CA="/etc/openssl/CAcert.pem"

CAkey="/etc/openssl/CAkey.pem"

OUTDIR="/etc/openssl/clientcert/"

CN="client"

BITS=2048

DAYS=365

#Создаём секретный ключ во временной папке БЕЗ шифрования

TMP="/tmp/ssl-$$"

mkdir $TMP

if [ ! -d $OUTDIR ];then

    mkdir $OUTDIR

fi

pushd $TMP > /dev/null

$GENRSA -rand $RAND -out tmp.key $BITS

# Создаём конфиг для клиента

cat > cfg <<EOT

[ req ]

default_bits                   = $BITS

distinguished_name             = req_DN

extensions                     = v3_req

[ req_DN ]

countryName                    = "1. Country Name             (2 letter code)"

countryName_default            = "$C"

countryName_min                = 2

countryName_max                = 2

stateOrProvinceName            = "2. State or Province Name   (full name)    "

stateOrProvinceName_default    = "$ST"

localityName                   = "3. Locality Name            (eg, city)     "

localityName_default           = "$L"

0.organizationName             = "4. Organization Name        (eg, company)  "