0

I don't really trust the guy and i'm trying to take my time to learn everything about it, but what do you guys think?

generate_ssl.sh

#!/bin/bash

name=ourwebdomain.local
openssl req \
  -new \
  -newkey rsa:2048 \
  -sha256 \
  -days 3650 \
  -nodes \
  -x509 \
  -keyout $name.key \
  -out $name.crt \
  -config <(cat <<-EOF
  [req]
  distinguished_name = req_distinguished_name
  x509_extensions = v3_req
  prompt = no
  [req_distinguished_name]
  CN = $name
  [v3_req]
  keyUsage = keyEncipherment, dataEncipherment
  extendedKeyUsage = serverAuth
  subjectAltName = @alt_names
  [alt_names]
  DNS.1 = $name
  DNS.2 = *.$name
EOF

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ourwebsitdomain.local.crt

This was accompanied by two other files, so here

file ./*
generate_ssl:          ASCII text
ourdomain.local.crt: PEM certificate
ourdomain.local.key: ASCII text

I'm not that worried i'm more curious. oh then he added this file to our github repo a bit ago, he's just been acting very weird recently and i'd like to Understand what he's doing.

mynaems-MacBook-Pro% file dump.rdb
dump.rdb: data
myname-MacBook-Pro% ls -lh | grep rdb

-rwxr--r-- 1 myname staff 92B Aug 29 22:44 dump.rdb

  • In my opinion this question is missing relevant context (and thus is too broad). I doubt that the other developer just posted the code and asked all to run it without giving an explanation what it is supposed to do and why all should install it, i.e. what is the goal or what problem gets solved by this. If you have problems understanding the information of your coworker then please provide these information and show what exactly you don't understand. If just the command was provided without any kind of information then please ask the developer for an explanation. – Steffen Ullrich Sep 1 '19 at 13:52
  • unfortunately, we cannot do malicious code review – schroeder Sep 1 '19 at 14:42
2

The openssl req command creates a self-signed certificate, then the sudo security add-trusted-cert command adds the newly created self-signed certificate to your local store of trusted certificates.

Are you running a local web server on the host that your doing this on, and using this host to develop and/or test an application with the local web server? If so, this would explain why your coworker is asking you to do this.

0

This creates a new certificate for ourwebsitdomain.local and *.ourwebsitdomain.local, marking it as trusted on MacOS.

That would allow someone holding such certificate to impersonate a website there. However, since you are running it locally, you are the one having that private key, so this seems to only be useful if you also were to use that certificate on a website published on that domain (maybe you would locally develop at jensen.ourwebsitdomain.local ?).

Not the answer you're looking for? Browse other questions tagged or ask your own question.