via the CRL) ----------------------
|
||||
[[ -f "${CA_DIR}/index.txt" ]] || : > "${CA_DIR}/index.txt"
|
||||
[[ -f "${CA_DIR}/serial" ]] || echo 1000 > "${CA_DIR}/serial"
|
||||
[[ -f "${CA_DIR}/crlnumber" ]] || echo 1000 > "${CA_DIR}/crlnumber"
|
||||
# unique_subject=no allows re-issuing a leaf for the same CN (device/host cert rotation).
|
||||
[[ -f "${CA_DIR}/index.txt.attr" ]] || echo "unique_subject = no" > "${CA_DIR}/index.txt.attr"
|
||||
|
||||
if [[ ! -f "${CA_DIR}/openssl.cnf" ]]; then
|
||||
# dir = . → the issue/revoke scripts `cd` into CA_DIR before invoking `openssl ca`, so the db is
|
||||
# relocatable (works in a mktemp test dir). $dir is expanded by openssl; ${CA_NAME} by bash here.
|
||||
cat > "${CA_DIR}/openssl.cnf" <<EOF
|
||||
[ ca ]
|
||||
default_ca = CA_default
|
||||
|
||||
[ CA_default ]
|
||||
dir = .
|
||||
database = \$dir/index.txt
|
||||
serial = \$dir/serial
|
||||
new_certs_dir = \$dir/newcerts
|
||||
certificate = \$dir/${CA_NAME}.cert.pem
|
||||
private_key = \$dir/${CA_NAME}.key.pem
|
||||
crlnumber = \$dir/crlnumber
|
||||
crl = \$dir/crl.pem
|
||||
default_md = sha256
|
||||
default_days = 825
|
||||
default_crl_days = 30
|
||||
policy = policy_anything
|
||||
copy_extensions = none
|
||||
x509_extensions = client_cert
|
||||
crl_extensions = crl_ext
|
||||
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
# Leaf profile: client-authentication ONLY (never serverAuth, never CA).
|
||||
[ client_cert ]
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, digitalSignature
|
||||
extendedKeyUsage = clientAuth
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
|
||||
[ crl_ext ]
|
||||
authorityKeyIdentifier = keyid:always
|
||||
EOF
|
||||
fi
|
||||
|
||||
# ---- 3. Empty CRL now (V4 `ssl_crl` needs the file to exist even with zero revocations) ------------
|
||||
if [[ ! -f "${CA_DIR}/crl.pem" ]]; then
|
||||
( cd "${CA_DIR}" && openssl ca -config openssl.cnf -gencrl -out crl.pem >/dev/null 2>&1 )
|
||||
fi
|
||||
|
||||
# ---- 4. Permissions + summary ---------------------------------------------------------------------
|
||||
chmod 700 "${CA_DIR}"
|
||||
chmod 600 "${KEY}"
|
||||
chmod 644 "${CERT}" "${CA_DIR}/crl.pem"
|
||||
|
||||
cat <<SUMMARY
|
||||
|
||||
${KIND} CA ready in ${CA_DIR}:
|
||||
CA cert = ${CERT} (0644 — the trust anchor to deploy)
|
||||
CA key = ${KEY} (0600 — NEVER commit / NEVER leave a shared host)
|
||||
CRL = ${CA_DIR}/crl.pem (empty; regenerated by revoke-device.sh)
|
||||
ca db = index.txt / serial / crlnumber / newcerts / openssl.cnf
|
||||
|
||||
Wire it:
|
||||
device → nginx :8470 ssl_client_certificate ${CERT} ; ssl_crl ${CA_DIR}/crl.pem ;
|
||||
frp-client → frps.toml transport.tls.trustedCaFile = ${CERT}
|
||||
|
||||
Next:
|
||||
issue a leaf : CA_DIR=${CA_DIR} bash deploy/scripts/issue-device-cert.sh <CN> <out-dir>
|
||||
revoke a leaf : CA_DIR=${CA_DIR} bash deploy/scripts/revoke-device.sh <leaf.cert.pem>
|
||||
SUMMARY
|
||||
Reference in New Issue
Block a user