create-ca.sh

#!/usr/bin/bash -e
function help() {
    echo -e "Usage: ${0##*/} [OPTION]...\nCreate a CA certificate.\nExample: ${0##*/} -a \$(date --date='300 days' +%Y%m%d%H%M%SZ) -f\n\n  -a  set not after date\n  -b  set not before date\n  -f  recreate if the CA already exists\n  -h  display this help text and exit\n  -n  select ec curve name (list available via \`openssl ecparam -list_curves\`)"
    exit "$1"
}

while getopts "a:b:fhn:" OPT; do
  case "$OPT" in
    a) NOT_AFTER="$OPTARG" ;;
    b) NOT_BEFORE="$OPTARG" ;;
    f) FORCE=1 ;;
    n) NAME="$OPTARG" ;;
    *) help 0 ;;
  esac
done

cd "$(realpath "$(dirname "$0")")"

if [ -z "$NOT_AFTER" ]; then
    NOT_AFTER="$(date --date="3650 days" +%Y%m%d%H%M%SZ)"
fi
if [ -z "$NOT_BEFORE" ]; then
    NOT_BEFORE="$(date +%Y%m%d%H%M%SZ)"
fi
if [ -z "$NAME" ]; then
    NAME='secp384r1'
fi

if [[ -f 'cacert.pem' && "$FORCE" != '1' ]]; then
    echo -e 'The CA is already created, use `-f` to confirm recreate. \nNote that all data related to the current CA will be cleared if you do that.'
    exit 1
fi

find . -type f \( \
    -path '*/certs/*' -or \
    -path '*/crl/*' -or \
    -path '*/newcerts/*' -or \
    -path '*/private/*' \) -not \
    -name '.gitkeep' \
    -exec rm -fr {} \;
rm -fr cacert.pem index.txt* serial*

echo "01" > serial
touch index.txt index.txt.attr
openssl ecparam -genkey -name "$NAME" -out private/cakey.pem
openssl req -new -x509 -key private/cakey.pem -config openssl-ca.cnf -extensions v3_ca -not_after "$NOT_AFTER" -not_before "$NOT_BEFORE" -out cacert.pem