Annotation of embedaddon/axTLS/ssl/test/make_certs.sh, revision 1.1.1.1
1.1 misho 1: #!/bin/sh
2:
3: #
4: # Copyright (c) 2007, Cameron Rich
5: #
6: # All rights reserved.
7: #
8: # Redistribution and use in source and binary forms, with or without
9: # modification, are permitted provided that the following conditions are met:
10: #
11: # * Redistributions of source code must retain the above copyright notice,
12: # this list of conditions and the following disclaimer.
13: # * Redistributions in binary form must reproduce the above copyright
14: # notice, this list of conditions and the following disclaimer in the
15: # documentation and/or other materials provided with the distribution.
16: # * Neither the name of the axTLS project nor the names of its
17: # contributors may be used to endorse or promote products derived
18: # from this software without specific prior written permission.
19: #
20: # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21: # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22: # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
23: # A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
24: # CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25: # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
26: # TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27: # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
28: # OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
29: # NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30: # THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31: #
32:
33: #
34: # Generate the certificates and keys for testing.
35: #
36:
37: PROJECT_NAME="axTLS Project"
38:
39: # Generate the openssl configuration files.
40: cat > ca_cert.conf << EOF
41: [ req ]
42: distinguished_name = req_distinguished_name
43: prompt = no
44:
45: [ req_distinguished_name ]
46: O = $PROJECT_NAME Dodgy Certificate Authority
47: EOF
48:
49: cat > certs.conf << EOF
50: [ req ]
51: distinguished_name = req_distinguished_name
52: prompt = no
53:
54: [ req_distinguished_name ]
55: O = $PROJECT_NAME
56: CN = 127.0.0.1
57: EOF
58:
59: cat > device_cert.conf << EOF
60: [ req ]
61: distinguished_name = req_distinguished_name
62: prompt = no
63:
64: [ req_distinguished_name ]
65: O = $PROJECT_NAME Device Certificate
66: EOF
67:
68: # private key generation
69: openssl genrsa -out axTLS.ca_key.pem 1024
70: openssl genrsa -out axTLS.key_512.pem 512
71: openssl genrsa -out axTLS.key_1024.pem 1024
72: openssl genrsa -out axTLS.key_1042.pem 1042
73: openssl genrsa -out axTLS.key_2048.pem 2048
74: openssl genrsa -out axTLS.key_4096.pem 4096
75: openssl genrsa -out axTLS.device_key.pem 1024
76: openssl genrsa -aes128 -passout pass:abcd -out axTLS.key_aes128.pem 512
77: openssl genrsa -aes256 -passout pass:abcd -out axTLS.key_aes256.pem 512
78:
79:
80: # convert private keys into DER format
81: openssl rsa -in axTLS.key_512.pem -out axTLS.key_512 -outform DER
82: openssl rsa -in axTLS.key_1024.pem -out axTLS.key_1024 -outform DER
83: openssl rsa -in axTLS.key_1042.pem -out axTLS.key_1042 -outform DER
84: openssl rsa -in axTLS.key_2048.pem -out axTLS.key_2048 -outform DER
85: openssl rsa -in axTLS.key_4096.pem -out axTLS.key_4096 -outform DER
86: openssl rsa -in axTLS.device_key.pem -out axTLS.device_key -outform DER
87:
88: # cert requests
89: openssl req -out axTLS.ca_x509.req -key axTLS.ca_key.pem -new \
90: -config ./ca_cert.conf
91: openssl req -out axTLS.x509_512.req -key axTLS.key_512.pem -new \
92: -config ./certs.conf
93: openssl req -out axTLS.x509_1024.req -key axTLS.key_1024.pem -new \
94: -config ./certs.conf
95: openssl req -out axTLS.x509_1042.req -key axTLS.key_1042.pem -new \
96: -config ./certs.conf
97: openssl req -out axTLS.x509_2048.req -key axTLS.key_2048.pem -new \
98: -config ./certs.conf
99: openssl req -out axTLS.x509_4096.req -key axTLS.key_4096.pem -new \
100: -config ./certs.conf
101: openssl req -out axTLS.x509_device.req -key axTLS.device_key.pem -new \
102: -config ./device_cert.conf
103: openssl req -out axTLS.x509_aes128.req -key axTLS.key_aes128.pem \
104: -new -config ./certs.conf -passin pass:abcd
105: openssl req -out axTLS.x509_aes256.req -key axTLS.key_aes256.pem \
106: -new -config ./certs.conf -passin pass:abcd
107:
108: # generate the actual certs.
