embedaddon/strongswan/testing/scripts/build-certs-chroot - view

File: [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / testing / scripts / build-certs-chroot
Revision 1.1.1.2 (vendor branch): download - view: text, annotated - select for diffs - revision graph
Wed Mar 17 00:20:15 2021 UTC (3 years, 6 months ago) by misho
Branches: strongswan, MAIN
CVS tags: v5_9_2p0, HEAD

strongswan 5.9.2

1: #!/bin/bash 2: 3: set -o errexit 4: 5: echo "Building certificates" 6: 7: # Disable leak detective when using pki as it produces warnings in tzset 8: export LEAK_DETECTIVE_DISABLE=1 9: 10: # Determine testing directory 11: DIR="$(dirname `readlink -f $0`)/.." 12: 13: # Define some global variables 14: PROJECT="strongSwan Project" 15: CA_DIR="${DIR}/hosts/winnetou/etc/ca" 16: CA_KEY="${CA_DIR}/strongswanKey.pem" 17: CA_CERT="${CA_DIR}/strongswanCert.pem" 18: CA_CERT_DER="${CA_DIR}/strongswanCert.der" 19: CA_CRL="${CA_DIR}/strongswan.crl" 20: CA_LAST_CRL="${CA_DIR}/strongswan_last.crl" 21: CA_CDP="http://crl.strongswan.org/strongswan.crl" 22: CA_BASE_CDP="http://crl.strongswan.org/strongswan_base.crl" 23: CA_OCSP="http://ocsp.strongswan.org:8880" 24: # 25: START=`date -d "-2 day" "+%d.%m.%y %T"` 26: SH_END=`date -d "-1 day" "+%d.%m.%y %T"` # 1 day 27: CA_END=`date -d "+3651 day" "+%d.%m.%y %T"` # 10 years 28: IM_END=`date -d "+3286 day" "+%d.%m.%y %T"` # 9 years 29: EE_END=`date -d "+2920 day" "+%d.%m.%y %T"` # 8 years 30: SH_EXP=`date -d "-1 day" "+%y%m%d%H%M%SZ"` # 1 day 31: IM_EXP=`date -d "+3286 day" "+%y%m%d%H%M%SZ"` # 9 years 32: EE_EXP=`date -d "+2920 day" "+%y%m%d%H%M%SZ"` # 8 years 33: NOW=`date "+%y%m%d%H%M%SZ"` 34: # 35: RESEARCH_DIR="${CA_DIR}/research" 36: RESEARCH_KEY="${RESEARCH_DIR}/researchKey.pem" 37: RESEARCH_CERT="${RESEARCH_DIR}/researchCert.pem" 38: RESEARCH_CERT_DER="${RESEARCH_DIR}/researchCert.der" 39: RESEARCH_CDP="http://crl.strongswan.org/research.crl" 40: # 41: SALES_DIR="${CA_DIR}/sales" 42: SALES_KEY="${SALES_DIR}/salesKey.pem" 43: SALES_CERT="${SALES_DIR}/salesCert.pem" 44: SALES_CERT_DER="${SALES_DIR}/salesCert.der" 45: SALES_CDP="http://crl.strongswan.org/sales.crl" 46: # 47: LEVELS_DIR="${CA_DIR}/levels" 48: LEVELS_KEY="${LEVELS_DIR}/levelsKey.pem" 49: LEVELS_CERT="${LEVELS_DIR}/levelsCert.pem" 50: LEVELS_CDP="http://crl.strongswan.org/levels.crl" 51: LEVELS_L2_KEY="${LEVELS_DIR}/levelsKey_l2.pem" 52: LEVELS_L2_CERT="${LEVELS_DIR}/levelsCert_l2.pem" 53: LEVELS_L2_CDP="http://crl.strongswan.org/levels_l2.crl" 54: LEVELS_L3_KEY="${LEVELS_DIR}/levelsKey_l3.pem" 55: LEVELS_L3_CERT="${LEVELS_DIR}/levelsCert_l3.pem" 56: LEVELS_L3_CDP="http://crl.strongswan.org/levels_l3.crl" 57: # 58: DUCK_DIR="${CA_DIR}/duck" 59: DUCK_KEY="${DUCK_DIR}/duckKey.pem" 60: DUCK_CERT="${DUCK_DIR}/duckCert.pem" 61: # 62: ECDSA_DIR="${CA_DIR}/ecdsa" 63: ECDSA_KEY="${ECDSA_DIR}/strongswanKey.pem" 64: ECDSA_CERT="${ECDSA_DIR}/strongswanCert.pem" 65: ECDSA_CDP="http://crl.strongswan.org/strongswan_ecdsa.crl" 66: # 67: RFC3779_DIR="${CA_DIR}/rfc3779" 68: RFC3779_KEY="${RFC3779_DIR}/strongswanKey.pem" 69: RFC3779_CERT="${RFC3779_DIR}/strongswanCert.pem" 70: RFC3779_CDP="http://crl.strongswan.org/strongswan_rfc3779.crl" 71: # 72: SHA3_RSA_DIR="${CA_DIR}/sha3-rsa" 73: SHA3_RSA_KEY="${SHA3_RSA_DIR}/strongswanKey.pem" 74: SHA3_RSA_CERT="${SHA3_RSA_DIR}/strongswanCert.pem" 75: SHA3_RSA_CDP="http://crl.strongswan.org/strongswan_sha3_rsa.crl" 76: # 77: ED25519_DIR="${CA_DIR}/ed25519" 78: ED25519_KEY="${ED25519_DIR}/strongswanKey.pem" 79: ED25519_CERT="${ED25519_DIR}/strongswanCert.pem" 80: ED25519_CDP="http://crl.strongswan.org/strongswan_ed25519.crl" 81: # 82: MONSTER_DIR="${CA_DIR}/monster" 83: MONSTER_KEY="${MONSTER_DIR}/strongswanKey.pem" 84: MONSTER_CERT="${MONSTER_DIR}/strongswanCert.pem" 85: MONSTER_CDP="http://crl.strongswan.org/strongswan_monster.crl" 86: MONSTER_CA_RSA_SIZE="8192" 87: MONSTER_EE_RSA_SIZE="4096" 88: # 89: BLISS_DIR="${CA_DIR}/bliss" 90: BLISS_KEY="${BLISS_DIR}/strongswan_blissKey.der" 91: BLISS_CERT="${BLISS_DIR}/strongswan_blissCert.der" 92: BLISS_CDP="http://crl.strongswan.org/strongswan_bliss.crl" 93: # 94: RSA_SIZE="3072" 95: IPSEC_DIR="etc/ipsec.d" 96: SWANCTL_DIR="etc/swanctl" 97: TKM_DIR="etc/tkm" 98: HOSTS="carol dave moon sun alice venus bob" 99: TEST_DIR="${DIR}/tests" 100: 101: # Create directories 102: mkdir -p ${CA_DIR}/certs 103: mkdir -p ${CA_DIR}/keys 104: mkdir -p ${RESEARCH_DIR}/certs 105: mkdir -p ${RESEARCH_DIR}/keys 106: mkdir -p ${SALES_DIR}/certs 107: mkdir -p ${SALES_DIR}/keys 108: mkdir -p ${LEVELS_DIR}/certs 109: mkdir -p ${DUCK_DIR}/certs 110: mkdir -p ${ECDSA_DIR}/certs 111: mkdir -p ${RFC3779_DIR}/certs 112: mkdir -p ${SHA3_RSA_DIR}/certs 113: mkdir -p ${ED25519_DIR}/certs 114: mkdir -p ${MONSTER_DIR}/certs 115: mkdir -p ${BLISS_DIR}/certs 116: 117: ################################################################################ 118: # strongSwan Root CA # 119: ################################################################################ 120: 121: # Generate strongSwan Root CA 122: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${CA_KEY} 123: pki --self --type rsa --in ${CA_KEY} --not-before "${START}" --not-after "${CA_END}" \ 124: --ca --pathlen 1 --dn "C=CH, O=${PROJECT}, CN=strongSwan Root CA" \ 125: --outform pem > ${CA_CERT} 126: 127: # Distribute strongSwan Root CA certificate 128: for h in ${HOSTS} 129: do 130: HOST_DIR="${DIR}/hosts/${h}" 131: mkdir -p ${HOST_DIR}/${IPSEC_DIR}/cacerts 132: mkdir -p ${HOST_DIR}/${SWANCTL_DIR}/x509ca 133: cp ${CA_CERT} ${HOST_DIR}/${IPSEC_DIR}/cacerts 134: cp ${CA_CERT} ${HOST_DIR}/${SWANCTL_DIR}/x509ca 135: done 136: 137: # Put a copy onto the alice FreeRADIUS server 138: mkdir -p ${DIR}/hosts/alice/etc/raddb/certs 139: cp ${CA_CERT} ${DIR}/hosts/alice/etc/raddb/certs 140: 141: # Convert strongSwan Root CA certificate into DER format 142: openssl x509 -in ${CA_CERT} -outform der -out ${CA_CERT_DER} 143: 144: # Generate a stale CRL 145: pki --signcrl --cakey ${CA_KEY} --cacert ${CA_CERT} \ 146: --this-update "${START}" --lifetime 1 > ${CA_LAST_CRL} 147: 148: # Put a CRL copy into the ikev2/crl-ldap scenario to be used as a stale crl 149: TEST="${TEST_DIR}/ikev2/crl-ldap" 150: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/crls 151: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/crls 152: cp ${CA_LAST_CRL} ${TEST}/hosts/carol/${IPSEC_DIR}/crls/stale.crl 153: cp ${CA_LAST_CRL} ${TEST}/hosts/moon/${IPSEC_DIR}/crls/stale.crl 154: 155: # Generate host keys 156: for h in ${HOSTS} 157: do 158: HOST_DIR="${DIR}/hosts/${h}" 159: HOST_KEY="${HOST_DIR}/${IPSEC_DIR}/private/${h}Key.pem" 160: mkdir -p ${HOST_DIR}/${IPSEC_DIR}/private 161: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${HOST_KEY} 162: 163: # Put a copy into swanctl directory tree 164: mkdir -p ${HOST_DIR}/${SWANCTL_DIR}/rsa 165: cp ${HOST_KEY} ${HOST_DIR}/${SWANCTL_DIR}/rsa 166: 167: # Convert host key into DER format 168: openssl rsa -in ${HOST_KEY} -outform der -out ${CA_DIR}/keys/${h}Key.der \ 169: 2> /dev/null 170: done 171: 172: # Put DER-encoded moon private key and Root CA certificate into tkm scenarios 173: for t in host2host-initiator host2host-responder host2host-xfrmproxy \ 174: multi-level-ca net2net-initiator net2net-xfrmproxy xfrmproxy-expire \ 175: xfrmproxy-rekey 176: do 177: TEST="${TEST_DIR}/tkm/${t}" 178: mkdir -p ${TEST}/hosts/moon/${TKM_DIR} 179: cp ${CA_DIR}/keys/moonKey.der ${CA_CERT_DER} ${TEST}/hosts/moon/${TKM_DIR} 180: done 181: 182: # Put DER_encoded sun private key and Root CA certificate into tkm scenarios 183: TEST="${TEST_DIR}/tkm/multiple-clients" 184: mkdir -p ${TEST}/hosts/sun/${TKM_DIR} 185: cp ${CA_DIR}/keys/sunKey.der ${CA_CERT_DER} ${TEST}/hosts/sun/${TKM_DIR} 186: 187: # Convert moon private key into unencrypted PKCS#8 format 188: TEST="${TEST_DIR}/ikev2/rw-pkcs8" 189: HOST_KEY="${DIR}/hosts/moon/${SWANCTL_DIR}/rsa/moonKey.pem" 190: TEST_KEY="${TEST}/hosts/moon/${IPSEC_DIR}/private/moonKey.pem" 191: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/private 192: openssl pkcs8 -in ${HOST_KEY} -nocrypt -topk8 -out ${TEST_KEY} 193: 194: # Convert carol private key into v1.5 DES encrypted PKCS#8 format 195: HOST_KEY="${DIR}/hosts/carol/${SWANCTL_DIR}/rsa/carolKey.pem" 196: TEST_KEY="${TEST}/hosts/carol/${IPSEC_DIR}/private/carolKey.pem" 197: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 198: openssl pkcs8 -in ${HOST_KEY} -nocrypt -topk8 -v1 PBE-MD5-DES \ 199: -passout "pass:nH5ZQEWtku0RJEZ6" -out ${TEST_KEY} 200: 201: # Convert dave private key into v2.0 AES-128 encrypted PKCS#8 format 202: HOST_KEY="${DIR}/hosts/dave/${SWANCTL_DIR}/rsa/daveKey.pem" 203: TEST_KEY="${TEST}/hosts/dave/${IPSEC_DIR}/private/daveKey.pem" 204: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/private 205: openssl pkcs8 -in ${HOST_KEY} -nocrypt -topk8 -v2 aes128 \ 206: -passout "pass:OJlNZBx+80dLh4wC6fw5LmBd" -out ${TEST_KEY} 207: 208: ################################################################################ 209: # Public Key Extraction # 210: ################################################################################ 211: 212: # Extract the raw moon public key for the swanctl/net2net-pubkey scenario 213: TEST="${TEST_DIR}/swanctl/net2net-pubkey" 214: TEST_PUB="${TEST}/hosts/moon/${SWANCTL_DIR}/pubkey/moonPub.pem" 215: HOST_KEY="${DIR}/hosts/moon/${SWANCTL_DIR}/rsa/moonKey.pem" 216: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/pubkey 217: mkdir -p ${TEST}/hosts/sun/${SWANCTL_DIR}/pubkey 218: pki --pub --type rsa --in ${HOST_KEY} --outform pem > ${TEST_PUB} 219: cp ${TEST_PUB} ${TEST}/hosts/sun/${SWANCTL_DIR}/pubkey 220: 221: # Put a copy into the following ikev2 scenarios 222: for t in net2net-dnssec net2net-pubkey rw-dnssec 223: do 224: TEST="${TEST_DIR}/ikev2/${t}" 225: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/certs 226: cp ${TEST_PUB} ${TEST}/hosts/moon/${IPSEC_DIR}/certs 227: done 228: 229: # Put a copy into the ikev2/net2net-pubkey scenario 230: TEST="${TEST_DIR}/ikev2/net2net-pubkey" 231: mkdir -p ${TEST}/hosts/sun/${IPSEC_DIR}/certs 232: cp ${TEST_PUB} ${TEST}/hosts/sun/${IPSEC_DIR}/certs 233: 234: # Put a copy into the swanctl/rw-dnssec scenario 235: TEST="${TEST_DIR}/swanctl/rw-dnssec" 236: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/pubkey 237: cp ${TEST_PUB} ${TEST}/hosts/moon/${SWANCTL_DIR}/pubkey 238: 239: # Put a copy into the following swanctl scenarios 240: for t in rw-pubkey-anon rw-pubkey-keyid 241: do 242: TEST="${TEST_DIR}/swanctl/${t}" 243: for h in moon carol dave 244: do 245: mkdir -p ${TEST}/hosts/${h}/${SWANCTL_DIR}/pubkey 246: cp ${TEST_PUB} ${TEST}/hosts/${h}/${SWANCTL_DIR}/pubkey 247: done 248: done 249: 250: # Extract the raw sun public key for the swanctl/net2net-pubkey scenario 251: TEST="${TEST_DIR}/swanctl/net2net-pubkey" 252: TEST_PUB="${TEST}/hosts/sun/${SWANCTL_DIR}/pubkey/sunPub.pem" 253: HOST_KEY="${DIR}/hosts/sun/${SWANCTL_DIR}/rsa/sunKey.pem" 254: pki --pub --type rsa --in ${HOST_KEY} --outform pem > ${TEST_PUB} 255: cp ${TEST_PUB} ${TEST}/hosts/moon/${SWANCTL_DIR}/pubkey 256: 257: # Put a copy into the ikev2/net2net-dnssec scenario 258: TEST="${TEST_DIR}/ikev2/net2net-dnssec" 259: mkdir -p ${TEST}/hosts/sun/${IPSEC_DIR}/certs 260: cp ${TEST_PUB} ${TEST}/hosts/sun/${IPSEC_DIR}/certs 261: 262: # Put a copy into the ikev2/net2net-pubkey scenario 263: TEST="${TEST_DIR}/ikev2/net2net-pubkey" 264: cp ${TEST_PUB} ${TEST}/hosts/moon/${IPSEC_DIR}/certs 265: cp ${TEST_PUB} ${TEST}/hosts/sun/${IPSEC_DIR}/certs 266: 267: # Put a copy into the swanctl/rw-pubkey-anon scenario 268: TEST="${TEST_DIR}/swanctl/rw-pubkey-anon" 269: cp ${TEST_PUB} ${TEST}/hosts/moon/${SWANCTL_DIR}/pubkey 270: 271: # Extract the raw carol public key for the swanctl/rw-dnssec scenario 272: TEST="${TEST_DIR}/swanctl/rw-dnssec" 273: TEST_PUB="${TEST}/hosts/carol/${SWANCTL_DIR}/pubkey/carolPub.pem" 274: HOST_KEY="${DIR}/hosts/carol/${SWANCTL_DIR}/rsa/carolKey.pem" 275: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/pubkey 276: pki --pub --type rsa --in ${HOST_KEY} --outform pem > ${TEST_PUB} 277: 278: # Put a copy into the swanctl/rw-pubkey-anon scenario 279: TEST="${TEST_DIR}/swanctl/rw-pubkey-anon" 280: cp ${TEST_PUB} ${TEST}/hosts/carol/${SWANCTL_DIR}/pubkey 281: cp ${TEST_PUB} ${TEST}/hosts/moon/${SWANCTL_DIR}/pubkey 282: 283: # Put a copy into the swanctl/rw-pubkey-keyid scenario 284: TEST="${TEST_DIR}/swanctl/rw-pubkey-keyid" 285: cp ${TEST_PUB} ${TEST}/hosts/carol/${SWANCTL_DIR}/pubkey 286: cp ${TEST_PUB} ${TEST}/hosts/moon/${SWANCTL_DIR}/pubkey 287: 288: # Extract the raw dave public key for the swanctl/rw-dnssec scenario 289: TEST="${TEST_DIR}/swanctl/rw-dnssec" 290: TEST_PUB="${TEST}/hosts/dave/${SWANCTL_DIR}/pubkey/davePub.pem" 291: HOST_KEY="${DIR}/hosts/dave/${SWANCTL_DIR}/rsa/daveKey.pem" 292: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/pubkey 293: pki --pub --type rsa --in ${HOST_KEY} --outform pem > ${TEST_PUB} 294: 295: # Put a copy into the swanctl/rw-pubkey-anon scenario 296: TEST="${TEST_DIR}/swanctl/rw-pubkey-anon" 297: cp ${TEST_PUB} ${TEST}/hosts/dave/${SWANCTL_DIR}/pubkey 298: cp ${TEST_PUB} ${TEST}/hosts/moon/${SWANCTL_DIR}/pubkey 299: 300: # Put a copy into the swanctl/rw-pubkey-keyid scenario 301: TEST="${TEST_DIR}/swanctl/rw-pubkey-keyid" 302: cp ${TEST_PUB} ${TEST}/hosts/dave/${SWANCTL_DIR}/pubkey 303: cp ${TEST_PUB} ${TEST}/hosts/moon/${SWANCTL_DIR}/pubkey 304: 305: ################################################################################ 306: # Host Certificate Generation # 307: ################################################################################ 308: 309: # function issue_cert: serial host cn [ou] 310: issue_cert() 311: { 312: # does optional OU argument exist? 