diff --git a/certificates/MyPrivateCA.crl b/certificates/MyPrivateCA.crl new file mode 100644 index 0000000..dc61e28 --- /dev/null +++ b/certificates/MyPrivateCA.crl @@ -0,0 +1,18 @@ +-----BEGIN X509 CRL----- +MIIC1DCBvQIBATANBgkqhkiG9w0BAQsFADBRMQswCQYDVQQGEwJVSzEOMAwGA1UE +CAwFbGVlZHMxDjAMBgNVBAcMBWxlZWRzMREwDwYDVQQKDAhnZWVyYWVydDEPMA0G +A1UEAwwGcGllcnJlFw0yNjAzMTkyMzMzNDBaFw0zNjAzMTYyMzMzNDBaMCcwJQIU +czJzV+tMQcYuS3cIV70ViSOden0XDTI2MDMxOTIzMjUyOFqgDzANMAsGA1UdFAQE +AgIQAjANBgkqhkiG9w0BAQsFAAOCAgEAhdChD4AO0wRTLs8qlQOQT/q0uYHzV7dE +KLXLb4uwt1/nuYy9t60VtYqOzwWd8cXjIa0EiMtWg30Ve+CoGOLiI1XNKcigM/Hi +cNFyKte9/+yZvk+D/pJng85cj8eraH5TyO2f8u0FqFlRzTL4R215tXnpQ0MyxREq +McTt1vZ13ggvhXZhbz//e5i7kIMY6w9yN7+9oyeSOYIVt4MP2LKxMhTdT+9EwLxV +Tg8tIuZG3OeAzlDl5vHZifsoNfNOtASa8OzpD7RaHs4DaWmKUQbvX88E6fpsuwqK +5uusnpaSUsKtMGihQT8APXLuMMU7Zg+/i/GSMsh77sJeKFHe4Fmjdy4t2K7vplKq +ZHNz1EKh6uqjMnM4avoLRmN6hfcZKCKJMz/XaZmOm71+jb/Urh5hHNzJWiFQ1edU +L1qEhY9fpeDNKUoHZf2hiR7fAok+MNYjaqpS/s5ZqLfIY9v1kNVjSosGhucWSPER +g+8Wbd2aaLJz1TJDjBPKxQ/jMN6i9xkxZygR9IWBiyf26DMXRP/XlpXeROZcTWgk +4iVkdN+bhADKG2S4amyZCEK5Ze3sGmqwUMSpoHgBIiPXbpXlKoWopKx7lTl5Gvmi +qdmFzpsNperjbv4D6/ueA6Kh0+BQYaz1Rs6GTulZDyHvoL9kDgOZ/LAMqvkUDcSE +81/y3Eg8pNQ= +-----END X509 CRL----- diff --git a/certificates/crlnumber b/certificates/crlnumber new file mode 100644 index 0000000..baccd03 --- /dev/null +++ b/certificates/crlnumber @@ -0,0 +1 @@ +1003 diff --git a/certificates/crlnumber.old b/certificates/crlnumber.old new file mode 100644 index 0000000..7d802a3 --- /dev/null +++ b/certificates/crlnumber.old @@ -0,0 +1 @@ +1002 diff --git a/certificates/index.txt b/certificates/index.txt new file mode 100644 index 0000000..0a9e91a --- /dev/null +++ b/certificates/index.txt @@ -0,0 +1 @@ +R 270319224742Z 260319232528Z 73327357EB4C41C62E4B770857BD1589239D7A7D unknown /C=UK/ST=west-yorkshire/L=leeds/O=geeraert/CN=pierre diff --git a/certificates/index.txt.attr b/certificates/index.txt.attr new file mode 100644 index 0000000..8f7e63a --- /dev/null +++ b/certificates/index.txt.attr @@ -0,0 +1 @@ +unique_subject = yes diff --git a/certificates/index.txt.old b/certificates/index.txt.old new file mode 100644 index 0000000..e69de29 diff --git a/certificates/module.tf b/certificates/module.tf new file mode 100644 index 0000000..7eaf07d --- /dev/null +++ b/certificates/module.tf @@ -0,0 +1,112 @@ +variable "device_names" { + type = set(string) + default = [] +} + +# 1. Generate Private Keys for each device +resource "tls_private_key" "device_key" { + for_each = var.device_names + algorithm = "RSA" + rsa_bits = 2048 +} + +# 1. Save the private key temporarily (needed for the openssl command) +resource "local_sensitive_file" "tmp_key" { + for_each = var.device_names + content = tls_private_key.device_key[each.key].private_key_pem + filename = "${path.module}/output/${each.key}.key" +} + +# 2. Create Certificate Signing Requests (CSR) +resource "tls_cert_request" "device_csr" { + for_each = var.device_names + private_key_pem = tls_private_key.device_key[each.key].private_key_pem + + subject { + common_name = each.key + organization = "My Home Lab" + } +} + +# 3. Sign the Certificates using your existing CA +# Note: You need your CA cert and key available as files +resource "tls_locally_signed_cert" "device_cert" { + for_each = var.device_names + cert_request_pem = tls_cert_request.device_csr[each.key].cert_request_pem + ca_private_key_pem = file("${path.module}/MyPrivateCA.key") + ca_cert_pem = file("${path.module}/MyPrivateCA.crt") + + validity_period_hours = 8760 # 1 year + allowed_uses = [ + "client_auth", + "digital_signature", + ] +} + +# 4. EXPORT: Generate the .p12 and the CRL automatically +# This runs every time a cert is added OR removed +resource "null_resource" "manage_certs" { + triggers = { + devices = join(",", var.device_names) + } + + # When a cert is REMOVED from the list, Terraform marks it for destruction. + # We use a 'destroy' provisioner to trigger the revocation in your CRL. + provisioner "local-exec" { + when = destroy + command = <