mksmime-certs.sh 3.6 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485
  1. #!/bin/sh
  2. # Copyright 2013-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. #
  4. # Licensed under the Apache License 2.0 (the "License"). You may not use
  5. # this file except in compliance with the License. You can obtain a copy
  6. # in the file LICENSE in the source distribution or at
  7. # https://www.openssl.org/source/license.html
  8. # Utility to recreate S/MIME certificates
  9. OPENSSL=../../apps/openssl
  10. OPENSSL_CONF=./ca.cnf
  11. export OPENSSL_CONF
  12. # Root CA: create certificate directly
  13. CN="Test S/MIME RSA Root" $OPENSSL req -config ca.cnf -x509 -nodes \
  14. -keyout smroot.pem -out smroot.pem -newkey rsa:2048 -days 3650
  15. # EE RSA certificates: create request first
  16. CN="Test S/MIME EE RSA #1" $OPENSSL req -config ca.cnf -nodes \
  17. -keyout smrsa1.pem -out req.pem -newkey rsa:2048
  18. # Sign request: end entity extensions
  19. $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
  20. -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa1.pem
  21. CN="Test S/MIME EE RSA #2" $OPENSSL req -config ca.cnf -nodes \
  22. -keyout smrsa2.pem -out req.pem -newkey rsa:2048
  23. $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
  24. -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa2.pem
  25. CN="Test S/MIME EE RSA #3" $OPENSSL req -config ca.cnf -nodes \
  26. -keyout smrsa3.pem -out req.pem -newkey rsa:2048
  27. $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
  28. -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa3.pem
  29. # Create DSA parameters
  30. $OPENSSL dsaparam -out dsap.pem 2048
  31. CN="Test S/MIME EE DSA #1" $OPENSSL req -config ca.cnf -nodes \
  32. -keyout smdsa1.pem -out req.pem -newkey dsa:dsap.pem
  33. $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
  34. -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa1.pem
  35. CN="Test S/MIME EE DSA #2" $OPENSSL req -config ca.cnf -nodes \
  36. -keyout smdsa2.pem -out req.pem -newkey dsa:dsap.pem
  37. $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
  38. -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa2.pem
  39. CN="Test S/MIME EE DSA #3" $OPENSSL req -config ca.cnf -nodes \
  40. -keyout smdsa3.pem -out req.pem -newkey dsa:dsap.pem
  41. $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
  42. -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa3.pem
  43. # Create EC parameters
  44. $OPENSSL ecparam -out ecp.pem -name P-256
  45. $OPENSSL ecparam -out ecp2.pem -name K-283
  46. CN="Test S/MIME EE EC #1" $OPENSSL req -config ca.cnf -nodes \
  47. -keyout smec1.pem -out req.pem -newkey ec:ecp.pem
  48. $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
  49. -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec1.pem
  50. CN="Test S/MIME EE EC #2" $OPENSSL req -config ca.cnf -nodes \
  51. -keyout smec2.pem -out req.pem -newkey ec:ecp2.pem
  52. $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
  53. -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec2.pem
  54. CN="Test S/MIME EE EC #3" $OPENSSL req -config ca.cnf -nodes \
  55. -keyout smec3.pem -out req.pem -newkey ec:ecp.pem
  56. $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
  57. -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec3.pem
  58. # Create X9.42 DH parameters.
  59. $OPENSSL genpkey -genparam -algorithm DH -pkeyopt dh_paramgen_type:2 \
  60. -out dhp.pem
  61. # Generate X9.42 DH key.
  62. $OPENSSL genpkey -paramfile dhp.pem -out smdh.pem
  63. $OPENSSL pkey -pubout -in smdh.pem -out dhpub.pem
  64. # Generate dummy request.
  65. CN="Test S/MIME EE DH #1" $OPENSSL req -config ca.cnf -nodes \
  66. -keyout smtmp.pem -out req.pem -newkey rsa:2048
  67. # Sign request but force public key to DH
  68. $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
  69. -force_pubkey dhpub.pem \
  70. -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdh.pem
  71. # Remove temp files.
  72. rm -f req.pem ecp.pem ecp2.pem dsap.pem dhp.pem dhpub.pem smtmp.pem smroot.srl