generate-certs

#!/bin/sh

set -e -x

# Install certstrap
go get -v github.com/square/certstrap

# Place keys and certificates here
depot_path="etcd-certs"
mkdir -p ${depot_path}

# CA to distribute to etcd clients and servers
certstrap --depot-path ${depot_path} init --passphrase '' --common-name etcdCA
mv -f ${depot_path}/etcdCA.crt ${depot_path}/etcd-ca.crt
mv -f ${depot_path}/etcdCA.key ${depot_path}/etcd-ca.key

# Server certificate to share across the etcd cluster
certstrap --depot-path ${depot_path} request-cert --passphrase '' --common-name etcd.service.consul --domain '*.etcd.service.consul,etcd.service.consul'
certstrap --depot-path ${depot_path} sign etcd.service.consul --CA etcd-ca
mv -f ${depot_path}/etcd.service.consul.key ${depot_path}/server.key
mv -f ${depot_path}/etcd.service.consul.csr ${depot_path}/server.csr
mv -f ${depot_path}/etcd.service.consul.crt ${depot_path}/server.crt

# Client certificate to distribute to jobs that access etcd
certstrap --depot-path ${depot_path} request-cert --passphrase '' --common-name 'clientName'
certstrap --depot-path ${depot_path} sign clientName --CA etcd-ca
mv -f ${depot_path}/clientName.key ${depot_path}/client.key
mv -f ${depot_path}/clientName.csr ${depot_path}/client.csr
mv -f ${depot_path}/clientName.crt ${depot_path}/client.crt

# CA to distribute across etcd peers
certstrap --depot-path ${depot_path} init --passphrase '' --common-name peerCA
mv -f ${depot_path}/peerCA.crt ${depot_path}/peer-ca.crt
mv -f ${depot_path}/peerCA.key ${depot_path}/peer-ca.key

# Client certificate to distribute across etcd peers
certstrap --depot-path ${depot_path} request-cert --passphrase '' --common-name etcd.service.consul --domain '*.etcd.service.consul,etcd.service.consul'
certstrap --depot-path ${depot_path} sign etcd.service.consul --CA peer-ca
mv -f ${depot_path}/etcd.service.consul.key ${depot_path}/peer.key
mv -f ${depot_path}/etcd.service.consul.csr ${depot_path}/peer.csr
mv -f ${depot_path}/etcd.service.consul.crt ${depot_path}/peer.crt