109: openssl x509 -req -in axTLS.ca_x509.req -out axTLS.ca_x509.pem \
110: -sha1 -days 5000 -signkey axTLS.ca_key.pem
111: openssl x509 -req -in axTLS.x509_512.req -out axTLS.x509_512.pem \
112: -sha1 -CAcreateserial -days 5000 \
113: -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
114: openssl x509 -req -in axTLS.x509_1024.req -out axTLS.x509_1024.pem \
115: -sha1 -CAcreateserial -days 5000 \
116: -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
117: openssl x509 -req -in axTLS.x509_1042.req -out axTLS.x509_1042.pem \
118: -sha1 -CAcreateserial -days 5000 \
119: -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
120: openssl x509 -req -in axTLS.x509_2048.req -out axTLS.x509_2048.pem \
121: -md5 -CAcreateserial -days 5000 \
122: -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
123: openssl x509 -req -in axTLS.x509_4096.req -out axTLS.x509_4096.pem \
124: -md5 -CAcreateserial -days 5000 \
125: -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
126: openssl x509 -req -in axTLS.x509_device.req -out axTLS.x509_device.pem \
127: -sha1 -CAcreateserial -days 5000 \
128: -CA axTLS.x509_512.pem -CAkey axTLS.key_512.pem
129: openssl x509 -req -in axTLS.x509_aes128.req \
130: -out axTLS.x509_aes128.pem \
131: -sha1 -CAcreateserial -days 5000 \
132: -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
133: openssl x509 -req -in axTLS.x509_aes256.req \
134: -out axTLS.x509_aes256.pem \
135: -sha1 -CAcreateserial -days 5000 \
136: -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
137:
138: # note: must be root to do this
139: DATE_NOW=`date`
140: if date -s "Jan 1 2025"; then
141: openssl x509 -req -in axTLS.x509_512.req -out axTLS.x509_bad_before.pem \
142: -sha1 -CAcreateserial -days 365 \
143: -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
144: date -s "$DATE_NOW"
145: touch axTLS.x509_bad_before.pem
146: fi
147: openssl x509 -req -in axTLS.x509_512.req -out axTLS.x509_bad_after.pem \
148: -sha1 -CAcreateserial -days -365 \
149: -CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
150:
151: # some cleanup
152: rm axTLS*.req
153: rm axTLS.srl
154: rm *.conf
155:
156: # need this for the client tests
157: openssl x509 -in axTLS.ca_x509.pem -outform DER -out axTLS.ca_x509.cer
158: openssl x509 -in axTLS.x509_512.pem -outform DER -out axTLS.x509_512.cer
159: openssl x509 -in axTLS.x509_1024.pem -outform DER -out axTLS.x509_1024.cer
160: openssl x509 -in axTLS.x509_1042.pem -outform DER -out axTLS.x509_1042.cer
161: openssl x509 -in axTLS.x509_2048.pem -outform DER -out axTLS.x509_2048.cer
162: openssl x509 -in axTLS.x509_4096.pem -outform DER -out axTLS.x509_4096.cer
163: openssl x509 -in axTLS.x509_device.pem -outform DER -out axTLS.x509_device.cer
164:
165: # generate pkcs8 files (use RC4-128 for encryption)
166: openssl pkcs8 -in axTLS.key_512.pem -passout pass:abcd -topk8 -v1 PBE-SHA1-RC4-128 -out axTLS.encrypted_pem.p8
167: openssl pkcs8 -in axTLS.key_512.pem -passout pass:abcd -topk8 -outform DER -v1 PBE-SHA1-RC4-128 -out axTLS.encrypted.p8
168: openssl pkcs8 -in axTLS.key_512.pem -nocrypt -topk8 -out axTLS.unencrypted_pem.p8
169: openssl pkcs8 -in axTLS.key_512.pem -nocrypt -topk8 -outform DER -out axTLS.unencrypted.p8
170:
171: # generate pkcs12 files (use RC4-128 for encryption)
172: openssl pkcs12 -export -in axTLS.x509_1024.pem -inkey axTLS.key_1024.pem -certfile axTLS.ca_x509.pem -keypbe PBE-SHA1-RC4-128 -certpbe PBE-SHA1-RC4-128 -name "p12_with_CA" -out axTLS.withCA.p12 -password pass:abcd
173: openssl pkcs12 -export -in axTLS.x509_1024.pem -inkey axTLS.key_1024.pem -keypbe PBE-SHA1-RC4-128 -certpbe PBE-SHA1-RC4-128 -name "p12_without_CA" -out axTLS.withoutCA.p12 -password pass:abcd
174: openssl pkcs12 -export -in axTLS.x509_1024.pem -inkey axTLS.key_1024.pem -keypbe PBE-SHA1-RC4-128 -certpbe PBE-SHA1-RC4-128 -out axTLS.noname.p12 -password pass:abcd
175:
176: # PEM certificate chain
177: cat axTLS.ca_x509.pem >> axTLS.x509_device.pem
178:
179: # set default key/cert for use in the server
180: xxd -i axTLS.x509_1024.cer | sed -e \
181: "s/axTLS_x509_1024_cer/default_certificate/" > ../../ssl/cert.h
182: xxd -i axTLS.key_1024 | sed -e \
183: "s/axTLS_key_1024/default_private_key/" > ../../ssl/private_key.h
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to make_certs.sh CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / axTLS / ssl / test