blob: 0f4976ac55175e0331a55a3720a77203a8966668 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
#!/bin/sh
opensslcmd() {
LD_LIBRARY_PATH=../.. ../../apps/openssl $@
}
# report the openssl version
opensslcmd version
echo "Creating private keys and certs..."
#####
# root CA private key
opensslcmd genpkey \
-algorithm EC \
-pkeyopt ec_paramgen_curve:secp521r1 \
-pkeyopt ec_param_enc:named_curve \
-out root-key.pem
# root CA certificate (self-signed)
opensslcmd req \
-config ca.cnf \
-x509 \
-days 3650 \
-key root-key.pem \
-subj /CN=TestRootCA \
-out root-cert.pem
#####
# intermediate CA private key
opensslcmd genpkey \
-algorithm EC \
-pkeyopt ec_paramgen_curve:secp384r1 \
-pkeyopt ec_param_enc:named_curve \
-out intermediate-key.pem
# intermediate CA certificate-signing-request
opensslcmd req \
-config ca.cnf \
-new \
-key intermediate-key.pem \
-subj /CN=TestIntermediateCA \
-out intermediate-csr.pem
# intermediate CA certificate (signed by root CA)
opensslcmd req \
-config ca.cnf \
-x509 \
-days 1825 \
-CA root-cert.pem \
-CAkey root-key.pem \
-in intermediate-csr.pem \
-copy_extensions copyall \
-out intermediate-cert.pem
#####
# server key
opensslcmd genpkey \
-algorithm EC \
-pkeyopt ec_paramgen_curve:prime256v1 \
-pkeyopt ec_param_enc:named_curve \
-out server-key.pem
# server certificate-signing-request
opensslcmd req \
-config ca.cnf \
-extensions usr_cert \
-new \
-key server-key.pem \
-subj /CN=TestServerCA \
-out server-csr.pem
# server certificate (signed by intermediate CA)
opensslcmd req \
-config ca.cnf \
-extensions usr_cert \
-x509 \
-days 365 \
-CA intermediate-cert.pem \
-CAkey intermediate-key.pem \
-in server-csr.pem \
-copy_extensions copyall \
-out server-cert.pem
#####
rm -f index.txt index.txt.attr
echo -n > index.txt
opensslcmd ca \
-config ca.cnf \
-valid server-cert.pem \
-keyfile intermediate-key.pem \
-cert intermediate-cert.pem
rm -f index.txt.old
#####
cat server-cert.pem server-key.pem intermediate-cert.pem > server.pem
cat intermediate-cert.pem intermediate-key.pem > ocsp.pem
echo "Done."
|
