|
| 1 | +#!/usr/bin/env bash |
| 2 | +# ============================================================================= |
| 3 | +# BESSAI Edge Gateway — OT PKI Certificate Generator |
| 4 | +# IEC 62443-3-3 SR 3.1: Communication Integrity via mutual TLS |
| 5 | +# GAP-003 REMEDIATION |
| 6 | +# ============================================================================= |
| 7 | +# Usage: |
| 8 | +# bash infrastructure/certs/gen_certs.sh |
| 9 | +# |
| 10 | +# Output (in infrastructure/certs/): |
| 11 | +# ca.key — CA private key (SECRET — never commit) |
| 12 | +# ca.crt — CA root certificate (safe to commit) |
| 13 | +# gateway-client.key — Gateway private key (SECRET — never commit) |
| 14 | +# gateway-client.crt — Gateway certificate (safe to commit) |
| 15 | +# gateway-client.csr — CSR (intermediate) (safe to commit/discard) |
| 16 | +# modbus-proxy.key — Proxy private key (SECRET — never commit) |
| 17 | +# modbus-proxy.crt — Proxy certificate (safe to commit) |
| 18 | +# modbus-proxy.csr — CSR (intermediate) (safe to commit/discard) |
| 19 | +# |
| 20 | +# Requirements: openssl (ships with Git for Windows / WSL / macOS / Linux) |
| 21 | +# ============================================================================= |
| 22 | + |
| 23 | +set -euo pipefail |
| 24 | + |
| 25 | +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" |
| 26 | +OUT_DIR="$SCRIPT_DIR" |
| 27 | + |
| 28 | +# Certificate validity — 10 years (edge devices have infrequent rotations) |
| 29 | +VALIDITY_DAYS=3650 |
| 30 | + |
| 31 | +# Organization info (customize per deployment) |
| 32 | +COUNTRY="${BESSAI_CERT_COUNTRY:-CL}" |
| 33 | +ORG="${BESSAI_CERT_ORG:-BESSAI-Solutions}" |
| 34 | +SITE_ID="${BESSAI_SITE_ID:-edge-001}" |
| 35 | + |
| 36 | +echo "════════════════════════════════════════════════════" |
| 37 | +echo " BESSAI OT PKI Generator — IEC 62443 GAP-003" |
| 38 | +echo " Site: ${SITE_ID} | Org: ${ORG}" |
| 39 | +echo "════════════════════════════════════════════════════" |
| 40 | + |
| 41 | +# ── 1. CA Root (BESSAI-OT-CA) ───────────────────────────────────────────────── |
| 42 | +echo "" |
| 43 | +echo "[1/3] Generating BESSAI-OT-CA root certificate..." |
| 44 | + |
| 45 | +openssl genrsa -out "${OUT_DIR}/ca.key" 4096 2>/dev/null |
| 46 | + |
| 47 | +openssl req -new -x509 \ |
| 48 | + -key "${OUT_DIR}/ca.key" \ |
| 49 | + -out "${OUT_DIR}/ca.crt" \ |
| 50 | + -days "${VALIDITY_DAYS}" \ |
| 51 | + -subj "/C=${COUNTRY}/O=${ORG}/CN=BESSAI-OT-CA-${SITE_ID}" \ |
| 52 | + -addext "basicConstraints=critical,CA:TRUE,pathlen:0" \ |
| 53 | + -addext "keyUsage=critical,keyCertSign,cRLSign" |
| 54 | + |
| 55 | +echo " ✅ CA: ${OUT_DIR}/ca.crt" |
| 56 | + |
| 57 | +# ── 2. Gateway Client Certificate ───────────────────────────────────────────── |
| 58 | +echo "" |