313: if [ -z "${4}" ] 314: then 315: OU="" 316: else 317: OU=" OU=${4}," 318: fi 319: 320: HOST_DIR="${DIR}/hosts/${2}" 321: HOST_KEY="${HOST_DIR}/${IPSEC_DIR}/private/${2}Key.pem" 322: HOST_CERT="${HOST_DIR}/${IPSEC_DIR}/certs/${2}Cert.pem" 323: mkdir -p ${HOST_DIR}/${IPSEC_DIR}/certs 324: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 325: --in ${HOST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${3} \ 326: --serial ${1} --dn "C=CH, O=${PROJECT},${OU} CN=${3}" \ 327: --outform pem > ${HOST_CERT} 328: cp ${HOST_CERT} ${CA_DIR}/certs/${1}.pem 329: 330: # Put a certificate copy into swanctl directory tree 331: mkdir -p ${HOST_DIR}/${SWANCTL_DIR}/x509 332: cp ${HOST_CERT} ${HOST_DIR}/${SWANCTL_DIR}/x509 333: } 334: 335: # Generate host certificates 336: issue_cert 01 carol carol@strongswan.org Research 337: issue_cert 02 dave dave@strongswan.org Accounting 338: issue_cert 03 moon moon.strongswan.org 339: issue_cert 04 sun sun.strongswan.org 340: issue_cert 05 alice alice@strongswan.org Sales 341: issue_cert 06 venus venus.strongswan.org 342: issue_cert 07 bob bob@strongswan.org Research 343: 344: # Create PKCS#12 file for moon 345: TEST="${TEST_DIR}/ikev2/net2net-pkcs12" 346: HOST_KEY="${DIR}/hosts/moon/${SWANCTL_DIR}/rsa/moonKey.pem" 347: HOST_CERT="${DIR}/hosts/moon/${SWANCTL_DIR}/x509/moonCert.pem" 348: MOON_PKCS12="${TEST}/hosts/moon/${IPSEC_DIR}/private/moonCert.p12" 349: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/private 350: openssl pkcs12 -export -inkey ${HOST_KEY} -in ${HOST_CERT} -name "moon" \ 351: -certfile ${CA_CERT} -caname "strongSwan Root CA" \ 352: -aes128 -passout "pass:kUqd8O7mzbjXNJKQ" > ${MOON_PKCS12} 2> /dev/null 353: 354: # Create PKCS#12 file for sun 355: HOST_KEY="${DIR}/hosts/sun/${SWANCTL_DIR}/rsa/sunKey.pem" 356: HOST_CERT="${DIR}/hosts/sun/${SWANCTL_DIR}/x509/sunCert.pem" 357: SUN_PKCS12="${TEST}/hosts/sun/${IPSEC_DIR}/private/sunCert.p12" 358: mkdir -p ${TEST}/hosts/sun/${IPSEC_DIR}/private 359: openssl pkcs12 -export -inkey ${HOST_KEY} -in ${HOST_CERT} -name "sun" \ 360: -certfile ${CA_CERT} -caname "strongSwan Root CA" \ 361: -aes128 -passout "pass:IxjQVCF3JGI+MoPi" > ${SUN_PKCS12} 2> /dev/null 362: 363: # Put a PKCS#12 copy into the botan/net2net-pkcs12 scenario 364: for t in botan/net2net-pkcs12 openssl-ikev2/net2net-pkcs12 365: do 366: TEST="${TEST_DIR}/${t}" 367: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/pkcs12 368: mkdir -p ${TEST}/hosts/sun/${SWANCTL_DIR}/pkcs12 369: cp ${MOON_PKCS12} ${TEST}/hosts/moon/${SWANCTL_DIR}/pkcs12 370: cp ${SUN_PKCS12} ${TEST}/hosts/sun/${SWANCTL_DIR}/pkcs12 371: done 372: 373: ################################################################################ 374: # DNSSEC Zone Files # 375: ################################################################################ 376: 377: # Store moon and sun certificates in strongswan.org zone 378: ZONE_FILE="${CA_DIR}/db.strongswan.org.certs-and-keys" 379: echo "; Automatically generated for inclusion in zone file" > ${ZONE_FILE} 380: for h in moon sun 381: do 382: HOST_CERT=${DIR}/hosts/${h}/${SWANCTL_DIR}/x509/${h}Cert.pem 383: cert=$(grep --invert-match ^----- ${HOST_CERT}| sed -e 's/^/\t\t\t\t/') 384: echo -e "${h}\tIN\tCERT\t( 1 0 0\n${cert}\n\t\t\t\t)" >> ${ZONE_FILE} 385: done 386: 387: # Store public keys in strongswan.org zone 388: echo ";" >> ${ZONE_FILE} 389: for h in moon sun carol dave 390: do 391: HOST_CERT=${DIR}/hosts/${h}/${SWANCTL_DIR}/x509/${h}Cert.pem 392: pubkey=$(pki --pub --type x509 --in ${HOST_CERT} --outform dnskey | sed 's/$.\{0,64\}$/\t\t\t\t\1\n/g') 393: echo -e "${h}\tIN\tIPSECKEY\t( 10 3 2 ${h}.strongswan.org.\n${pubkey}\n\t\t\t\t)" >> ${ZONE_FILE} 394: done 395: 396: # Generate a carol certificate for the swanctl/crl-to-cache scenario with base CDP 397: TEST="${TEST_DIR}/swanctl/crl-to-cache" 398: TEST_CERT="${TEST}/hosts/carol/${SWANCTL_DIR}/x509/carolCert.pem" 399: HOST_KEY="${DIR}/hosts/carol/${SWANCTL_DIR}/rsa/carolKey.pem" 400: CN="carol@strongswan.org" 401: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 402: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_BASE_CDP} --type rsa \ 403: --in ${HOST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 404: --serial 01 --dn "C=CH, O=${PROJECT}, OU=Research, CN=${CN}" \ 405: --outform pem > ${TEST_CERT} 406: 407: # Generate a moon certificate for the swanctl/crl-to-cache scenario with base CDP 408: TEST_CERT="${TEST}/hosts/moon/${SWANCTL_DIR}/x509/moonCert.pem" 409: HOST_KEY="${DIR}/hosts/moon/${SWANCTL_DIR}/rsa/moonKey.pem" 410: CN="moon.strongswan.org" 411: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509 412: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_BASE_CDP} --type rsa \ 413: --in ${HOST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 414: --serial 03 --dn "C=CH, O=${PROJECT}, CN=${CN}" \ 415: --outform pem > ${TEST_CERT} 416: 417: # Encrypt carolKey.pem 418: HOST_KEY="${DIR}/hosts/carol/${IPSEC_DIR}/private/carolKey.pem" 419: KEY_PWD="nH5ZQEWtku0RJEZ6" 420: openssl rsa -in ${HOST_KEY} -aes128 --passout pass:${KEY_PWD} -out ${HOST_KEY} \ 421: 2> /dev/null 422: 423: # Put a copy into the ikev2/dynamic-initiator scenario 424: for t in ikev2/dynamic-initiator ikev1/dynamic-initiator ikev1/dynamic-responder 425: do 426: TEST="${TEST_DIR}/${t}" 427: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/private 428: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/certs 429: cp ${HOST_KEY} ${TEST}/hosts/dave/${IPSEC_DIR}/private 430: cp ${CA_DIR}/certs/01.pem ${TEST}/hosts/dave/${IPSEC_DIR}/certs/carolCert.pem 431: done 432: 433: # Put a copy into the swanctl/rw-cert scenario 434: TEST="${TEST_DIR}/swanctl/rw-cert" 435: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/rsa 436: cp ${HOST_KEY} ${TEST}/hosts/carol/${SWANCTL_DIR}/rsa 437: 438: # Generate another carol certificate and revoke it 439: TEST="${TEST_DIR}/ikev2/crl-revoked" 440: TEST_KEY="${TEST}/hosts/carol/${IPSEC_DIR}/private/carolKey.pem" 441: TEST_CERT="${TEST}/hosts/carol/${IPSEC_DIR}/certs/carolCert.pem" 442: CN="carol@strongswan.org" 443: SERIAL="08" 444: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 445: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/certs 446: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 447: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 448: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 449: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Research, CN=${CN}" \ 450: --outform pem > ${TEST_CERT} 451: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 452: pki --signcrl --cakey ${CA_KEY} --cacert ${CA_CERT} --reason "key-compromise" \ 453: --serial ${SERIAL} > ${CA_CRL} 454: cp ${CA_CRL} ${CA_LAST_CRL} 455: 456: # Put a copy into the ikev2/ocsp-revoked scenario 457: TEST="${TEST_DIR}/ikev2/ocsp-revoked" 458: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 459: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/certs 460: cp ${TEST_KEY} ${TEST}/hosts/carol/${IPSEC_DIR}/private 461: cp ${TEST_CERT} ${TEST}/hosts/carol/${IPSEC_DIR}/certs 462: 463: # Generate another carol certificate with serialNumber=002 464: TEST="${TEST_DIR}/ikev2/two-certs" 465: TEST_KEY="${TEST}/hosts/carol/${IPSEC_DIR}/private/carolKey-002.pem" 466: TEST_CERT="${TEST}/hosts/carol/${IPSEC_DIR}/certs/carolCert-002.pem" 467: SERIAL="09" 468: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 469: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/certs 470: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 471: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 472: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 473: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Research, serialNumber=002, CN=${CN}" \ 474: --outform pem > ${TEST_CERT} 475: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 476: 477: ################################################################################ 478: # Research CA Certificate Generation # 479: ################################################################################ 480: 481: # Generate a Research CA certificate signed by the Root CA and revoke it 482: TEST="${TEST_DIR}/ikev2/multi-level-ca-revoked" 483: TEST_CERT="${TEST}/hosts/moon/${IPSEC_DIR}/cacerts/researchCert.pem" 484: SERIAL="0A" 485: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/cacerts/ 486: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${RESEARCH_KEY} 487: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 488: --in ${RESEARCH_KEY} --not-before "${START}" --not-after "${IM_END}" --ca \ 489: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Research, CN=Research CA" \ 490: --outform pem > ${TEST_CERT} 491: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 492: pki --signcrl --cakey ${CA_KEY} --cacert ${CA_CERT} --reason "ca-compromise" \ 493: --serial ${SERIAL} --lastcrl ${CA_LAST_CRL} > ${CA_CRL} 494: rm ${CA_LAST_CRL} 495: 496: # Generate Research CA with the same private key as above signed by Root CA 497: SERIAL="0B" 498: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 499: --in ${RESEARCH_KEY} --not-before "${START}" --not-after "${IM_END}" --ca \ 500: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Research, CN=Research CA" \ 501: --outform pem > ${RESEARCH_CERT} 502: cp ${RESEARCH_CERT} ${CA_DIR}/certs/${SERIAL}.pem 503: 504: # Put a certificate copy into the following scenarios 505: for t in ikev1/multi-level-ca ikev2/multi-level-ca ikev2/multi-level-ca-ldap \ 506: ikev2/multi-level-ca-pathlen ikev2/multi-level-ca-strict \ 507: ikev2/ocsp-multi-level ikev2/ocsp-strict-ifuri 508: do 509: TEST="${TEST_DIR}/${t}" 510: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/cacerts 511: cp ${RESEARCH_CERT} ${TEST}/hosts/moon/${IPSEC_DIR}/cacerts 512: done 513: 514: for t in ikev1/multi-level-ca-cr-init ikev1/multi-level-ca-cr-resp \ 515: ikev2/multi-level-ca-cr-init ikev2/multi-level-ca-cr-resp 516: do 517: TEST="${TEST_DIR}/${t}" 518: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/cacerts 519: cp ${RESEARCH_CERT} ${TEST}/hosts/carol/${IPSEC_DIR}/cacerts 520: done 521: 522: for t in multi-level-ca ocsp-multi-level 523: do 524: TEST="${TEST_DIR}/swanctl/${t}" 525: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509ca 526: cp ${RESEARCH_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509ca 527: done 528: 529: for t in rw-hash-and-url-multi-level 530: do 531: TEST="${TEST_DIR}/swanctl/${t}" 532: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509ca 533: cp ${RESEARCH_CERT} ${TEST}/hosts/carol/${SWANCTL_DIR}/x509ca 534: done 535: 536: # Convert Research CA certificate into DER format 537: openssl x509 -in ${RESEARCH_CERT} -outform der -out ${RESEARCH_CERT_DER} 538: 539: # Generate Research CA with the same private key as above but invalid CDP 540: TEST="${TEST_DIR}/ikev2/multi-level-ca-skipped" 541: TEST_CERT="${TEST}/hosts/moon/${IPSEC_DIR}/cacerts/researchCert.pem" 542: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/cacerts 