Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Automate CSR (Certificate Signing Request) via Java Keytool with Batch and VBscript

Posted on 2013-06-12
7
Medium Priority
?
1,795 Views
Last Modified: 2013-06-12
Hi Experts!

I have a script we use to generate a CSR which is currently used manually. I'd like to be able to run this script remotely via sys management tools and use sort of an 'answer' file for info required to generate the CSR.

I guess I have a few questions.. one, can I simply use batch for all of this and what is the syntax for reading a "file.txt" and plugging in the answers.. two, is it possible to use VBscript to plug the answers in via file.txt and can you provide a sample of this either way?

Or is there a completely different approach I should be taking?

The file.txt would exist in the same directory and it's content would simply read something like this:

website.com
IT dept.
Miami
FL
US
yes



Here's what I have so far....

Title Generate CSR
@ECHO Off
Set X64_SYS="C:\Program Files (x86)"
Set SSL_DIR="C:\SSL"
Set SSL_BK_DIR=C:\SSL\BKup
Set KEY_STORE=New.keystore

REM Fetch the path of the Java installation and set as variable

IF EXIST %X64_SYS% (
	for /f "tokens=2*" %%a in ('reg.exe query "HKLM\SOFTWARE\Wow6432Node\Java" /v "Path" ^| find /i "Path"') do set JAVA_HOME=%%b
) ELSE (
	for /f "tokens=2*" %%a in ('reg.exe query "HKLM\SOFTWARE\Java" /v "Path" ^| find /i "Path"') do set JAVA_HOME=%%b
)

Set KTOOL="%JAVA_HOME%\bin\keytool.exe"

REM Create dated working directory

echo > dateFile.txt
set DATEFILE=dateFile.txt
date /t >> %DATEFILE%
for /f "usebackq tokens=2-4 delims=^/ " %%p in (%DATEFILE%) do set THEDAY=%%r%%p%%q
del %DATEFILE%
mkdir %SSL_DIR%
mkdir %SSL_BK_DIR%
cd %SSL_DIR%
ECHO :
ECHO :::::::::::::::::::::::::::::::::::::::::::
ECHO :          
ECHO :     Please use caution while
ECHO :
ECHO :     entering SSL certificate details:
ECHO :
ECHO :  EXAMPLE:
ECHO :
ECHO :  First and Last Name:	        Website.com
ECHO :
ECHO :  Organization Unit:		IT Department
ECHO :
ECHO :  City or Locality:			City
ECHO :
ECHO :  State or Province:		State
ECHO :
ECHO :  Country Code:			US
ECHO :
ECHO :  Is this information Correct?:  yes
ECHO :
ECHO :::::::::::::::::::::::::::::::::::::::::::
ECHO :
ECHO :
%KTOOL% -genkey -keyalg RSA -keysize 2048 -keystore %SSL_DIR%\%KEY_STORE% -alias tomcat
ECHO :
ECHO :::::::::::::::::::::::::::::::::::::::::::
ECHO :          
ECHO :      !!!  Verify All Certs Exist  !!!
ECHO :
ECHO :::::::::::::::::::::::::::::::::::::::::::
ECHO :
ECHO :
pause
%KTOOL% -list -keystore %SSL_DIR%\%KEY_STORE%
ECHO :
ECHO :
ECHO :::::::::::::::::::::::::::::::::::::::::::
ECHO :          
ECHO :      !!!  Verify All Certs Exist  !!!
ECHO :
ECHO :::::::::::::::::::::::::::::::::::::::::::
ECHO :
ECHO :
pause
ECHO :
ECHO :
ECHO :::::::::::::::::::::::::::::::::::::::::::
ECHO :          
ECHO :    Provide Password to export CSR
ECHO :
ECHO :::::::::::::::::::::::::::::::::::::::::::
ECHO :
ECHO :
%KTOOL% -certreq -keyalg RSA -file %SSL_DIR%\New-CSR-%THEDAY%.csr -keystore %SSL_DIR%\%KEY_STORE% -alias tomcat
copy %SSL_DIR%\%KEY_STORE% %SSL_BK_DIR%\CSR-EXPORTED-%THEDAY%.Keystore
copy %SSL_DIR%\New-CSR-%THEDAY%.csr %SSL_BK_DIR%\New-CSR-%THEDAY%.csr
ECHO :
ECHO :
ECHO :::::::::::::::::::::::::::::::::::::::::::
ECHO :
ECHO :      Successfully Exported CSR to %SSL_DIR%
ECHO :
ECHO :::::::::::::::::::::::::::::::::::::::::::
ECHO :
ECHO :
ECHO :
pause

Open in new window

0
Comment
Question by:zequestioner
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 2
7 Comments
 
LVL 1

Author Comment

by:zequestioner
ID: 39242125
To test this you can simply create the folder C:\SSL and create a file called New.keystore in it. Set your variable manually for the java keytool and REM out the section that fetches it from the registry.
0
 
LVL 5

Accepted Solution

by:
DOSLover earned 2000 total points
ID: 39242569
To answer your first question, yes, you can use input redirection to pass values to the command (keytool) as follows. Assume you have prompt values in a file called, file.txt. Please note password is also a prompt and needs to enetered twice to confirm. The first two values in your file.txt will be passwords. You can save prompt values separately for creating certificate request, in file2.txt
Then your keytool commands will be:
%KTOOL% -genkey -keyalg RSA -keysize 2048 -keystore %SSL_DIR%\%KEY_STORE% -alias tomcat  < file.txt

%KTOOL% -certreq -keyalg RSA -file %SSL_DIR%\New-CSR-%THEDAY%.csr -keystore %SSL_DIR%\%KEY_STORE% -alias tomcat < file2.txt

Open in new window

0
 
LVL 1

Author Comment

by:zequestioner
ID: 39242661
Sweet! That worked like a charm, but I have a question... why do the first '2' lines have to be the password? When you run the command manually, it only prompts once for the pw.... so I'm wondering why the answer file needs it on both lines?
0
Build and deliver software with DevOps

A digital transformation requires faster time to market, shorter software development lifecycles, and the ability to adapt rapidly to changing customer demands. DevOps provides the solution.

 
LVL 5

Expert Comment

by:DOSLover
ID: 39242725
I think it prompts once for the pwd and then the next prompt is 'Re-enter new password' to confirm.
0
 
LVL 1

Author Comment

by:zequestioner
ID: 39243170
But there shouldn't be a 'new' password in the beginning... again, running the command manually, it only asks for a pw once to get into the keystore... but whats weird is that if I don't list the pw twice (first two lines of file.txt) then it doesn't work....
0
 
LVL 1

Author Comment

by:zequestioner
ID: 39243171
I wonder why it's different from running it manually?
0
 
LVL 1

Author Comment

by:zequestioner
ID: 39243207
I think i answered my own question... the reason is that the answer file (file.txt) was missing a line for the company name (O after OU) and was taking the 2nd pw as the first prompt after the pw... i figured this out by removing the @echo off... works great... and now the pw is only needed once on the first line.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Computer science students often experience many of the same frustrations when going through their engineering courses. This article presents seven tips I found useful when completing a bachelors and masters degree in computing which I believe may he…
What do responsible coders do? They don't take detrimental shortcuts. They do take reasonable security precautions, create important automation, implement sufficient logging, fix things they break, and care about users.
With the power of JIRA, there's an unlimited number of ways you can customize it, use it and benefit from it. With that in mind, there's bound to be things that I wasn't able to cover in this course. With this summary we'll look at some places to go…
Starting up a Project

670 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question