| 59 | +echo "[2/3] Generating gateway client certificate..." |
| 60 | + |
| 61 | +openssl genrsa -out "${OUT_DIR}/gateway-client.key" 2048 2>/dev/null |
| 62 | + |
| 63 | +openssl req -new \ |
| 64 | + -key "${OUT_DIR}/gateway-client.key" \ |
| 65 | + -out "${OUT_DIR}/gateway-client.csr" \ |
| 66 | + -subj "/C=${COUNTRY}/O=${ORG}/CN=bessai-gateway-${SITE_ID}" |
| 67 | + |
| 68 | +openssl x509 -req \ |
| 69 | + -in "${OUT_DIR}/gateway-client.csr" \ |
| 70 | + -CA "${OUT_DIR}/ca.crt" \ |
| 71 | + -CAkey "${OUT_DIR}/ca.key" \ |
| 72 | + -CAcreateserial \ |
| 73 | + -out "${OUT_DIR}/gateway-client.crt" \ |
| 74 | + -days "${VALIDITY_DAYS}" \ |
| 75 | + -extfile <(printf "extendedKeyUsage=clientAuth\nsubjectAltName=DNS:bessai-gateway,DNS:localhost") \ |
| 76 | + 2>/dev/null |
| 77 | + |
| 78 | +echo " ✅ Gateway client cert: ${OUT_DIR}/gateway-client.crt" |
| 79 | + |
| 80 | +# ── 3. Modbus Proxy (stunnel) Server Certificate ────────────────────────────── |
| 81 | +echo "" |
| 82 | +echo "[3/3] Generating modbus-proxy (stunnel) server certificate..." |
| 83 | + |
| 84 | +openssl genrsa -out "${OUT_DIR}/modbus-proxy.key" 2048 2>/dev/null |
| 85 | + |
| 86 | +openssl req -new \ |
| 87 | + -key "${OUT_DIR}/modbus-proxy.key" \ |
| 88 | + -out "${OUT_DIR}/modbus-proxy.csr" \ |
| 89 | + -subj "/C=${COUNTRY}/O=${ORG}/CN=bessai-modbus-proxy-${SITE_ID}" |
| 90 | + |
| 91 | +openssl x509 -req \ |
| 92 | + -in "${OUT_DIR}/modbus-proxy.csr" \ |
| 93 | + -CA "${OUT_DIR}/ca.crt" \ |
| 94 | + -CAkey "${OUT_DIR}/ca.key" \ |
| 95 | + -CAcreateserial \ |
| 96 | + -out "${OUT_DIR}/modbus-proxy.crt" \ |
| 97 | + -days "${VALIDITY_DAYS}" \ |
| 98 | + -extfile <(printf "extendedKeyUsage=serverAuth\nsubjectAltName=DNS:bessai-stunnel,DNS:localhost") \ |
| 99 | + 2>/dev/null |
| 100 | + |
| 101 | +echo " ✅ Proxy server cert: ${OUT_DIR}/modbus-proxy.crt" |
| 102 | + |
| 103 | +# ── Summary ─────────────────────────────────────────────────────────────────── |
| 104 | +echo "" |
| 105 | +echo "════════════════════════════════════════════════════" |
| 106 | +echo " PKI generation complete." |
| 107 | +echo "" |
| 108 | +echo " Certificates generated in: ${OUT_DIR}" |
| 109 | +echo "" |
| 110 | +echo " ⚠️ PRIVATE KEYS — DO NOT COMMIT:" |
| 111 | +echo " ca.key gateway-client.key modbus-proxy.key" |
| 112 | +echo "" |
| 113 | +echo " Next steps:" |
| 114 | +echo " 1. docker compose --profile ot-security up -d" |
| 115 | +echo " 2. Set in .env:" |
| 116 | +echo " OT_MTLS_ENABLED=true" |
| 117 | +echo " OT_CA_CERT_PATH=infrastructure/certs/ca.crt" |
| 118 | +echo " OT_CLIENT_CERT_PATH=infrastructure/certs/gateway-client.crt" |
| 119 | +echo " OT_CLIENT_KEY_PATH=infrastructure/certs/gateway-client.key" |
| 120 | +echo "════════════════════════════════════════════════════" |
0 commit comments