543: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --type rsa \ 544: --crl "http://crl.strongswan.org/not-available.crl" \ 545: --in ${RESEARCH_KEY} --not-before "${START}" --not-after "${IM_END}" --ca \ 546: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Research, CN=Research CA" \ 547: --outform pem > ${TEST_CERT} 548: 549: ################################################################################ 550: # Sales CA Certificate Generation # 551: ################################################################################ 552: 553: # Generate Sales CA signed by Root CA 554: SERIAL="0C" 555: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${SALES_KEY} 556: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 557: --in ${SALES_KEY} --not-before "${START}" --not-after "${IM_END}" --ca \ 558: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Sales, CN=Sales CA" \ 559: --outform pem > ${SALES_CERT} 560: cp ${SALES_CERT} ${CA_DIR}/certs/${SERIAL}.pem 561: 562: # Put a certificate copy into the following scenarios 563: for t in ikev1/multi-level-ca ikev2/multi-level-ca ikev2/multi-level-ca-ldap \ 564: ikev2/multi-level-ca-strict ikev2/ocsp-multi-level \ 565: ikev2/ocsp-multi-level ikev2/ocsp-strict-ifuri 566: do 567: TEST="${TEST_DIR}/${t}" 568: cp ${SALES_CERT} ${TEST}/hosts/moon/${IPSEC_DIR}/cacerts 569: done 570: 571: for t in ikev1/multi-level-ca-cr-init ikev1/multi-level-ca-cr-resp \ 572: ikev2/multi-level-ca-cr-init ikev2/multi-level-ca-cr-resp 573: do 574: TEST="${TEST_DIR}/${t}" 575: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/cacerts 576: cp ${SALES_CERT} ${TEST}/hosts/dave/${IPSEC_DIR}/cacerts 577: done 578: 579: for t in multi-level-ca ocsp-multi-level 580: do 581: TEST="${TEST_DIR}/swanctl/${t}" 582: cp ${SALES_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509ca 583: done 584: 585: for t in rw-hash-and-url-multi-level 586: do 587: TEST="${TEST_DIR}/swanctl/${t}" 588: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/x509ca 589: cp ${SALES_CERT} ${TEST}/hosts/dave/${SWANCTL_DIR}/x509ca 590: done 591: 592: # Convert Sales CA certificate into DER format 593: openssl x509 -in ${SALES_CERT} -outform der -out ${SALES_CERT_DER} 594: 595: ################################################################################ 596: # Multi-level CA Certificate Generation # 597: ################################################################################ 598: 599: # Generate Levels Root CA (pathlen is higher than the regular root) 600: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${LEVELS_KEY} 601: pki --self --type rsa --in ${LEVELS_KEY} --not-before "${START}" --not-after "${CA_END}" \ 602: --ca --pathlen 2 --dn "C=CH, O=${PROJECT}, CN=strongSwan Levels Root CA" \ 603: --outform pem > ${LEVELS_CERT} 604: 605: # For TKM's CA ID mapping 606: LEVELS_SPK_HEX=`pki --keyid --type rsa --format hex --id spk --in ${LEVELS_KEY}` 607: 608: # Generate Levels L2 CA signed by Levels Root CA 609: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${LEVELS_L2_KEY} 610: pki --issue --cakey ${LEVELS_KEY} --cacert ${LEVELS_CERT} --crl ${LEVELS_CDP} \ 611: --type rsa --in ${LEVELS_L2_KEY} --not-before "${START}" --not-after "${IM_END}" \ 612: --ca --dn "C=CH, O=${PROJECT}, OU=L2, CN=Levels L2 CA" \ 613: --outform pem > ${LEVELS_L2_CERT} 614: 615: # Generate Levels L3 CA signed by Levels L2 CA 616: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${LEVELS_L3_KEY} 617: pki --issue --cakey ${LEVELS_L2_KEY} --cacert ${LEVELS_L2_CERT} --crl ${LEVELS_L2_CDP} \ 618: --type rsa --in ${LEVELS_L3_KEY} --not-before "${START}" --not-after "${IM_END}" \ 619: --ca --dn "C=CH, O=${PROJECT}, OU=L3, CN=Levels L3 CA" \ 620: --outform pem > ${LEVELS_L3_CERT} 621: 622: for t in swanctl/multi-level-ca-l3 tkm/multi-level-ca 623: do 624: TEST="${TEST_DIR}/${t}" 625: for h in moon carol 626: do 627: mkdir -p ${TEST}/hosts/${h}/${SWANCTL_DIR}/x509ca 628: cp ${LEVELS_CERT} ${TEST}/hosts/${h}/${SWANCTL_DIR}/x509ca 629: done 630: cp ${LEVELS_L2_CERT} ${TEST}/hosts/carol/${SWANCTL_DIR}/x509ca 631: cp ${LEVELS_L3_CERT} ${TEST}/hosts/carol/${SWANCTL_DIR}/x509ca 632: done 633: 634: # Put DER-encoded Levels CA certificate into tkm scenario 635: TEST="${TEST_DIR}/tkm/multi-level-ca" 636: mkdir -p ${TEST}/hosts/moon/${TKM_DIR} 637: openssl x509 -in ${LEVELS_CERT} -outform der -out ${TEST}/hosts/moon/${TKM_DIR}/levelsCert.der 638: 639: ################################################################################ 640: 641: # Generate an AES-128 encrypted moon key and a SHA-224 hashed certificate 642: TEST="${TEST_DIR}/ikev2/strong-keys-certs" 643: TEST_KEY="${TEST}/hosts/moon/${IPSEC_DIR}/private/moonKey-aes128.pem" 644: TEST_CERT="${TEST}/hosts/moon/${IPSEC_DIR}/certs/moonCert-sha224.pem" 645: KEY_PWD="gOQHdrSWeFuiZtYPetWuyzHW" 646: CN="moon.strongswan.org" 647: SERIAL="0D" 648: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/private 649: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/certs 650: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 651: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 652: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 653: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=SHA-224, CN=${CN}" \ 654: --digest sha224 --outform pem > ${TEST_CERT} 655: openssl rsa -in ${TEST_KEY} -aes128 --passout pass:${KEY_PWD} -out ${TEST_KEY} \ 656: 2> /dev/null 657: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 658: 659: # Generate an AES-192 encrypted carol key and a SHA-384 hashed certificate 660: TEST_KEY="${TEST}/hosts/carol/${IPSEC_DIR}/private/carolKey-aes192.pem" 661: TEST_CERT="${TEST}/hosts/carol/${IPSEC_DIR}/certs/carolCert-sha384.pem" 662: KEY_PWD="ITP/H4lSHqGpUGmCpgNDklbzTNV+swjA" 663: CN="carol@strongswan.org" 664: SERIAL="0E" 665: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 666: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/certs 667: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 668: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 669: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 670: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=SHA-384, CN=${CN}" \ 671: --digest sha384 --outform pem > ${TEST_CERT} 672: openssl rsa -in ${TEST_KEY} -aes192 --passout pass:${KEY_PWD} -out ${TEST_KEY} \ 673: 2> /dev/null 674: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 675: 676: # Generate an AES-256 encrypted dave key and a SHA-512 hashed certificate 677: TEST_KEY="${TEST}/hosts/dave/${IPSEC_DIR}/private/daveKey-aes256.pem" 678: TEST_CERT="${TEST}/hosts/dave/${IPSEC_DIR}/certs/daveCert-sha512.pem" 679: KEY_PWD="MeFnDN7VUbj+qU/bkgRIFvbCketIk2wrrs5Ii8297N2v" 680: CN="dave@strongswan.org" 681: SERIAL="0F" 682: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/private 683: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/certs 684: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 685: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 686: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 687: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=SHA-512, CN=${CN}" \ 688: --digest sha512 --outform pem > ${TEST_CERT} 689: openssl rsa -in ${TEST_KEY} -aes256 --passout pass:${KEY_PWD} -out ${TEST_KEY} \ 690: 2> /dev/null 691: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 692: 693: # Generate another carol certificate with an OCSP URI 694: TEST="${TEST_DIR}/ikev2/ocsp-signer-cert" 695: TEST_KEY="${TEST}/hosts/carol/${IPSEC_DIR}/private/carolKey.pem" 696: TEST_CERT="${TEST}/hosts/carol/${IPSEC_DIR}/certs/carolCert.pem" 697: CN="carol@strongswan.org" 698: SERIAL="10" 699: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 700: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/certs 701: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 702: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 703: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 704: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=OCSP, CN=${CN}" \ 705: --ocsp ${CA_OCSP} --outform pem > ${TEST_CERT} 706: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 707: 708: # Put a copy into the ikev2/ocsp-timeouts-good scenario 709: TEST="${TEST_DIR}/ikev2/ocsp-timeouts-good" 710: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 711: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/certs 712: cp ${TEST_KEY} ${TEST}/hosts/carol/${IPSEC_DIR}/private 713: cp ${TEST_CERT} ${TEST}/hosts/carol/${IPSEC_DIR}/certs 714: 715: # Put a copy into the swanctl/ocsp-signer-cert scenario 716: for t in ocsp-signer-cert ocsp-disabled 717: do 718: cd "${TEST_DIR}/swanctl/${t}/hosts/carol/${SWANCTL_DIR}" 719: mkdir -p rsa x509 720: cp ${TEST_KEY} rsa 721: cp ${TEST_CERT} x509 722: done 723: 724: # Generate an OCSP Signing certificate for the strongSwan Root CA 725: TEST_KEY="${CA_DIR}/ocspKey.pem" 726: TEST_CERT="${CA_DIR}/ocspCert.pem" 727: CN="ocsp.strongswan.org" 728: OU="OCSP Signing Authority" 729: SERIAL="11" 730: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 731: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 732: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 733: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=${OU}, CN=${CN}" \ 734: --flag ocspSigning --outform pem > ${TEST_CERT} 735: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 736: 737: # Generate a self-signed OCSP Signing certificate 738: TEST_KEY="${CA_DIR}/ocspKey-self.pem" 739: TEST_CERT="${CA_DIR}/ocspCert-self.pem" 740: OU="OCSP Self-Signed Authority" 741: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 742: pki --self --type rsa --in ${TEST_KEY} --flag ocspSigning \ 743: --not-before "${START}" --not-after "${CA_END}" --san ${CN} \ 744: --dn "C=CH, O=${PROJECT}, OU=${OU}, CN=${CN}" \ 745: --outform pem > ${TEST_CERT} 746: 747: # Copy self-signed OCSP Signing certificate to ikev2/ocsp-local-cert scenario 748: TEST="${TEST_DIR}/ikev2/ocsp-local-cert" 749: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/ocspcerts 750: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/ocspcerts 751: cp ${TEST_CERT} ${TEST}/hosts/carol/${IPSEC_DIR}/ocspcerts 752: cp ${TEST_CERT} ${TEST}/hosts/moon/${IPSEC_DIR}/ocspcerts 753: 754: # Generate mars virtual server certificate 755: TEST="${TEST_DIR}/ha/both-active" 756: TEST_KEY="${TEST}/hosts/moon/${IPSEC_DIR}/private/marsKey.pem" 757: TEST_CERT="${TEST}/hosts/moon/${IPSEC_DIR}/certs/marsCert.pem" 758: CN="mars.strongswan.org" 759: OU="Virtual VPN Gateway" 760: SERIAL="12" 761: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/private 762: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/certs 763: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 764: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 765: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 766: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=${OU}, CN=${CN}" \ 767: --flag serverAuth --outform pem > ${TEST_CERT} 768: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 769: 770: # Put a copy into the mirrored gateway 771: mkdir -p ${TEST}/hosts/alice/${IPSEC_DIR}/private 772: mkdir -p ${TEST}/hosts/alice/${IPSEC_DIR}/certs 773: cp ${TEST_KEY} ${TEST}/hosts/alice/${IPSEC_DIR}/private 774: cp ${TEST_CERT} ${TEST}/hosts/alice/${IPSEC_DIR}/certs 775: 776: # Put a copy into the ha/active-passive and ikev2-redirect-active scenarios 777: for t in "ha/active-passive" "ikev2/redirect-active" 778: do 779: TEST="${TEST_DIR}/${t}" 780: for h in alice moon 781: do 782: mkdir -p ${TEST}/hosts/${h}/${IPSEC_DIR}/private 783: mkdir -p ${TEST}/hosts/${h}/${IPSEC_DIR}/certs 784: cp ${TEST_KEY} ${TEST}/hosts/${h}/${IPSEC_DIR}/private 785: cp ${TEST_CERT} ${TEST}/hosts/${h}/${IPSEC_DIR}/certs 786: done 787: done 788: 789: # Generate moon certificate with an unsupported critical X.509 extension 790: TEST="${TEST_DIR}/ikev2/critical-extension" 791: TEST_KEY="${TEST}/hosts/moon/${IPSEC_DIR}/private/moonKey.pem" 792: TEST_CERT="${TEST}/hosts/moon/${IPSEC_DIR}/certs/moonCert.pem" 793: CN="moon.strongswan.org" 794: SERIAL="13" 795: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/private 796: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/certs 797: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 798: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 799: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 800: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Critical