5337281e85
Committable VPS artifacts for the native reverse-tunnel (no live-ops, no secrets):
- gen-device-ca.sh: EC P-256 self-signed device CA (CA:TRUE pathlen:0, keyCertSign+cRLSign),
openssl ca db + empty CRL, idempotent, --kind frp-client scaffolds the control-channel CA.
- issue-device-cert.sh: P-256 leaf, EKU=clientAuth only, 825d, emits .p12 (-legacy) + .pem/.key/.fullchain,
copy_extensions=none prevents CSR-injected serverAuth/CA:TRUE; CN traversal guard.
- revoke-device.sh: openssl ca revoke -> regenerate crl.pem (revocation enforced via -crl_check).
- frp/{frps.toml.example,frpc.example.toml}: control-channel mTLS+token, disableCustomTLSFirstByte=true.
- nginx/frp-mtls.conf: :8470 TLS-term, ssl_verify_client on + device-CA + ssl_crl, WS-upgrade proxy to :7080.
- nginx/stream-sni-additions.md: the two additive SNI map lines (merge-only, coexistence-safe).
Verified: gen->issue->openssl verify->revoke->CRL chain green in a tmp dir (OpenSSL 3.0.18).
164 lines
7.0 KiB
Bash
Executable File
164 lines
7.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# RELAY-PHASE1 · Native mTLS tunnel · V2 — Device client-CA (and frp-client control-CA).
|
|
#
|
|
# STAGING TEMPLATE. Mints a PRIVATE client-authentication CA whose leaves the native clients (iOS /
|
|
# Android / desktop) present at nginx :8470 (`ssl_verify_client on`). This CA is the ONE AND ONLY
|
|
# security gate for the tunnelled base app (the base app has no login of its own — PLAN §1), so it
|
|
# MUST be a SEPARATE trust root from Let's Encrypt (the public :8470 SERVER cert) and from the
|
|
# agent-enrollment CA (deploy/scripts/gen-agent-ca.sh). Mixing them would let a foreign leaf enroll.
|
|
#
|
|
# *** P-256 (prime256v1), NEVER Ed25519. *** nginx `ssl_verify_client` + iOS client-certificate
|
|
# selection require ECDSA-P256/RSA; Ed25519 client certs are not universally accepted (PLAN V2).
|
|
#
|
|
# Two KINDs (same structure, different name/subject/default dir):
|
|
# device → /etc/relay/device-ca (device-ca.cert.pem) leaves = client devices (V2/V4)
|
|
# frp-client → /etc/relay/frp-client-ca (frp-client-ca.cert.pem) leaves = per-host frpc control mTLS (V1/V1b)
|
|
#
|
|
# Produces an OpenSSL `ca` database (index.txt / serial / crlnumber / newcerts / openssl.cnf) so that
|
|
# deploy/scripts/issue-device-cert.sh can sign tracked leaves and deploy/scripts/revoke-device.sh can
|
|
# revoke by serial and regenerate the CRL. An EMPTY crl.pem is initialised NOW so V4's `ssl_crl` has a
|
|
# file to reference from day one.
|
|
#
|
|
# Outputs (0600 key, 0644 cert) under CA_DIR:
|
|
# <CA_NAME>.key.pem <CA_NAME>.cert.pem crl.pem
|
|
# index.txt serial crlnumber index.txt.attr newcerts/ openssl.cnf (the `openssl ca` db)
|
|
#
|
|
# Config via ENV or flags (no hardcoded secrets — this CA key is generated in place, never committed):
|
|
# KIND device | frp-client (default device) — or --kind <k>
|
|
# CA_DIR output dir (default per-KIND above) — or --dir <path>
|
|
# CA_DAYS CA lifetime in days (default 3650)
|
|
#
|
|
# Idempotent: an existing CA (key+cert) is REUSED, never overwritten (delete the dir to rotate).
|
|
#
|
|
# Verify (syntax): bash -n deploy/scripts/gen-device-ca.sh
|
|
set -euo pipefail
|
|
|
|
KIND="${KIND:-device}"
|
|
CA_DIR="${CA_DIR:-}"
|
|
CA_DAYS="${CA_DAYS:-3650}"
|
|
|
|
# ---- args (flags override env) --------------------------------------------------------------------
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--kind) KIND="${2:?--kind needs a value}"; shift 2 ;;
|
|
--dir) CA_DIR="${2:?--dir needs a value}"; shift 2 ;;
|
|
-h|--help)
|
|
grep '^#' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
|
|
*) echo "FATAL: unknown argument '$1' (see --help)" >&2; exit 2 ;;
|
|
esac
|
|
done
|
|
|
|
case "${KIND}" in
|
|
device) CA_NAME="device-ca"; CA_CN="web-terminal Device CA"; CA_OU="device-ca"
|
|
CA_DIR="${CA_DIR:-/etc/relay/device-ca}" ;;
|
|
frp-client) CA_NAME="frp-client-ca"; CA_CN="web-terminal frp-client CA"; CA_OU="frp-client-ca"
|
|
CA_DIR="${CA_DIR:-/etc/relay/frp-client-ca}" ;;
|
|
*) echo "FATAL: KIND must be 'device' or 'frp-client' (got '${KIND}')." >&2; exit 2 ;;
|
|
esac
|
|
|
|
command -v openssl >/dev/null 2>&1 || { echo "FATAL: openssl not found on PATH." >&2; exit 3; }
|
|
|
|
umask 077
|
|
mkdir -p "${CA_DIR}/newcerts"
|
|
# Resolve to an absolute path so `openssl ca` (which we run cd'd into CA_DIR with dir=.) is stable.
|
|
CA_DIR="$(cd "${CA_DIR}" && pwd)"
|
|
|
|
KEY="${CA_DIR}/${CA_NAME}.key.pem"
|
|
CERT="${CA_DIR}/${CA_NAME}.cert.pem"
|
|
|
|
echo "== Device/frp-client CA (${KIND}, PRIVATE — not Let's Encrypt) into ${CA_DIR} =="
|
|
|
|
# ---- 1. CA keypair + self-signed cert (P-256, CA:TRUE, keyCertSign+cRLSign) -----------------------
|
|
if [[ -f "${KEY}" && -f "${CERT}" ]]; then
|
|
echo ">> CA already exists — reusing (delete ${CA_DIR} to rotate)."
