Initial commit: Certificate management tools

- cert-manager.py: Interactive certificate lifecycle management
- generate-csr.sh: Generate CSR on remote host
- sign-cert.sh: Sign certificate with UCS CA
- README.md: Complete documentation
- .gitignore: Ignore certificate and config files

Features:
- Interactive prompts with default values
- Config persistence between runs
- Remote CSR generation with proper server extensions
- Automated CA signing
- Optional certificate deployment

sign-cert.sh

@@ -0,0 +1,87 @@
+#!/bin/bash
+# Script to sign a certificate request with UCS CA
+# Usage: ./sign-cert.sh <req-file> <hostname> [days]
+
+set -e
+
+# Configuration
+UCS_SERVER="10.0.0.21"
+UCS_USER="root"
+DEFAULT_DAYS=3650
+
+# Check arguments
+if [ $# -lt 2 ]; then
+    echo "Usage: $0 <req-file> <hostname> [days]"
+    echo ""
+    echo "Example: $0 webui.req myserver 3650"
+    echo ""
+    echo "The script will:"
+    echo "  1. Copy the CSR to UCS server"
+    echo "  2. Sign it with the UCS CA"
+    echo "  3. Download the signed certificate to current directory"
+    exit 1
+fi
+
+REQ_FILE="$1"
+HOSTNAME="$2"
+DAYS="${3:-$DEFAULT_DAYS}"
+
+# Validate req file exists
+if [ ! -f "$REQ_FILE" ]; then
+    echo "Error: Certificate request file '$REQ_FILE' not found!"
+    exit 1
+fi
+
+# Get absolute path of req file
+REQ_FILE=$(realpath "$REQ_FILE")
+OUTPUT_FILE="${HOSTNAME}-cert.pem"
+
+echo "=========================================="
+echo "UCS Certificate Signing Script"
+echo "=========================================="
+echo "Request file: $REQ_FILE"
+echo "Hostname:     $HOSTNAME"
+echo "Valid days:   $DAYS"
+echo "Output file:  $OUTPUT_FILE"
+echo "=========================================="
+echo ""
+
+# Step 1: Copy CSR to UCS server
+echo "[1/3] Copying CSR to UCS server..."
+scp "$REQ_FILE" ${UCS_USER}@${UCS_SERVER}:/tmp/${HOSTNAME}.csr
+if [ $? -ne 0 ]; then
+    echo "Error: Failed to copy CSR to UCS server"
+    exit 1
+fi
+
+# Step 2: Sign the certificate
+echo "[2/3] Signing certificate on UCS server..."
+ssh ${UCS_USER}@${UCS_SERVER} "univention-certificate sign -request /tmp/${HOSTNAME}.csr -name ${HOSTNAME} -days ${DAYS}"
+if [ $? -ne 0 ]; then
+    echo "Error: Failed to sign certificate"
+    exit 1
+fi
+
+# Step 3: Download signed certificate
+echo "[3/3] Downloading signed certificate..."
+scp ${UCS_USER}@${UCS_SERVER}:/etc/univention/ssl/${HOSTNAME}/cert.pem "$OUTPUT_FILE"
+if [ $? -ne 0 ]; then
+    echo "Error: Failed to download signed certificate"
+    exit 1
+fi
+
+echo ""
+echo "=========================================="
+echo "✓ Certificate signed successfully!"
+echo "=========================================="
+echo "Certificate saved to: $OUTPUT_FILE"
+echo ""
+echo "Certificate details:"
+openssl x509 -in "$OUTPUT_FILE" -noout -subject -issuer -dates
+echo ""
+echo "Subject Alternative Names:"
+openssl x509 -in "$OUTPUT_FILE" -noout -text | grep -A 1 "Subject Alternative Name" | tail -1
+echo ""
+echo "Extended Key Usage:"
+openssl x509 -in "$OUTPUT_FILE" -noout -text | grep -A 1 "Extended Key Usage" | tail -1
+echo "=========================================="