Extension, CN=${CN}" \ 801: --critical 1.3.6.1.4.1.36906.1 --flag serverAuth \ 802: --outform pem > ${TEST_CERT} 803: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 804: 805: # Put a copy in the openssl-ikev2/critical extension scenario 806: TEST="${TEST_DIR}/openssl-ikev2/critical-extension" 807: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/rsa 808: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509 809: cp ${TEST_KEY} ${TEST}/hosts/moon/${SWANCTL_DIR}/rsa 810: cp ${TEST_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509 811: 812: # Generate sun certificate with an unsupported critical X.509 extension 813: TEST="${TEST_DIR}/ikev2/critical-extension" 814: TEST_KEY="${TEST}/hosts/sun/${IPSEC_DIR}/private/sunKey.pem" 815: TEST_CERT="${TEST}/hosts/sun/${IPSEC_DIR}/certs/sunCert.pem" 816: CN="sun.strongswan.org" 817: SERIAL="14" 818: mkdir -p ${TEST}/hosts/sun/${IPSEC_DIR}/private 819: mkdir -p ${TEST}/hosts/sun/${IPSEC_DIR}/certs 820: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 821: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 822: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 823: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Critical Extension, CN=${CN}" \ 824: --critical 1.3.6.1.4.1.36906.1 --flag serverAuth \ 825: --outform pem > ${TEST_CERT} 826: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 827: 828: # Put a copy in the openssl-ikev2/critical extension scenario 829: TEST="${TEST_DIR}/openssl-ikev2/critical-extension" 830: mkdir -p ${TEST}/hosts/sun/${SWANCTL_DIR}/rsa 831: mkdir -p ${TEST}/hosts/sun/${SWANCTL_DIR}/x509 832: cp ${TEST_KEY} ${TEST}/hosts/sun/${SWANCTL_DIR}/rsa 833: cp ${TEST_CERT} ${TEST}/hosts/sun/${SWANCTL_DIR}/x509 834: 835: # Generate winnetou server certificate 836: HOST_KEY="${CA_DIR}/winnetouKey.pem" 837: HOST_CERT="${CA_DIR}/winnetouCert.pem" 838: CN="winnetou.strongswan.org" 839: SERIAL="15" 840: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${HOST_KEY} 841: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 842: --in ${HOST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 843: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, CN=${CN}" \ 844: --flag serverAuth --outform pem > ${HOST_CERT} 845: cp ${HOST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 846: 847: # Generate AAA server certificate 848: TEST="${TEST_DIR}/tnc/tnccs-20-pdp-eap" 849: TEST_KEY="${TEST}/hosts/alice/${SWANCTL_DIR}/rsa/aaaKey.pem" 850: TEST_CERT="${TEST}/hosts/alice/${SWANCTL_DIR}/x509/aaaCert.pem" 851: CN="aaa.strongswan.org" 852: SERIAL="16" 853: cd "${TEST}/hosts/alice/${SWANCTL_DIR}" 854: mkdir -p rsa x509 855: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 856: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 857: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 858: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, CN=${CN}" \ 859: --flag serverAuth --outform pem > ${TEST_CERT} 860: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 861: 862: # Put a copy into various tnc scenarios 863: for t in tnccs-20-pdp-pt-tls tnccs-20-ev-pt-tls tnccs-20-hcd-eap 864: do 865: cd "${TEST_DIR}/tnc/${t}/hosts/alice/${SWANCTL_DIR}" 866: mkdir -p rsa x509 867: cp ${TEST_KEY} rsa 868: cp ${TEST_CERT} x509 869: done 870: 871: # Put a copy into the alice FreeRADIUS server 872: cp ${TEST_KEY} ${TEST_CERT} ${DIR}/hosts/alice/etc/raddb/certs 873: 874: ################################################################################ 875: # strongSwan Attribute Authority # 876: ################################################################################ 877: 878: # Generate Attribute Authority certificate 879: TEST="${TEST_DIR}/ikev2/acert-cached" 880: TEST_KEY="${TEST}/hosts/moon/${IPSEC_DIR}/private/aaKey.pem" 881: TEST_CERT="${TEST}/hosts/moon/${IPSEC_DIR}/aacerts/aaCert.pem" 882: CN="strongSwan Attribute Authority" 883: SERIAL="17" 884: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/private 885: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/aacerts 886: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/acerts 887: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 888: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 889: --in ${TEST_KEY} --not-before "${START}" --not-after "${IM_END}" \ 890: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, CN=${CN}" \ 891: --outform pem > ${TEST_CERT} 892: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 893: 894: # Generate carol's attribute certificate for sales and finance 895: ACERT="${TEST}/hosts/moon/${IPSEC_DIR}/acerts/carol-sales-finance.pem" 896: pki --acert --issuerkey ${TEST_KEY} --issuercert ${TEST_CERT} \ 897: --in ${CA_DIR}/certs/01.pem --group sales --group finance \ 898: --not-before "${START}" --not-after "${EE_END}" --outform pem > ${ACERT} 899: 900: # Generate dave's expired attribute certificate for sales 901: ACERT="${TEST}/hosts/moon/${IPSEC_DIR}/acerts/dave-sales-expired.pem" 902: pki --acert --issuerkey ${TEST_KEY} --issuercert ${TEST_CERT} \ 903: --in ${CA_DIR}/certs/02.pem --group sales \ 904: --not-before "${START}" --not-after "${SH_END}" --outform pem > ${ACERT} 905: 906: # Generate dave's attribute certificate for marketing 907: ACERT_DM="${TEST}/hosts/moon/${IPSEC_DIR}/acerts/dave-marketing.pem" 908: pki --acert --issuerkey ${TEST_KEY} --issuercert ${TEST_CERT} \ 909: --in ${CA_DIR}/certs/02.pem --group marketing \ 910: --not-before "${SH_END}" --not-after "${EE_END}" --outform pem > ${ACERT_DM} 911: 912: # Put a copy into the ikev2/acert-fallback scenario 913: TEST="${TEST_DIR}/ikev2/acert-fallback" 914: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/private 915: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/aacerts 916: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/acerts 917: cp ${TEST_KEY} ${TEST}/hosts/moon/${IPSEC_DIR}/private 918: cp ${TEST_CERT} ${TEST}/hosts/moon/${IPSEC_DIR}/aacerts 919: 920: # Generate carol's expired attribute certificate for finance 921: ACERT=${TEST}/hosts/carol/${IPSEC_DIR}/acerts/carol-finance-expired.pem 922: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/acerts 923: pki --acert --issuerkey ${TEST_KEY} --issuercert ${TEST_CERT} \ 924: --in ${CA_DIR}/certs/01.pem --group finance \ 925: --not-before "${START}" --not-after "${SH_END}" --outform pem > ${ACERT} 926: 927: # Generate carol's valid attribute certificate for sales 928: ACERT_CS=${TEST}/hosts/carol/${IPSEC_DIR}/acerts/carol-sales.pem 929: pki --acert --issuerkey ${TEST_KEY} --issuercert ${TEST_CERT} \ 930: --in ${CA_DIR}/certs/01.pem --group sales \ 931: --not-before "${SH_END}" --not-after "${EE_END}" --outform pem > ${ACERT_CS} 932: 933: # Put a copy into the ikev2/acert-inline scenario 934: TEST="${TEST_DIR}/ikev2/acert-inline" 935: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/private 936: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/aacerts 937: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/acerts 938: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/acerts 939: cp ${TEST_KEY} ${TEST}/hosts/moon/${IPSEC_DIR}/private 940: cp ${TEST_CERT} ${TEST}/hosts/moon/${IPSEC_DIR}/aacerts 941: cp ${ACERT_CS} ${TEST}/hosts/carol/${IPSEC_DIR}/acerts 942: cp ${ACERT_DM} ${TEST}/hosts/dave/${IPSEC_DIR}/acerts 943: 944: # Generate a short-lived Attribute Authority certificate 945: CN="strongSwan Legacy AA" 946: TEST_KEY="${TEST}/hosts/moon/${IPSEC_DIR}/private/aaKey-expired.pem" 947: TEST_CERT="${TEST}/hosts/moon/${IPSEC_DIR}/aacerts/aaCert-expired.pem" 948: SERIAL="18" 949: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 950: pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \ 951: --in ${TEST_KEY} --not-before "${START}" --not-after "${SH_END}" \ 952: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, CN=${CN}" \ 953: --outform pem > ${TEST_CERT} 954: cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem 955: 956: # Generate dave's attribute certificate for sales from expired AA 957: ACERT=${TEST}/hosts/dave/${IPSEC_DIR}/acerts/dave-expired-aa.pem 958: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/acerts 959: pki --acert --issuerkey ${TEST_KEY} --issuercert ${TEST_CERT} \ 960: --in ${CA_DIR}/certs/02.pem --group sales \ 961: --not-before "${START}" --not-after "${EE_END}" --outform pem > ${ACERT} 962: 963: ################################################################################ 964: # strongSwan Root CA index for OCSP server # 965: ################################################################################ 966: 967: # generate index.txt file for Root OCSP server 968: cp ${CA_DIR}/index.txt.template ${CA_DIR}/index.txt 969: sed -i -e "s/EE_EXPIRATION/${EE_EXP}/g" ${CA_DIR}/index.txt 970: sed -i -e "s/IM_EXPIRATION/${IM_EXP}/g" ${CA_DIR}/index.txt 971: sed -i -e "s/SH_EXPIRATION/${SH_EXP}/g" ${CA_DIR}/index.txt 972: sed -i -e "s/REVOCATION/${NOW}/g" ${CA_DIR}/index.txt 973: 974: ################################################################################ 975: # Research CA # 976: ################################################################################ 977: 978: # Generate a carol research certificate 979: TEST="${TEST_DIR}/ikev2/multi-level-ca" 980: TEST_KEY="${TEST}/hosts/carol/${IPSEC_DIR}/private/carolKey.pem" 981: TEST_CERT="${TEST}/hosts/carol/${IPSEC_DIR}/certs/carolCert.pem" 982: CN="carol@strongswan.org" 983: SERIAL="01" 984: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 985: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/certs 986: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 987: pki --issue --cakey ${RESEARCH_KEY} --cacert ${RESEARCH_CERT} --type rsa \ 988: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 989: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Research, CN=${CN}" \ 990: --crl ${RESEARCH_CDP} --outform pem > ${TEST_CERT} 991: cp ${TEST_CERT} ${RESEARCH_DIR}/certs/${SERIAL}.pem 992: 993: # Save a copy of the private key in DER format 994: openssl rsa -in ${TEST_KEY} -outform der \ 995: -out ${RESEARCH_DIR}/keys/${SERIAL}.der 2> /dev/null 996: 997: # Put a copy in the following scenarios 998: for t in ikev2/multi-level-ca-cr-init ikev2/multi-level-ca-cr-resp \ 999: ikev2/multi-level-ca-ldap ikev2/multi-level-ca-loop \ 1000: ikev2/multi-level-ca-revoked ikev2/multi-level-ca-skipped \ 1001: ikev2/multi-level-ca-strict ikev2/ocsp-multi-level \ 1002: ikev1/multi-level-ca ikev1/multi-level-ca-cr-init \ 1003: ikev1/multi-level-ca-cr-resp 1004: do 1005: TEST="${TEST_DIR}/${t}" 1006: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 1007: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/certs 1008: cp ${TEST_KEY} ${TEST}/hosts/carol/${IPSEC_DIR}/private 1009: cp ${TEST_CERT} ${TEST}/hosts/carol/${IPSEC_DIR}/certs 1010: done 1011: 1012: for t in multi-level-ca rw-hash-and-url-multi-level ocsp-multi-level 1013: do 1014: TEST="${TEST_DIR}/swanctl/${t}" 1015: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/rsa 1016: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 1017: cp ${TEST_KEY} ${TEST}/hosts/carol/${SWANCTL_DIR}/rsa 1018: cp ${TEST_CERT} ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 1019: done 1020: 1021: # Generate a carol research certificate without a CDP 1022: TEST="${TEST_DIR}/ikev2/ocsp-strict-ifuri" 1023: TEST_CERT="${TEST}/hosts/carol/${IPSEC_DIR}/certs/carolCert.pem" 1024: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/certs 1025: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 1026: pki --issue --cakey ${RESEARCH_KEY} --cacert ${RESEARCH_CERT} --type rsa \ 1027: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1028: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Research, CN=${CN}" \ 1029: --outform pem > ${TEST_CERT} 1030: cp ${TEST_KEY} ${TEST}/hosts/carol/${IPSEC_DIR}/private 1031: 1032: # Generate an OCSP Signing certificate for the Research CA 1033: TEST_KEY="${RESEARCH_DIR}/ocspKey.pem" 1034: TEST_CERT="${RESEARCH_DIR}/ocspCert.pem" 1035: OU="Research OCSP Signing Authority" 1036: CN="ocsp.research.strongswan.org" 1037: SERIAL="02" 1038: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 1039: pki --issue --cakey ${RESEARCH_KEY} --cacert ${RESEARCH_CERT} --type rsa \ 1040: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1041: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=${OU}, CN=${CN}" \ 1042: --crl ${RESEARCH_CDP} --flag ocspSigning --outform