|
|
else
|
|
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out "${KEY}"
|
|
openssl req -x509 -new -key "${KEY}" -days "${CA_DAYS}" \
|
|
-subj "/O=web-terminal-relay/OU=${CA_OU}/CN=${CA_CN}" \
|
|
-addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
|
|
-addext "keyUsage=critical,keyCertSign,cRLSign" \
|
|
-addext "subjectKeyIdentifier=hash" \
|
|
-out "${CERT}"
|
|
fi
|
|
|
|
# ---- 2. OpenSSL `ca` database (so leaves are tracked → revocable via the CRL) ----------------------
|
|
[[ -f "${CA_DIR}/index.txt" ]] || : > "${CA_DIR}/index.txt"
|
|
[[ -f "${CA_DIR}/serial" ]] || echo 1000 > "${CA_DIR}/serial"
|
|
[[ -f "${CA_DIR}/crlnumber" ]] || echo 1000 > "${CA_DIR}/crlnumber"
|
|
# unique_subject=no allows re-issuing a leaf for the same CN (device/host cert rotation).
|
|
[[ -f "${CA_DIR}/index.txt.attr" ]] || echo "unique_subject = no" > "${CA_DIR}/index.txt.attr"
|
|
|
|
if [[ ! -f "${CA_DIR}/openssl.cnf" ]]; then
|
|
# dir = . → the issue/revoke scripts `cd` into CA_DIR before invoking `openssl ca`, so the db is
|
|
# relocatable (works in a mktemp test dir). $dir is expanded by openssl; ${CA_NAME} by bash here.
|
|
cat > "${CA_DIR}/openssl.cnf" <<EOF
|
|
[ ca ]
|
|
default_ca = CA_default
|
|
|
|
[ CA_default ]
|
|
dir = .
|
|
database = \$dir/index.txt
|
|
serial = \$dir/serial
|
|
new_certs_dir = \$dir/newcerts
|
|
certificate = \$dir/${CA_NAME}.cert.pem
|
|
private_key = \$dir/${CA_NAME}.key.pem
|
|
crlnumber = \$dir/crlnumber
|
|
crl = \$dir/crl.pem
|
|
default_md = sha256
|
|
default_days = 825
|
|
default_crl_days = 30
|
|
policy = policy_anything
|
|
copy_extensions = none
|
|
x509_extensions = client_cert
|
|
crl_extensions = crl_ext
|
|
|
|
[ policy_anything ]
|
|
countryName = optional
|
|
stateOrProvinceName = optional
|
|
localityName = optional
|
|
organizationName = optional
|
|
organizationalUnitName = optional
|
|
commonName = supplied
|
|
emailAddress = optional
|
|
|
|
# Leaf profile: client-authentication ONLY (never serverAuth, never CA).
|
|
[ client_cert ]
|
|
basicConstraints = critical, CA:FALSE
|
|
keyUsage = critical, digitalSignature
|
|
extendedKeyUsage = clientAuth
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid,issuer
|
|
|
|
[ crl_ext ]
|
|
authorityKeyIdentifier = keyid:always
|
|
EOF
|
|
fi
|
|
|
|
# ---- 3. Empty CRL now (V4 `ssl_crl` needs the file to exist even with zero revocations) ------------
|
|
if [[ ! -f "${CA_DIR}/crl.pem" ]]; then
|
|
( cd "${CA_DIR}" && openssl ca -config openssl.cnf -gencrl -out crl.pem >/dev/null 2>&1 )
|
|
fi
|
|
|
|
# ---- 4. Permissions + summary ---------------------------------------------------------------------
|
|
chmod 700 "${CA_DIR}"
|
|
chmod 600 "${KEY}"
|
|
chmod 644 "${CERT}" "${CA_DIR}/crl.pem"
|
|
|
|
cat <<SUMMARY
|
|
|
|
${KIND} CA ready in ${CA_DIR}:
|
|
CA cert = ${CERT} (0644 — the trust anchor to deploy)
|
|
CA key = ${KEY} (0600 — NEVER commit / NEVER leave a shared host)
|
|
CRL = ${CA_DIR}/crl.pem (empty; regenerated by revoke-device.sh)
|
|
ca db = index.txt / serial / crlnumber / newcerts / openssl.cnf
|
|
|
|
Wire it:
|
|
device → nginx :8470 ssl_client_certificate ${CERT} ; ssl_crl ${CA_DIR}/crl.pem ;
|
|
frp-client → frps.toml transport.tls.trustedCaFile = ${CERT}
|
|
|
|
Next:
|
|
issue a leaf : CA_DIR=${CA_DIR} bash deploy/scripts/issue-device-cert.sh <CN> <out-dir>
|
|
revoke a leaf : CA_DIR=${CA_DIR} bash deploy/scripts/revoke-device.sh <leaf.cert.pem>
|
|
SUMMARY
|