pem > ${TEST_CERT} 1043: cp ${TEST_CERT} ${RESEARCH_DIR}/certs/${SERIAL}.pem 1044: 1045: # Generate a Sales CA certificate signed by the Research CA 1046: TEST="${TEST_DIR}/ikev2/multi-level-ca-loop" 1047: TEST_CERT="${TEST}/hosts/moon/${IPSEC_DIR}/cacerts/sales_by_researchCert.pem" 1048: SERIAL="03" 1049: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/cacerts 1050: pki --issue --cakey ${RESEARCH_KEY} --cacert ${RESEARCH_CERT} --type rsa \ 1051: --in ${SALES_KEY} --not-before "${START}" --not-after "${EE_END}" --ca \ 1052: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Sales, CN=Sales CA" \ 1053: --crl ${RESEARCH_CDP} --outform pem > ${TEST_CERT} 1054: cp ${TEST_CERT} ${RESEARCH_DIR}/certs/${SERIAL}.pem 1055: 1056: ################################################################################ 1057: # Duck Research CA # 1058: ################################################################################ 1059: 1060: # Generate a Duck Research CA certificate signed by the Research CA 1061: SERIAL="04" 1062: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${DUCK_KEY} 1063: pki --issue --cakey ${RESEARCH_KEY} --cacert ${RESEARCH_CERT} --type rsa \ 1064: --in ${DUCK_KEY} --not-before "${START}" --not-after "${EE_END}" --ca \ 1065: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Research, CN=Duck Research CA" \ 1066: --crl ${RESEARCH_CDP} --outform pem > ${DUCK_CERT} 1067: cp ${DUCK_CERT} ${RESEARCH_DIR}/certs/${SERIAL}.pem 1068: 1069: # Put a certificate copy in the ikev2/multilevel-ca-pathlen scenario 1070: TEST="${TEST_DIR}/ikev2/multi-level-ca-pathlen" 1071: cp ${DUCK_CERT} ${TEST}/hosts/moon/${IPSEC_DIR}/cacerts 1072: 1073: # Generate a carol certificate signed by the Duck Research CA 1074: TEST_KEY="${TEST}/hosts/carol/${IPSEC_DIR}/private/carolKey.pem" 1075: TEST_CERT="${TEST}/hosts/carol/${IPSEC_DIR}/certs/carolCert.pem" 1076: CN="carol@strongswan.org" 1077: SERIAL="01" 1078: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 1079: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/certs 1080: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 1081: pki --issue --cakey ${DUCK_KEY} --cacert ${DUCK_CERT} --type rsa \ 1082: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1083: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Duck Research, CN=${CN}" \ 1084: --outform pem > ${TEST_CERT} 1085: cp ${TEST_CERT} ${DUCK_DIR}/certs/${SERIAL}.pem 1086: 1087: # Generate index.txt file for Research OCSP server 1088: cp ${RESEARCH_DIR}/index.txt.template ${RESEARCH_DIR}/index.txt 1089: sed -i -e "s/EE_EXPIRATION/${EE_EXP}/g" ${RESEARCH_DIR}/index.txt 1090: 1091: ################################################################################ 1092: # Sales CA # 1093: ################################################################################ 1094: 1095: # Generate a dave sales certificate 1096: TEST="${TEST_DIR}/ikev2/multi-level-ca" 1097: TEST_KEY="${TEST}/hosts/dave/${IPSEC_DIR}/private/daveKey.pem" 1098: TEST_CERT="${TEST}/hosts/dave/${IPSEC_DIR}/certs/daveCert.pem" 1099: CN="dave@strongswan.org" 1100: SERIAL="01" 1101: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/private 1102: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/certs 1103: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 1104: pki --issue --cakey ${SALES_KEY} --cacert ${SALES_CERT} --type rsa \ 1105: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1106: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Sales, CN=${CN}" \ 1107: --crl ${SALES_CDP} --outform pem > ${TEST_CERT} 1108: cp ${TEST_CERT} ${SALES_DIR}/certs/${SERIAL}.pem 1109: 1110: # Save a copy of the private key in DER format 1111: openssl rsa -in ${TEST_KEY} -outform der \ 1112: -out ${SALES_DIR}/keys/${SERIAL}.der 2> /dev/null 1113: 1114: # Put a copy in the following scenarios 1115: for t in ikev2/multi-level-ca-cr-init ikev2/multi-level-ca-cr-resp \ 1116: ikev2/multi-level-ca-ldap ikev2/multi-level-ca-strict \ 1117: ikev2/ocsp-multi-level ikev1/multi-level-ca \ 1118: ikev1/multi-level-ca-cr-init ikev1/multi-level-ca-cr-resp 1119: do 1120: TEST="${TEST_DIR}/${t}" 1121: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/private 1122: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/certs 1123: cp ${TEST_KEY} ${TEST}/hosts/dave/${IPSEC_DIR}/private 1124: cp ${TEST_CERT} ${TEST}/hosts/dave/${IPSEC_DIR}/certs 1125: done 1126: 1127: for t in multi-level-ca rw-hash-and-url-multi-level ocsp-multi-level 1128: do 1129: TEST="${TEST_DIR}/swanctl/${t}" 1130: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/rsa 1131: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/x509 1132: cp ${TEST_KEY} ${TEST}/hosts/dave/${SWANCTL_DIR}/rsa 1133: cp ${TEST_CERT} ${TEST}/hosts/dave/${SWANCTL_DIR}/x509 1134: done 1135: 1136: # Generate a dave sales certificate with an inactive OCSP URI and no CDP 1137: TEST="${TEST_DIR}/ikev2/ocsp-strict-ifuri" 1138: TEST_CERT="${TEST}/hosts/dave/${IPSEC_DIR}/certs/daveCert.pem" 1139: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/certs 1140: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/private 1141: pki --issue --cakey ${SALES_KEY} --cacert ${SALES_CERT} --type rsa \ 1142: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1143: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Sales, CN=${CN}" \ 1144: --ocsp "http://ocsp2.strongswan.org:8882" --outform pem > ${TEST_CERT} 1145: cp ${TEST_KEY} ${TEST}/hosts/dave/${IPSEC_DIR}/private 1146: 1147: # Generate an OCSP Signing certificate for the Sales CA 1148: TEST_KEY="${SALES_DIR}/ocspKey.pem" 1149: TEST_CERT="${SALES_DIR}/ocspCert.pem" 1150: OU="Sales OCSP Signing Authority" 1151: CN="ocsp.sales.strongswan.org" 1152: SERIAL="02" 1153: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 1154: pki --issue --cakey ${SALES_KEY} --cacert ${SALES_CERT} --type rsa \ 1155: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1156: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=${OU}, CN=${CN}" \ 1157: --crl ${SALES_CDP} --flag ocspSigning --outform pem > ${TEST_CERT} 1158: cp ${TEST_CERT} ${SALES_DIR}/certs/${SERIAL}.pem 1159: 1160: # Generate a Research CA certificate signed by the Sales CA 1161: TEST="${TEST_DIR}/ikev2/multi-level-ca-loop" 1162: TEST_CERT="${TEST}/hosts/moon/${IPSEC_DIR}/cacerts/research_by_salesCert.pem" 1163: SERIAL="03" 1164: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/cacerts 1165: pki --issue --cakey ${SALES_KEY} --cacert ${SALES_CERT} --type rsa \ 1166: --in ${RESEARCH_KEY} --not-before "${START}" --not-after "${EE_END}" --ca \ 1167: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Research, CN=Research CA" \ 1168: --crl ${SALES_CDP} --outform pem > ${TEST_CERT} 1169: cp ${TEST_CERT} ${SALES_DIR}/certs/${SERIAL}.pem 1170: 1171: # generate index.txt file for Sales OCSP server 1172: cp ${SALES_DIR}/index.txt.template ${SALES_DIR}/index.txt 1173: sed -i -e "s/EE_EXPIRATION/${EE_EXP}/g" ${SALES_DIR}/index.txt 1174: 1175: ################################################################################ 1176: # Levels L3 CA # 1177: ################################################################################ 1178: 1179: # Generate a carol l3 certificate 1180: TEST="${TEST_DIR}/swanctl/multi-level-ca-l3" 1181: TEST_KEY="${TEST}/hosts/carol/${SWANCTL_DIR}/rsa/carolKey.pem" 1182: TEST_CERT="${TEST}/hosts/carol/${SWANCTL_DIR}/x509/carolCert.pem" 1183: CN="carol@strongswan.org" 1184: SERIAL="01" 1185: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/rsa 1186: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 1187: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 1188: pki --issue --cakey ${LEVELS_L3_KEY} --cacert ${LEVELS_L3_CERT} --type rsa \ 1189: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1190: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=L3, CN=${CN}" \ 1191: --crl ${LEVELS_L3_CDP} --outform pem > ${TEST_CERT} 1192: cp ${TEST_CERT} ${LEVELS_DIR}/certs/${SERIAL}.pem 1193: 1194: for t in tkm/multi-level-ca 1195: do 1196: TEST="${TEST_DIR}/${t}" 1197: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/rsa 1198: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 1199: cp ${TEST_KEY} ${TEST}/hosts/carol/${SWANCTL_DIR}/rsa 1200: cp ${TEST_CERT} ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 1201: done 1202: 1203: ################################################################################ 1204: # strongSwan EC Root CA # 1205: ################################################################################ 1206: 1207: # Generate strongSwan EC Root CA 1208: pki --gen --type ecdsa --size 521 --outform pem > ${ECDSA_KEY} 1209: pki --self --type ecdsa --in ${ECDSA_KEY} \ 1210: --not-before "${START}" --not-after "${CA_END}" --ca \ 1211: --dn "C=CH, O=${PROJECT}, CN=strongSwan EC Root CA" \ 1212: --outform pem > ${ECDSA_CERT} 1213: 1214: # Put a copy in the openssl-ikev2/ecdsa-certs scenario 1215: for t in ecdsa-certs ecdsa-pkcs8 1216: do 1217: TEST="${TEST_DIR}/openssl-ikev2/${t}" 1218: for h in moon carol dave 1219: do 1220: mkdir -p ${TEST}/hosts/${h}/${SWANCTL_DIR}/x509ca 1221: cp ${ECDSA_CERT} ${TEST}/hosts/${h}/${SWANCTL_DIR}/x509ca 1222: done 1223: done 1224: 1225: # Generate a moon ECDSA 521 bit certificate 1226: TEST="${TEST_DIR}/openssl-ikev2/ecdsa-certs" 1227: MOON_KEY="${TEST}/hosts/moon/${SWANCTL_DIR}/ecdsa/moonKey.pem" 1228: MOON_CERT="${TEST}/hosts/moon/${SWANCTL_DIR}/x509/moonCert.pem" 1229: CN="moon.strongswan.org" 1230: SERIAL="01" 1231: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/ecdsa 1232: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509 1233: pki --gen --type ecdsa --size 521 --outform pem > ${MOON_KEY} 1234: pki --issue --cakey ${ECDSA_KEY} --cacert ${ECDSA_CERT} --type ecdsa \ 1235: --in ${MOON_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1236: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=ECDSA 512 bit, CN=${CN}" \ 1237: --crl ${ECDSA_CDP} --outform pem > ${MOON_CERT} 1238: cp ${MOON_CERT} ${ECDSA_DIR}/certs/${SERIAL}.pem 1239: 1240: # Generate a carol ECDSA 256 bit certificate 1241: CAROL_KEY="${TEST}/hosts/carol/${SWANCTL_DIR}/ecdsa/carolKey.pem" 1242: CAROL_CERT="${TEST}/hosts/carol/${SWANCTL_DIR}/x509/carolCert.pem" 1243: CN="carol@strongswan.org" 1244: SERIAL="02" 1245: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/ecdsa 1246: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 1247: pki --gen --type ecdsa --size 256 --outform pem > ${CAROL_KEY} 1248: pki --issue --cakey ${ECDSA_KEY} --cacert ${ECDSA_CERT} --type ecdsa \ 1249: --in ${CAROL_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1250: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=ECDSA 256 bit, CN=${CN}" \ 1251: --crl ${ECDSA_CDP} --outform pem > ${CAROL_CERT} 1252: cp ${CAROL_CERT} ${ECDSA_DIR}/certs/${SERIAL}.pem 1253: 1254: # Generate a dave ECDSA 384 bit certificate 1255: DAVE_KEY="${TEST}/hosts/dave/${SWANCTL_DIR}/ecdsa/daveKey.pem" 1256: DAVE_CERT="${TEST}/hosts/dave/${SWANCTL_DIR}/x509/daveCert.pem" 1257: CN="dave@strongswan.org" 1258: SERIAL="03" 1259: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/ecdsa 1260: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/x509 1261: pki --gen --type ecdsa --size 384 --outform pem > ${DAVE_KEY} 1262: pki --issue --cakey ${ECDSA_KEY} --cacert ${ECDSA_CERT} --type ecdsa \ 1263: --in ${DAVE_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1264: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=ECDSA 384 bit, CN=${CN}" \ 1265: --crl ${ECDSA_CDP} --outform pem > ${DAVE_CERT} 1266: cp ${DAVE_CERT} ${ECDSA_DIR}/certs/${SERIAL}.pem 1267: 1268: # Put CA and EE certificate copies in the openssl-ikev2/ecdsa-pkcs8 scenario 1269: TEST="${TEST_DIR}/openssl-ikev2/ecdsa-pkcs8" 1270: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509 1271: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 1272: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/x509 1273: cp ${MOON_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509 1274: cp ${CAROL_CERT} ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 1275: cp ${DAVE_CERT} ${TEST}/hosts/dave/${SWANCTL_DIR}/x509 1276: 1277: # Convert moon private key into unencrypted PKCS#8 format 1278: TEST_KEY="${TEST}/hosts/moon/${SWANCTL_DIR}/pkcs8/moonKey.pem" 1279: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/pkcs8 1280: openssl pkcs8 -in ${MOON_KEY} -nocrypt -topk8 -out ${TEST_KEY} 1281: 1282: # Convert carol private key into v1.5 DES encrypted PKCS#8 format 1283: TEST_KEY="${TEST}/hosts/carol/${SWANCTL_DIR}/pkcs8/carolKey.pem" 1284: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/pkcs8 1285: openssl pkcs8 -in ${CAROL_KEY} -nocrypt -topk8 -v1 PBE-MD5-DES \ 1286: -passout "pass:nH5ZQEWtku0RJEZ6" -out ${TEST_KEY} 1287: 1288: # Convert dave private key into v2.0 AES-128 encrypted PKCS#8 format 1289: TEST_KEY="${TEST}/hosts/dave/${SWANCTL_DIR}/pkcs8/daveKey.pem" 1290: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/pkcs8 1291: openssl pkcs8 -in ${DAVE_KEY} -nocrypt -topk8 -v2 aes128 \ 1292: -passout "pass:OJlNZBx+80dLh4wC6fw5LmBd" -out ${TEST_KEY} 1293: 1294: # Put CA and EE certificate copies in the openssl-ikev1/ecdsa-certs scenario 1295: TEST="${TEST_DIR}/openssl-ikev1/ecdsa-certs" 1296: cd ${TEST}/hosts/moon/${SWANCTL_DIR} 1297: mkdir -p ecdsa x509 x509ca 1298: cp ${MOON_KEY} ecdsa 1299: cp ${MOON_CERT} x509 1300: cp ${ECDSA_CERT} x509ca 1301: cd ${TEST}/hosts/carol/${SWANCTL_DIR} 1302: mkdir -p ecdsa x509 x509ca 1303: cp ${CAROL_KEY} ecdsa 1304: cp ${CAROL_CERT} x509 1305: cp ${ECDSA_CERT} x509ca 1306: cd ${TEST}/hosts/dave/${SWANCTL_DIR} 1307: mkdir -p ecdsa x509 x509ca 1308: cp ${DAVE_KEY} ecdsa 1309: cp ${DAVE_CERT} x509 1310: cp ${ECDSA_CERT} x509ca 1311: 1312: ################################################################################ 1313: # strongSwan RFC3779 Root CA # 1314: ################################################################################ 1315: 1316: # Generate strongSwan RFC3779 Root CA 1317: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${RFC3779_KEY} 1318: pki --self --type rsa --in ${RFC3779_KEY} \ 1319: --not-before "${START}" --not-after "${CA_END}" --ca \ 1320: --dn "C=CH, O=${PROJECT}, OU=RFC3779, CN=strongSwan RFC3779 Root CA" \ 1321: --addrblock "10.1.0.0-10.2.255.255" \ 1322: --addrblock "10.3.0.1-10.3.3.232" \ 1323: --addrblock "192.168.0.0/24" \ 1324: --addrblock "fec0::-fec2:ffff:ffff:ffff:ffff:ffff:ffff:ffff" \ 1325: --outform pem > ${RFC3779_CERT} 1326: 1327: # Put a copy in the ikev2/net2net-rfc3779 scenario 1328: TEST="${TEST_DIR}/ikev2/net2net-rfc3779" 1329: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/cacerts 1330: mkdir -p ${TEST}/hosts/sun/${IPSEC_DIR}/cacerts 1331: cp ${RFC3779_CERT} ${TEST}/hosts/moon/${IPSEC_DIR}/cacerts 1332: cp ${RFC3779_CERT} ${TEST}/hosts/sun/${IPSEC_DIR}/cacerts 1333: 1334: # Put a copy in the ipv6/rw-rfc3779-ikev2 scenario 1335: TEST="${TEST_DIR}/ipv6/rw-rfc3779-ikev2" 1336: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509ca 1337: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/x509ca 1338: cp ${RFC3779_CERT} ${TEST}/hosts/carol/${SWANCTL_DIR}/x509ca 1339: cp ${RFC3779_CERT} ${TEST}/hosts/dave/${SWANCTL_DIR}/x509ca 1340: 1341: # Generate a moon RFC3779 certificate 1342: TEST="${TEST_DIR}/ikev2/net2net-rfc3779" 1343: TEST_KEY="${TEST}/hosts/moon/${IPSEC_DIR}/private/moonKey.pem" 1344: TEST_CERT="${TEST}/hosts/moon/${IPSEC_DIR}/certs/moonCert.pem" 1345: CN="moon.strongswan.org" 1346: SERIAL="01" 1347: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/private 1348: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/certs 1349: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 1350: pki --issue --cakey ${RFC3779_KEY} --cacert ${RFC3779_CERT} --type rsa \ 1351: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1352: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=RFC3779, CN=${CN}" \ 1353: --addrblock "10.1.0.0/16" --addrblock "192.168.0.1/32" \ 1354: --addrblock "fec0::1/128" --addrblock "fec1::/16" \ 1355: --crl ${RFC3779_CDP} --outform pem > ${TEST_CERT} 1356: cp ${TEST_CERT} ${RFC3779_DIR}/certs/${SERIAL}.pem 1357: 1358: # Put a copy in the ipv6 scenarios 1359: for t in net2net-rfc3779-ikev2 rw-rfc3779-ikev2 1360: do 1361: cd "${TEST_DIR}/ipv6/${t}/hosts/moon/${SWANCTL_DIR}" 1362: mkdir -p rsa x509 x509ca 1363: cp ${TEST_KEY} rsa 1364: cp ${TEST_CERT} x509 1365: cp ${RFC3779_CERT} x509ca 1366: done 1367: 1368: # Generate a sun RFC3779 certificate 1369: TEST="${TEST_DIR}/ikev2/net2net-rfc3779" 1370: TEST_KEY="${TEST}/hosts/sun/${IPSEC_DIR}/private/sunKey.pem" 1371: TEST_CERT="${TEST}/hosts/sun/${IPSEC_DIR}/certs/sunCert.pem" 1372: CN="sun.strongswan.org" 1373: SERIAL="02" 1374: mkdir -p ${TEST}/hosts/sun/${IPSEC_DIR}/private 1375: mkdir -p ${TEST}/hosts/sun/${IPSEC_DIR}/certs 1376: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 1377: pki --issue --cakey ${RFC3779_KEY} --cacert ${RFC3779_CERT} --type rsa \ 1378: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1379: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=RFC3779, CN=${CN}" \ 1380: --addrblock "10.2.0.0/16" --addrblock "192.168.0.2/32" \ 1381: --addrblock "fec0::2/128" --addrblock "fec2::/16" \ 1382: --crl ${RFC3779_CDP} --outform pem > ${TEST_CERT} 1383: cp ${TEST_CERT} ${RFC3779_DIR}/certs/${SERIAL}.pem 1384: 1385: # Put a copy in the ipv6/net2net-rfc3779-ikev2 scenario 1386: cd "${TEST_DIR}/ipv6/net2net-rfc3779-ikev2/hosts/sun/${SWANCTL_DIR}" 1387: mkdir -p rsa x509 x509ca 1388: cp ${TEST_KEY} rsa 1389: cp ${TEST_CERT} x509 1390: cp ${RFC3779_CERT} x509ca 1391: 1392: # Generate a carol RFC3779 certificate 1393: TEST="${TEST_DIR}/ipv6/rw-rfc3779-ikev2" 1394: TEST_KEY="${TEST}/hosts/carol/${SWANCTL_DIR}/rsa/carolKey.pem" 1395: TEST_CERT="${TEST}/hosts/carol/${SWANCTL_DIR}/x509/carolCert.pem" 1396: CN="carol@strongswan.org" 1397: SERIAL="03" 1398: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/rsa 1399: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 1400: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 1401: pki --issue --cakey ${RFC3779_KEY} --cacert ${RFC3779_CERT} --type rsa \ 1402: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1403: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=RFC3779, CN=${CN}" \ 1404: --addrblock "10.3.0.1/32" --addrblock "192.168.0.100/32" \ 1405: --addrblock "fec0::10/128" \ 1406: --crl ${RFC3779_CDP} --outform pem > ${TEST_CERT} 1407: cp ${TEST_CERT} ${RFC3779_DIR}/certs/${SERIAL}.pem 1408: 1409: # Generate a carol RFC3779 certificate 1410: TEST="${TEST_DIR}/ipv6/rw-rfc3779-ikev2" 1411: TEST_KEY="${TEST}/hosts/dave/${SWANCTL_DIR}/rsa/daveKey.pem" 1412: TEST_CERT="${TEST}/hosts/dave/${SWANCTL_DIR}/x509/daveCert.pem" 1413: CN="dave@strongswan.org" 1414: SERIAL="04" 1415: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/rsa 1416: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/x509 1417: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 1418: pki --issue --cakey ${RFC3779_KEY} --cacert ${RFC3779_CERT} --type rsa \ 1419: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1420: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=RFC3779, CN=${CN}" \ 1421: --addrblock "10.3.0.2/32" --addrblock "192.168.0.200/32" \ 1422: --addrblock "fec0::20/128" \ 1423: --crl ${RFC3779_CDP} --outform pem > ${TEST_CERT} 1424: cp ${TEST_CERT} ${RFC3779_DIR}/certs/${SERIAL}.pem 1425: 1426: ################################################################################ 1427: # strongSwan SHA3-RSA Root CA # 1428: ################################################################################ 1429: 1430: # Use specific plugin configuration to issue certificates with SHA-3 signatures 1431: # as not all crypto plugins support them. To avoid entropy issues use the 1432: # default plugins to generate the keys. 1433: SHA3_PKI_PLUGINS="gmp pem pkcs1 random sha1 sha3 x509" 1434: 1435: # Generate strongSwan SHA3-RSA Root CA 1436: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${SHA3_RSA_KEY} 1437: PKI_PLUGINS="${SHA3_PKI_PLUGINS}" \ 1438: pki --self --type rsa --in ${SHA3_RSA_KEY} --digest sha3_256 \ 1439: --not-before "${START}" --not-after "${CA_END}" --ca \ 1440: --dn "C=CH, O=${PROJECT}, OU=SHA-3, CN=strongSwan Root CA" \ 1441: --outform pem > ${SHA3_RSA_CERT} 1442: 1443: # Put a copy in the swanctl/net2net-sha3-rsa-cert scenario 1444: TEST="${TEST_DIR}/swanctl/net2net-sha3-rsa-cert" 1445: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509ca 1446: mkdir -p ${TEST}/hosts/sun/${SWANCTL_DIR}/x509ca 1447: cp ${SHA3_RSA_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509ca 1448: cp ${SHA3_RSA_CERT} ${TEST}/hosts/sun/${SWANCTL_DIR}/x509ca 1449: 1450: # Generate a sun SHA3-RSA certificate 1451: SUN_KEY="${TEST}/hosts/sun/${SWANCTL_DIR}/rsa/sunKey.pem" 1452: SUN_CERT="${TEST}/hosts/sun/${SWANCTL_DIR}/x509/sunCert.pem" 1453: CN="sun.strongswan.org" 1454: SERIAL="01" 1455: mkdir -p ${TEST}/hosts/sun/${SWANCTL_DIR}/rsa 1456: mkdir -p ${TEST}/hosts/sun/${SWANCTL_DIR}/x509 1457: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${SUN_KEY} 1458: PKI_PLUGINS="${SHA3_PKI_PLUGINS}" \ 1459: pki --issue --cakey ${SHA3_RSA_KEY} --cacert ${SHA3_RSA_CERT} --type rsa \ 1460: --in ${SUN_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1461: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=SHA-3, CN=${CN}" \ 1462: --crl ${SHA3_RSA_CDP} --digest sha3_256 --outform pem > ${SUN_CERT} 1463: cp ${SUN_CERT} ${SHA3_RSA_DIR}/certs/${SERIAL}.pem 1464: 1465: # Generate a moon SHA3-RSA certificate 1466: MOON_KEY="${TEST}/hosts/moon/${SWANCTL_DIR}/rsa/moonKey.pem" 1467: MOON_CERT="${TEST}/hosts/moon/${SWANCTL_DIR}/x509/moonCert.pem" 1468: CN="moon.strongswan.org" 1469: SERIAL="02" 1470: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/rsa 1471: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509 1472: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${MOON_KEY} 1473: PKI_PLUGINS="${SHA3_PKI_PLUGINS}" \ 1474: pki --issue --cakey ${SHA3_RSA_KEY} --cacert ${SHA3_RSA_CERT} --type rsa \ 1475: --in ${MOON_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1476: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=SHA-3, CN=${CN}" \ 1477: --crl ${SHA3_RSA_CDP} --digest sha3_256 --outform pem > ${MOON_CERT} 1478: cp ${MOON_CERT} ${SHA3_RSA_DIR}/certs/${SERIAL}.pem 1479: 1480: # Put a copy in the botan/net2net-sha3-rsa-cert scenario 1481: TEST="${TEST_DIR}/botan/net2net-sha3-rsa-cert" 1482: cd ${TEST}/hosts/moon/${SWANCTL_DIR} 1483: mkdir -p rsa x509 x509ca 1484: cp ${MOON_KEY} rsa 1485: cp ${MOON_CERT} x509 1486: cp ${SHA3_RSA_CERT} x509ca 1487: cd ${TEST}/hosts/sun/${SWANCTL_DIR} 1488: mkdir -p rsa x509 x509ca 1489: cp ${SUN_KEY} rsa 1490: cp ${SUN_CERT} x509 1491: cp ${SHA3_RSA_CERT} x509ca 1492: 1493: # Put a copy in the swanctl/rw-eap-tls-sha3-rsa scenario 1494: TEST="${TEST_DIR}/swanctl/rw-eap-tls-sha3-rsa" 1495: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/rsa 1496: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509 1497: cp ${MOON_KEY} ${TEST}/hosts/moon/${SWANCTL_DIR}/rsa 1498: cp ${MOON_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509 1499: 1500: # Generate a carol SHA3-RSA certificate 1501: TEST_KEY="${TEST}/hosts/carol/${SWANCTL_DIR}/rsa/carolKey.pem" 1502: TEST_CERT="${TEST}/hosts/carol/${SWANCTL_DIR}/x509/carolCert.pem" 1503: CN="carol@strongswan.org" 1504: SERIAL="03" 1505: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/rsa 1506: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 1507: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 1508: PKI_PLUGINS="${SHA3_PKI_PLUGINS}" \ 1509: pki --issue --cakey ${SHA3_RSA_KEY} --cacert ${SHA3_RSA_CERT} --type rsa \ 1510: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1511: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=SHA-3, CN=${CN}" \ 1512: --crl ${SHA3_RSA_CDP} --digest sha3_256 --outform pem > ${TEST_CERT} 1513: cp ${TEST_CERT} ${SHA3_RSA_DIR}/certs/${SERIAL}.pem 1514: 1515: # Generate a dave SHA3-RSA certificate 1516: TEST_KEY="${TEST}/hosts/dave/${SWANCTL_DIR}/rsa/daveKey.pem" 1517: TEST_CERT="${TEST}/hosts/dave/${SWANCTL_DIR}/x509/daveCert.pem" 1518: CN="dave@strongswan.org" 1519: SERIAL="04" 1520: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/rsa 1521: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/x509 1522: pki --gen --type rsa --size ${RSA_SIZE} --outform pem > ${TEST_KEY} 1523: PKI_PLUGINS="${SHA3_PKI_PLUGINS}" \ 1524: pki --issue --cakey ${SHA3_RSA_KEY} --cacert ${SHA3_RSA_CERT} --type rsa \ 1525: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1526: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=SHA-3, CN=${CN}" \ 1527: --crl ${SHA3_RSA_CDP} --digest sha3_256 --outform pem > ${TEST_CERT} 1528: cp ${TEST_CERT} ${SHA3_RSA_DIR}/certs/${SERIAL}.pem 1529: 1530: for h in moon carol dave 1531: do 1532: mkdir -p ${TEST}/hosts/${h}/${SWANCTL_DIR}/x509ca 1533: cp ${SHA3_RSA_CERT} ${TEST}/hosts/${h}/${SWANCTL_DIR}/x509ca 1534: done 1535: 1536: ################################################################################ 1537: # strongSwan Ed25519 Root CA # 1538: ################################################################################ 1539: 1540: # Generate strongSwan Ed25519 Root CA 1541: pki --gen --type ed25519 --outform pem > ${ED25519_KEY} 1542: pki --self --type ed25519 --in ${ED25519_KEY} \ 1543: --not-before "${START}" --not-after "${CA_END}" --ca \ 1544: --dn "C=CH, O=${PROJECT}, CN=strongSwan Ed25519 Root CA" \ 1545: --cert-policy "1.3.6.1.4.1.36906.1.1.1" \ 1546: --cert-policy "1.3.6.1.4.1.36906.1.1.2" \ 1547: --outform pem > ${ED25519_CERT} 1548: 1549: # Put a copy in the swanctl/net2net-ed25519 scenario 1550: TEST="${TEST_DIR}/swanctl/net2net-ed25519" 1551: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509ca 1552: mkdir -p ${TEST}/hosts/sun/${SWANCTL_DIR}/x509ca 1553: cp ${ED25519_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509ca 1554: cp ${ED25519_CERT} ${TEST}/hosts/sun/${SWANCTL_DIR}/x509ca 1555: 1556: # Generate a sun Ed25519 certificate 1557: SUN_KEY="${TEST}/hosts/sun/${SWANCTL_DIR}/pkcs8/sunKey.pem" 1558: SUN_CERT="${TEST}/hosts/sun/${SWANCTL_DIR}/x509/sunCert.pem" 1559: CN="sun.strongswan.org" 1560: SERIAL="01" 1561: mkdir -p ${TEST}/hosts/sun/${SWANCTL_DIR}/pkcs8 1562: mkdir -p ${TEST}/hosts/sun/${SWANCTL_DIR}/x509 1563: pki --gen --type ed25519 --outform pem > ${SUN_KEY} 1564: pki --issue --cakey ${ED25519_KEY} --cacert ${ED25519_CERT} --type ed25519 \ 1565: --in ${SUN_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1566: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Ed25519, CN=${CN}" \ 1567: --cert-policy "1.3.6.1.4.1.36906.1.1.2" --flag "serverAuth" \ 1568: --crl ${ED25519_CDP} --outform pem > ${SUN_CERT} 1569: cp ${SUN_CERT} ${ED25519_DIR}/certs/${SERIAL}.pem 1570: 1571: # Generate a moon Ed25519 certificate 1572: MOON_KEY="${TEST}/hosts/moon/${SWANCTL_DIR}/pkcs8/moonKey.pem" 1573: MOON_CERT="${TEST}/hosts/moon/${SWANCTL_DIR}/x509/moonCert.pem" 1574: CN="moon.strongswan.org" 1575: SERIAL="02" 1576: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/pkcs8 1577: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509 1578: pki --gen --type ed25519 --outform pem > ${MOON_KEY} 1579: pki --issue --cakey ${ED25519_KEY} --cacert ${ED25519_CERT} --type ed25519 \ 1580: --in ${MOON_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1581: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Ed25519, CN=${CN}" \ 1582: --cert-policy "1.3.6.1.4.1.36906.1.1.1" --flag "serverAuth" \ 1583: --crl ${ED25519_CDP} --outform pem > ${MOON_CERT} 1584: cp ${MOON_CERT} ${ED25519_DIR}/certs/${SERIAL}.pem 1585: 1586: # Put a copy in the botan/net2net-ed25519 scenario 1587: TEST="${TEST_DIR}/botan/net2net-ed25519" 1588: cd ${TEST}/hosts/moon/${SWANCTL_DIR} 1589: mkdir -p pkcs8 x509 x509ca 1590: cp ${MOON_KEY} pkcs8 1591: cp ${MOON_CERT} x509 1592: cp ${ED25519_CERT} x509ca 1593: cd ${TEST}/hosts/sun/${SWANCTL_DIR} 1594: mkdir -p pkcs8 x509 x509ca 1595: cp ${SUN_KEY} pkcs8 1596: cp ${SUN_CERT} x509 1597: cp ${ED25519_CERT} x509ca 1598: 1599: # Put a copy in the ikev2/net2net-ed25519 scenario 1600: TEST="${TEST_DIR}/ikev2/net2net-ed25519" 1601: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR} 1602: cd ${TEST}/hosts/moon/${IPSEC_DIR} 1603: mkdir -p cacerts certs private 1604: cp ${MOON_KEY} private 1605: cp ${MOON_CERT} certs 1606: cp ${ED25519_CERT} cacerts 1607: mkdir -p ${TEST}/hosts/sun/${IPSEC_DIR} 1608: cd ${TEST}/hosts/sun/${IPSEC_DIR} 1609: mkdir -p cacerts certs private 1610: cp ${SUN_KEY} private 1611: cp ${SUN_CERT} certs 1612: cp ${ED25519_CERT} cacerts 1613: 1614: # Put a copy in the swanctl/rw-ed25519-certpol scenario 1615: TEST="${TEST_DIR}/swanctl/rw-ed25519-certpol" 1616: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/pkcs8 1617: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509 1618: cp ${MOON_KEY} ${TEST}/hosts/moon/${SWANCTL_DIR}/pkcs8 1619: cp ${MOON_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509 1620: 1621: for h in moon carol dave 1622: do 1623: mkdir -p ${TEST}/hosts/${h}/${SWANCTL_DIR}/x509ca 1624: cp ${ED25519_CERT} ${TEST}/hosts/${h}/${SWANCTL_DIR}/x509ca 1625: done 1626: 1627: # Generate a carol Ed25519 certificate 1628: TEST_KEY="${TEST}/hosts/carol/${SWANCTL_DIR}/pkcs8/carolKey.pem" 1629: TEST_CERT="${TEST}/hosts/carol/${SWANCTL_DIR}/x509/carolCert.pem" 1630: CN="carol@strongswan.org" 1631: SERIAL="03" 1632: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/pkcs8 1633: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 1634: pki --gen --type ed25519 --outform pem > ${TEST_KEY} 1635: pki --issue --cakey ${ED25519_KEY} --cacert ${ED25519_CERT} --type ed25519 \ 1636: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1637: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Ed25519, CN=${CN}" \ 1638: --cert-policy "1.3.6.1.4.1.36906.1.1.1" --flag "clientAuth" \ 1639: --crl ${ED25519_CDP} --outform pem > ${TEST_CERT} 1640: cp ${TEST_CERT} ${ED25519_DIR}/certs/${SERIAL}.pem 1641: 1642: # Generate a dave Ed25519 certificate 1643: TEST_KEY="${TEST}/hosts/dave/${SWANCTL_DIR}/pkcs8/daveKey.pem" 1644: TEST_CERT="${TEST}/hosts/dave/${SWANCTL_DIR}/x509/daveCert.pem" 1645: CN="dave@strongswan.org" 1646: SERIAL="04" 1647: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/pkcs8 1648: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/x509 1649: pki --gen --type ed25519 --outform pem > ${TEST_KEY} 1650: pki --issue --cakey ${ED25519_KEY} --cacert ${ED25519_CERT} --type ed25519 \ 1651: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1652: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Ed25519, CN=${CN}" \ 1653: --cert-policy "1.3.6.1.4.1.36906.1.1.2" --flag "clientAuth" \ 1654: --crl ${ED25519_CDP} --outform pem > ${TEST_CERT} 1655: cp ${TEST_CERT} ${ED25519_DIR}/certs/${SERIAL}.pem 1656: 1657: ################################################################################ 1658: # strongSwan Monster Root CA # 1659: ################################################################################ 1660: 1661: # Generate strongSwan Monster Root CA 1662: pki --gen --type rsa --size ${MONSTER_CA_RSA_SIZE} --outform pem > ${MONSTER_KEY} 1663: pki --self --type rsa --in ${MONSTER_KEY} \ 1664: --not-before "01.05.09 15:00:00" --not-after "01.05.59 15:00:00" --ca \ 1665: --dn "C=CH, O=${PROJECT}, CN=strongSwan Monster CA" \ 1666: --outform pem > ${MONSTER_CERT} 1667: 1668: # Put a copy in the ikev2/after-2038-certs scenario 1669: TEST="${TEST_DIR}/ikev2/after-2038-certs" 1670: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/cacerts 1671: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/cacerts 1672: cp ${MONSTER_CERT} ${TEST}/hosts/moon/${IPSEC_DIR}/cacerts 1673: cp ${MONSTER_CERT} ${TEST}/hosts/carol/${IPSEC_DIR}/cacerts 1674: 1675: # Generate a moon Monster certificate 1676: TEST_KEY="${TEST}/hosts/moon/${IPSEC_DIR}/private/moonKey.pem" 1677: TEST_CERT="${TEST}/hosts/moon/${IPSEC_DIR}/certs/moonCert.pem" 1678: CN="moon.strongswan.org" 1679: SERIAL="01" 1680: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/private 1681: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/certs 1682: pki --gen --type rsa --size ${MONSTER_EE_RSA_SIZE} --outform pem > ${TEST_KEY} 1683: pki --issue --cakey ${MONSTER_KEY} --cacert ${MONSTER_CERT} --type rsa \ 1684: --in ${TEST_KEY} --san ${CN} \ 1685: --not-before "01.05.09 15:00:00" --not-after "01.05.39 15:00:00" - \ 1686: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Monster, CN=${CN}" \ 1687: --crl ${MONSTER_CDP} --outform pem > ${TEST_CERT} 1688: cp ${TEST_CERT} ${MONSTER_DIR}/certs/${SERIAL}.pem 1689: 1690: # Generate a carol Monster certificate 1691: TEST_KEY="${TEST}/hosts/carol/${IPSEC_DIR}/private/carolKey.pem" 1692: TEST_CERT="${TEST}/hosts/carol/${IPSEC_DIR}/certs/carolCert.pem" 1693: CN="carol@strongswan.org" 1694: SERIAL="02" 1695: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 1696: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/certs 1697: pki --gen --type rsa --size ${MONSTER_EE_RSA_SIZE} --outform pem > ${TEST_KEY} 1698: pki --issue --cakey ${MONSTER_KEY} --cacert ${MONSTER_CERT} --type rsa \ 1699: --in ${TEST_KEY} --san ${CN} \ 1700: --not-before "01.05.09 15:00:00" --not-after "01.05.39 15:00:00" - \ 1701: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=Monster, CN=${CN}" \ 1702: --crl ${MONSTER_CDP} --outform pem > ${TEST_CERT} 1703: cp ${TEST_CERT} ${MONSTER_DIR}/certs/${SERIAL}.pem 1704: 1705: ################################################################################ 1706: # Bliss CA # 1707: ################################################################################ 1708: 1709: # Generate BLISS Root CA with 192 bit security strength 1710: pki --gen --type bliss --size 4 > ${BLISS_KEY} 1711: pki --self --type bliss --in ${BLISS_KEY} --digest sha3_512 \ 1712: --not-before "${START}" --not-after "${CA_END}" --ca \ 1713: --dn "C=CH, O=${PROJECT}, CN=strongSwan BLISS Root CA" > ${BLISS_CERT} 1714: 1715: # Put a copy in the following scenarios 1716: for t in rw-newhope-bliss rw-ntru-bliss 1717: do 1718: TEST="${TEST_DIR}/ikev2/${t}" 1719: for h in moon carol dave 1720: do 1721: mkdir -p ${TEST}/hosts/${h}/${IPSEC_DIR}/cacerts 1722: cp ${BLISS_CERT} ${TEST}/hosts/${h}/${IPSEC_DIR}/cacerts 1723: done 1724: 1725: TEST="${TEST_DIR}/swanctl/${t}" 1726: for h in moon carol dave 1727: do 1728: mkdir -p ${TEST}/hosts/${h}/${SWANCTL_DIR}/x509ca 1729: cp ${BLISS_CERT} ${TEST}/hosts/${h}/${SWANCTL_DIR}/x509ca 1730: done 1731: done 1732: 1733: # Generate a carol BLISS certificate with 128 bit security strength 1734: TEST="${TEST_DIR}/ikev2/rw-newhope-bliss" 1735: TEST_KEY="${TEST}/hosts/carol/${IPSEC_DIR}/private/carolKey.der" 1736: TEST_CERT="${TEST}/hosts/carol/${IPSEC_DIR}/certs/carolCert.der" 1737: CN="carol@strongswan.org" 1738: SERIAL="01" 1739: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 1740: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/certs 1741: pki --gen --type bliss --size 1 > ${TEST_KEY} 1742: pki --issue --cakey ${BLISS_KEY} --cacert ${BLISS_CERT} --type bliss \ 1743: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1744: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=BLISS I, CN=${CN}" \ 1745: --crl ${BLISS_CDP} --digest sha3_512 > ${TEST_CERT} 1746: cp ${TEST_CERT} ${BLISS_DIR}/certs/${SERIAL}.der 1747: 1748: # Put a copy in the ikev2/rw-ntru-bliss scenario 1749: TEST="${TEST_DIR}/ikev2/rw-ntru-bliss" 1750: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/private 1751: mkdir -p ${TEST}/hosts/carol/${IPSEC_DIR}/certs 1752: cp ${TEST_KEY} ${TEST}/hosts/carol/${IPSEC_DIR}/private 1753: cp ${TEST_CERT} ${TEST}/hosts/carol/${IPSEC_DIR}/certs 1754: 1755: # Put a copy in the swanctl scenarios 1756: for t in rw-newhope-bliss rw-ntru-bliss 1757: do 1758: TEST="${TEST_DIR}/swanctl/${t}" 1759: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/bliss 1760: mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 1761: cp ${TEST_KEY} ${TEST}/hosts/carol/${SWANCTL_DIR}/bliss 1762: cp ${TEST_CERT} ${TEST}/hosts/carol/${SWANCTL_DIR}/x509 1763: done 1764: 1765: # Generate a dave BLISS certificate with 160 bit security strength 1766: TEST="${TEST_DIR}/ikev2/rw-newhope-bliss" 1767: TEST_KEY="${TEST}/hosts/dave/${IPSEC_DIR}/private/daveKey.der" 1768: TEST_CERT="${TEST}/hosts/dave/${IPSEC_DIR}/certs/daveCert.der" 1769: CN="dave@strongswan.org" 1770: SERIAL="02" 1771: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/private 1772: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/certs 1773: pki --gen --type bliss --size 3 > ${TEST_KEY} 1774: pki --issue --cakey ${BLISS_KEY} --cacert ${BLISS_CERT} --type bliss \ 1775: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1776: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=BLISS III, CN=${CN}" \ 1777: --crl ${BLISS_CDP} --digest sha3_512 > ${TEST_CERT} 1778: cp ${TEST_CERT} ${BLISS_DIR}/certs/${SERIAL}.der 1779: 1780: # Put a copy in the ikev2/rw-ntru-bliss scenario 1781: TEST="${TEST_DIR}/ikev2/rw-ntru-bliss" 1782: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/private 1783: mkdir -p ${TEST}/hosts/dave/${IPSEC_DIR}/certs 1784: cp ${TEST_KEY} ${TEST}/hosts/dave/${IPSEC_DIR}/private/ 1785: cp ${TEST_CERT} ${TEST}/hosts/dave/${IPSEC_DIR}/certs/ 1786: 1787: # Put a copy in the swanctl scenarios 1788: for t in rw-newhope-bliss rw-ntru-bliss 1789: do 1790: TEST="${TEST_DIR}/swanctl/${t}" 1791: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/bliss 1792: mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/x509 1793: cp ${TEST_KEY} ${TEST}/hosts/dave/${SWANCTL_DIR}/bliss/ 1794: cp ${TEST_CERT} ${TEST}/hosts/dave/${SWANCTL_DIR}/x509/ 1795: done 1796: 1797: # Generate a moon BLISS certificate with 192 bit security strength 1798: TEST="${TEST_DIR}/ikev2/rw-newhope-bliss" 1799: TEST_KEY="${TEST}/hosts/moon/${IPSEC_DIR}/private/moonKey.der" 1800: TEST_CERT="${TEST}/hosts/moon/${IPSEC_DIR}/certs/moonCert.der" 1801: CN="moon.strongswan.org" 1802: SERIAL="03" 1803: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/private 1804: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/certs 1805: pki --gen --type bliss --size 4 > ${TEST_KEY} 1806: pki --issue --cakey ${BLISS_KEY} --cacert ${BLISS_CERT} --type bliss \ 1807: --in ${TEST_KEY} --not-before "${START}" --not-after "${EE_END}" --san ${CN} \ 1808: --serial ${SERIAL} --dn "C=CH, O=${PROJECT}, OU=BLISS IV, CN=${CN}" \ 1809: --crl ${BLISS_CDP} --digest sha3_512 > ${TEST_CERT} 1810: cp ${TEST_CERT} ${BLISS_DIR}/certs/${SERIAL}.der 1811: 1812: # Put a copy in the ikev2/rw-ntru-bliss scenario 1813: TEST="${TEST_DIR}/ikev2/rw-ntru-bliss" 1814: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/private 1815: mkdir -p ${TEST}/hosts/moon/${IPSEC_DIR}/certs 1816: cp ${TEST_KEY} ${TEST}/hosts/moon/${IPSEC_DIR}/private/ 1817: cp ${TEST_CERT} ${TEST}/hosts/moon/${IPSEC_DIR}/certs/ 1818: 1819: # Put a copy in the swanctl scenarios 1820: for t in rw-newhope-bliss rw-ntru-bliss 1821: do 1822: TEST="${TEST_DIR}/swanctl/${t}" 1823: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/bliss 1824: mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509 1825: cp ${TEST_KEY} ${TEST}/hosts/moon/${SWANCTL_DIR}/bliss/ 1826: cp ${TEST_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509/ 1827: done 1828: 1829: ################################################################################ 1830: # SQL Data # 1831: ################################################################################ 1832: 1833: CA_SPK_HEX=`pki --keyid --type rsa --format hex --id spk --in ${CA_KEY}` 1834: CA_SPKI_HEX=`pki --keyid --type rsa --format hex --id spki --in ${CA_KEY}` 1835: CA_CERT_HEX=`cat ${CA_CERT_DER} | hexdump -v -e '/1 "%02x"'` 1836: CA_CERT_PEM_HEX=`cat ${CA_CERT} | hexdump -v -e '/1 "%02x"'` 1837: # 1838: MOON_CERT="${DIR}/hosts/moon/${SWANCTL_DIR}/x509/moonCert.pem" 1839: MOON_KEY="${CA_DIR}/keys/moonKey.der" 1840: MOON_KEY_PEM="${DIR}/hosts/moon/${SWANCTL_DIR}/rsa/moonKey.pem" 1841: MOON_KEY_PEM_HEX=`cat ${MOON_KEY_PEM} | hexdump -v -e '/1 "%02x"'` 1842: MOON_KEY_HEX=`cat ${MOON_KEY} | hexdump -v -e '/1 "%02x"'` 1843: MOON_SPK_HEX=`pki --keyid --type rsa --format hex --id spk --in ${MOON_KEY}` 1844: MOON_PUB_HEX=`pki --pub --type rsa --in ${MOON_KEY} | hexdump -v -e '/1 "%02x"'` 1845: MOON_CERT_HEX=`openssl x509 -in ${MOON_CERT} -outform der | hexdump -v -e '/1 "%02x"'` 1846: MOON_CERT_PEM_HEX=`cat ${MOON_CERT} | hexdump -v -e '/1 "%02x"'` 1847: # 1848: SUN_CERT="${DIR}/hosts/sun/${SWANCTL_DIR}/x509/sunCert.pem" 1849: SUN_KEY="${CA_DIR}/keys/sunKey.der" 1850: SUN_KEY_PEM="${DIR}/hosts/sun/${SWANCTL_DIR}/rsa/sunKey.pem" 1851: SUN_KEY_PEM_HEX=`cat ${SUN_KEY_PEM} | hexdump -v -e '/1 "%02x"'` 1852: SUN_KEY_HEX=`cat ${SUN_KEY} | hexdump -v -e '/1 "%02x"'` 1853: SUN_SPK_HEX=`pki --keyid --type rsa --format hex --id spk --in ${SUN_KEY}` 1854: SUN_CERT_HEX=`openssl x509 -in ${SUN_CERT} -outform der | hexdump -v -e '/1 "%02x"'` 1855: SUN_CERT_PEM_HEX=`cat ${SUN_CERT} | hexdump -v -e '/1 "%02x"'` 1856: # 1857: CAROL_CERT="${DIR}/hosts/carol/${SWANCTL_DIR}/x509/carolCert.pem" 1858: CAROL_KEY="${CA_DIR}/keys/carolKey.der" 1859: CAROL_KEY_HEX=`cat ${CAROL_KEY} | hexdump -v -e '/1 "%02x"'` 1860: CAROL_SPK_HEX=`pki --keyid --type rsa --format hex --id spk --in ${CAROL_KEY}` 1861: CAROL_PUB_HEX=`pki --pub --type rsa --in ${CAROL_KEY} | hexdump -v -e '/1 "%02x"'` 1862: CAROL_CERT_HEX=`openssl x509 -in ${CAROL_CERT} -outform der | hexdump -v -e '/1 "%02x"'` 1863: # 1864: DAVE_CERT="${DIR}/hosts/dave/${SWANCTL_DIR}/x509/daveCert.pem" 1865: DAVE_KEY="${CA_DIR}/keys/daveKey.der" 1866: DAVE_KEY_HEX=`cat ${DAVE_KEY} | hexdump -v -e '/1 "%02x"'` 1867: DAVE_SPK_HEX=`pki --keyid --type rsa --format hex --id spk --in ${DAVE_KEY}` 1868: DAVE_PUB_HEX=`pki --pub --type rsa --in ${DAVE_KEY} | hexdump -v -e '/1 "%02x"'` 1869: DAVE_CERT_HEX=`openssl x509 -in ${DAVE_CERT} -outform der | hexdump -v -e '/1 "%02x"'` 1870: # 1871: ALICE_CERT="${DIR}/hosts/alice/${SWANCTL_DIR}/x509/aliceCert.pem" 1872: ALICE_KEY="${CA_DIR}/keys/aliceKey.der" 1873: ALICE_KEY_HEX=`cat ${ALICE_KEY} | hexdump -v -e '/1 "%02x"'` 1874: ALICE_SPK_HEX=`pki --keyid --type rsa --format hex --id spk --in ${ALICE_KEY}` 1875: ALICE_CERT_HEX=`openssl x509 -in ${ALICE_CERT} -outform der | hexdump -v -e '/1 "%02x"'` 1876: # 1877: VENUS_CERT="${DIR}/hosts/venus/${SWANCTL_DIR}/x509/venusCert.pem" 1878: VENUS_KEY="${CA_DIR}/keys/venusKey.der" 1879: VENUS_KEY_HEX=`cat ${VENUS_KEY} | hexdump -v -e '/1 "%02x"'` 1880: VENUS_SPK_HEX=`pki --keyid --type rsa --format hex --id spk --in ${VENUS_KEY}` 1881: VENUS_CERT_HEX=`openssl x509 -in ${VENUS_CERT} -outform der | hexdump -v -e '/1 "%02x"'` 1882: # 1883: RESEARCH_SPK_HEX=`pki --keyid --type rsa --format hex --id spk --in ${RESEARCH_KEY}` 1884: RESEARCH_SPKI_HEX=`pki --keyid --type rsa --format hex --id spki --in ${RESEARCH_KEY}` 1885: RESEARCH_CERT_HEX=`cat ${RESEARCH_CERT_DER} | hexdump -v -e '/1 "%02x"'` 1886: # 1887: CAROL_R_CERT="${RESEARCH_DIR}/certs/01.pem" 1888: CAROL_R_KEY="${RESEARCH_DIR}/keys/01.der" 1889: CAROL_R_KEY_HEX=`cat ${CAROL_R_KEY} | hexdump -v -e '/1 "%02x"'` 1890: CAROL_R_SPK_HEX=`pki --keyid --type rsa --format hex --id spk --in ${CAROL_R_KEY}` 1891: CAROL_R_CERT_HEX=`openssl x509 -in ${CAROL_R_CERT} -outform der | hexdump -v -e '/1 "%02x"'` 1892: # 1893: SALES_SPK_HEX=`pki --keyid --type rsa --format hex --id spk --in ${SALES_KEY}` 1894: SALES_SPKI_HEX=`pki --keyid --type rsa --format hex --id spki --in ${SALES_KEY}` 1895: SALES_CERT_HEX=`cat ${SALES_CERT_DER} | hexdump -v -e '/1 "%02x"'` 1896: # 1897: DAVE_S_CERT="${SALES_DIR}/certs/01.pem" 1898: DAVE_S_KEY="${SALES_DIR}/keys/01.der" 1899: DAVE_S_KEY_HEX=`cat ${DAVE_S_KEY} | hexdump -v -e '/1 "%02x"'` 1900: DAVE_S_SPK_HEX=`pki --keyid --type rsa --format hex --id spk --in ${DAVE_S_KEY}` 1901: DAVE_S_CERT_HEX=`openssl x509 -in ${DAVE_S_CERT} -outform der | hexdump -v -e '/1 "%02x"'` 1902: # 1903: for t in ip-pool-db ip-pool-db-expired ip-pool-db-restart ip-split-pools-db \ 1904: ip-split-pools-db-restart multi-level-ca rw-cert rw-psk-rsa-split \ 1905: rw-psk-ipv4 rw-psk-ipv6 rw-rsa rw-rsa-keyid 1906: do 1907: for h in carol dave moon 1908: do 1909: TEST_DATA="${TEST_DIR}/sql/${t}/hosts/${h}/${IPSEC_DIR}/data.sql" 1910: sed -e "s/CA_SPK_HEX/${CA_SPK_HEX}/g" \ 1911: -e "s/CA_SPKI_HEX/${CA_SPKI_HEX}/g" \ 1912: -e "s/CA_CERT_HEX/${CA_CERT_HEX}/g" \ 1913: -e "s/MOON_KEY_HEX/${MOON_KEY_HEX}/g" \ 1914: -e "s/MOON_SPK_HEX/${MOON_SPK_HEX}/g" \ 1915: -e "s/MOON_PUB_HEX/${MOON_PUB_HEX}/g" \ 1916: -e "s/MOON_CERT_HEX/${MOON_CERT_HEX}/g" \ 1917: -e "s/CAROL_KEY_HEX/${CAROL_KEY_HEX}/g" \ 1918: -e "s/CAROL_SPK_HEX/${CAROL_SPK_HEX}/g" \ 1919: -e "s/CAROL_PUB_HEX/${CAROL_PUB_HEX}/g" \ 1920: -e "s/CAROL_CERT_HEX/${CAROL_CERT_HEX}/g" \ 1921: -e "s/DAVE_KEY_HEX/${DAVE_KEY_HEX}/g" \ 1922: -e "s/DAVE_SPK_HEX/${DAVE_SPK_HEX}/g" \ 1923: -e "s/DAVE_PUB_HEX/${DAVE_PUB_HEX}/g" \ 1924: -e "s/DAVE_CERT_HEX/${DAVE_CERT_HEX}/g" \ 1925: -e "s/RESEARCH_SPK_HEX/${RESEARCH_SPK_HEX}/g" \ 1926: -e "s/RESEARCH_SPKI_HEX/${RESEARCH_SPKI_HEX}/g" \ 1927: -e "s/RESEARCH_CERT_HEX/${RESEARCH_CERT_HEX}/g" \ 1928: -e "s/CAROL_R_KEY_HEX/${CAROL_R_KEY_HEX}/g" \ 1929: -e "s/CAROL_R_SPK_HEX/${CAROL_R_SPK_HEX}/g" \ 1930: -e "s/CAROL_R_CERT_HEX/${CAROL_R_CERT_HEX}/g" \ 1931: -e "s/SALES_SPK_HEX/${SALES_SPK_HEX}/g" \ 1932: -e "s/SALES_SPKI_HEX/${SALES_SPKI_HEX}/g" \ 1933: -e "s/SALES_CERT_HEX/${SALES_CERT_HEX}/g" \ 1934: -e "s/DAVE_S_KEY_HEX/${DAVE_S_KEY_HEX}/g" \ 1935: -e "s/DAVE_S_SPK_HEX/${DAVE_S_SPK_HEX}/g" \ 1936: -e "s/DAVE_S_CERT_HEX/${DAVE_S_CERT_HEX}/g" \ 1937: ${TEST_DATA}.in > ${TEST_DATA} 1938: done 1939: done 1940: # 1941: for t in rw-eap-aka-rsa 1942: do 1943: for h in carol moon 1944: do 1945: TEST_DATA="${TEST_DIR}/sql/${t}/hosts/${h}/${IPSEC_DIR}/data.sql" 1946: sed -e "s/CA_SPK_HEX/${CA_SPK_HEX}/g" \ 1947: -e "s/CA_SPKI_HEX/${CA_SPKI_HEX}/g" \ 1948: -e "s/CA_CERT_HEX/${CA_CERT_HEX}/g" \ 1949: -e "s/MOON_KEY_HEX/${MOON_KEY_HEX}/g" \ 1950: -e "s/MOON_SPK_HEX/${MOON_SPK_HEX}/g" \ 1951: -e "s/MOON_CERT_HEX/${MOON_CERT_HEX}/g" \ 1952: ${TEST_DATA}.in > ${TEST_DATA} 1953: done 1954: done 1955: # 1956: for t in net2net-cert net2net-psk net2net-route-pem net2net-start-pem 1957: do 1958: for h in moon sun 1959: do 1960: TEST_DATA="${TEST_DIR}/sql/${t}/hosts/${h}/${IPSEC_DIR}/data.sql" 1961: sed -e "s/CA_SPK_HEX/${CA_SPK_HEX}/g" \ 1962: -e "s/CA_SPKI_HEX/${CA_SPKI_HEX}/g" \ 1963: -e "s/CA_CERT_HEX/${CA_CERT_HEX}/g" \ 1964: -e "s/CA_CERT_PEM_HEX/${CA_CERT_PEM_HEX}/g" \ 1965: -e "s/MOON_KEY_PEM_HEX/${MOON_KEY_PEM_HEX}/g" \ 1966: -e "s/MOON_KEY_HEX/${MOON_KEY_HEX}/g" \ 1967: -e "s/MOON_SPK_HEX/${MOON_SPK_HEX}/g" \ 1968: -e "s/MOON_CERT_HEX/${MOON_CERT_HEX}/g" \ 1969: -e "s/MOON_CERT_PEM_HEX/${MOON_CERT_PEM_HEX}/g" \ 1970: -e "s/SUN_KEY_PEM_HEX/${SUN_KEY_PEM_HEX}/g" \ 1971: -e "s/SUN_KEY_HEX/${SUN_KEY_HEX}/g" \ 1972: -e "s/SUN_SPK_HEX/${SUN_SPK_HEX}/g" \ 1973: -e "s/SUN_CERT_HEX/${SUN_CERT_HEX}/g" \ 1974: -e "s/SUN_CERT_PEM_HEX/${SUN_CERT_PEM_HEX}/g" \ 1975: ${TEST_DATA}.in > ${TEST_DATA} 1976: done 1977: done 1978: # 1979: for t in shunt-policies-nat-rw 1980: do 1981: for h in alice venus sun 1982: do 1983: TEST_DATA="${TEST_DIR}/sql/${t}/hosts/${h}/${IPSEC_DIR}/data.sql" 1984: sed -e "s/CA_SPK_HEX/${CA_SPK_HEX}/g" \ 1985: -e "s/CA_SPKI_HEX/${CA_SPKI_HEX}/g" \ 1986: -e "s/CA_CERT_HEX/${CA_CERT_HEX}/g" \ 1987: -e "s/ALICE_KEY_HEX/${ALICE_KEY_HEX}/g" \ 1988: -e "s/ALICE_SPK_HEX/${ALICE_SPK_HEX}/g" \ 1989: -e "s/ALICE_CERT_HEX/${ALICE_CERT_HEX}/g" \ 1990: -e "s/VENUS_KEY_HEX/${VENUS_KEY_HEX}/g" \ 1991: -e "s/VENUS_SPK_HEX/${VENUS_SPK_HEX}/g" \ 1992: -e "s/VENUS_CERT_HEX/${VENUS_CERT_HEX}/g" \ 1993: -e "s/SUN_KEY_HEX/${SUN_KEY_HEX}/g" \ 1994: -e "s/SUN_SPK_HEX/${SUN_SPK_HEX}/g" \ 1995: -e "s/SUN_CERT_HEX/${SUN_CERT_HEX}/g" \ 1996: ${TEST_DATA}.in > ${TEST_DATA} 1997: done 1998: done 1999: 2000: ################################################################################ 2001: # Raw RSA keys # 2002: ################################################################################ 2003: 2004: MOON_PUB_DNS=`pki --pub --type rsa --outform dnskey --in ${MOON_KEY}` 2005: # 2006: SUN_PUB_DNS=`pki --pub --type rsa --outform dnskey --in ${SUN_KEY}` 2007: # 2008: for h in moon sun 2009: do 2010: TEST_DATA="${TEST_DIR}/ikev2/net2net-rsa/hosts/${h}/etc/ipsec.conf" 2011: sed -e "s|MOON_PUB_DNS|${MOON_PUB_DNS}|g" \ 2012: -e "s|SUN_PUB_DNS|${SUN_PUB_DNS}|g" \ 2013: ${TEST_DATA}.in > ${TEST_DATA} 2014: done 2015: 2016: ################################################################################ 2017: # TKM CA ID mapping # 2018: ################################################################################ 2019: 2020: for t in host2host-initiator host2host-responder host2host-xfrmproxy \ 2021: multi-level-ca net2net-initiator net2net-xfrmproxy xfrmproxy-expire \ 2022: xfrmproxy-rekey 2023: do 2024: for h in moon 2025: do 2026: TEST_DATA="${TEST_DIR}/tkm/${t}/hosts/moon/etc/strongswan.conf" 2027: sed -e "s/CA_SPK_HEX/${CA_SPK_HEX}/g" \ 2028: -e "s/CA_SPKI_HEX/${CA_SPKI_HEX}/g" \ 2029: -e "s/LEVELS_SPK_HEX/${LEVELS_SPK_HEX}/g" \ 2030: ${TEST_DATA}.in > ${TEST_DATA} 2031: done 2032: done 2033: 2034: for t in multiple-clients 2035: do 2036: for h in sun 2037: do 2038: TEST_DATA="${TEST_DIR}/tkm/${t}/hosts/${h}/etc/strongswan.conf" 2039: sed -e "s/CA_SPK_HEX/${CA_SPK_HEX}/g" \ 2040: -e "s/CA_SPKI_HEX/${CA_SPKI_HEX}/g" \ 2041: ${TEST_DATA}.in > ${TEST_DATA} 2042: done 2043: done