ECC-RSAcertgen.sh 3.6 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798
  1. #!/bin/sh
  2. # For a list of supported curves, use "apps/openssl ecparam -list_curves".
  3. # Path to the openssl distribution
  4. OPENSSL_DIR=../..
  5. # Path to the openssl program
  6. OPENSSL_CMD=$OPENSSL_DIR/apps/openssl
  7. # Option to find configuration file
  8. OPENSSL_CNF="-config $OPENSSL_DIR/apps/openssl.cnf"
  9. # Directory where certificates are stored
  10. CERTS_DIR=./Certs
  11. # Directory where private key files are stored
  12. KEYS_DIR=$CERTS_DIR
  13. # Directory where combo files (containing a certificate and corresponding
  14. # private key together) are stored
  15. COMBO_DIR=$CERTS_DIR
  16. # cat command
  17. CAT=/bin/cat
  18. # rm command
  19. RM=/bin/rm
  20. # mkdir command
  21. MKDIR=/bin/mkdir
  22. # The certificate will expire these many days after the issue date.
  23. DAYS=1500
  24. TEST_CA_FILE=rsa1024TestCA
  25. TEST_SERVER_CURVE=sect163r1
  26. TEST_SERVER_FILE=sect163r1-rsaTestServer
  27. TEST_SERVER_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Server (sect163r1 key signed with RSA)"
  28. TEST_CLIENT_CURVE=sect163r1
  29. TEST_CLIENT_FILE=sect163r1-rsaTestClient
  30. TEST_CLIENT_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Client (sect163r1 key signed with RSA)"
  31. # Generating an EC certificate involves the following main steps
  32. # 1. Generating curve parameters (if needed)
  33. # 2. Generating a certificate request
  34. # 3. Signing the certificate request
  35. # 4. [Optional] One can combine the cert and private key into a single
  36. # file and also delete the certificate request
  37. $MKDIR -p $CERTS_DIR
  38. $MKDIR -p $KEYS_DIR
  39. $MKDIR -p $COMBO_DIR
  40. echo "GENERATING A TEST SERVER CERTIFICATE (ECC key signed with RSA)"
  41. echo "=============================================================="
  42. $OPENSSL_CMD ecparam -name $TEST_SERVER_CURVE -out $TEST_SERVER_CURVE.pem
  43. $OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_SERVER_DN" \
  44. -keyout $KEYS_DIR/$TEST_SERVER_FILE.key.pem \
  45. -newkey ec:$TEST_SERVER_CURVE.pem -new \
  46. -out $CERTS_DIR/$TEST_SERVER_FILE.req.pem
  47. $OPENSSL_CMD x509 -req -days $DAYS \
  48. -in $CERTS_DIR/$TEST_SERVER_FILE.req.pem \
  49. -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
  50. -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
  51. -out $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -CAcreateserial
  52. # Display the certificate
  53. $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -text
  54. # Place the certificate and key in a common file
  55. $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -issuer -subject \
  56. > $COMBO_DIR/$TEST_SERVER_FILE.pem
  57. $CAT $KEYS_DIR/$TEST_SERVER_FILE.key.pem >> $COMBO_DIR/$TEST_SERVER_FILE.pem
  58. # Remove the cert request file (no longer needed)
  59. $RM $CERTS_DIR/$TEST_SERVER_FILE.req.pem
  60. echo "GENERATING A TEST CLIENT CERTIFICATE (ECC key signed with RSA)"
  61. echo "=============================================================="
  62. $OPENSSL_CMD ecparam -name $TEST_CLIENT_CURVE -out $TEST_CLIENT_CURVE.pem
  63. $OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_CLIENT_DN" \
  64. -keyout $KEYS_DIR/$TEST_CLIENT_FILE.key.pem \
  65. -newkey ec:$TEST_CLIENT_CURVE.pem -new \
  66. -out $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
  67. $OPENSSL_CMD x509 -req -days $DAYS \
  68. -in $CERTS_DIR/$TEST_CLIENT_FILE.req.pem \
  69. -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
  70. -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
  71. -out $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -CAcreateserial
  72. # Display the certificate
  73. $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -text
  74. # Place the certificate and key in a common file
  75. $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -issuer -subject \
  76. > $COMBO_DIR/$TEST_CLIENT_FILE.pem
  77. $CAT $KEYS_DIR/$TEST_CLIENT_FILE.key.pem >> $COMBO_DIR/$TEST_CLIENT_FILE.pem
  78. # Remove the cert request file (no longer needed)
  79. $RM $CERTS_DIR/$TEST_CLIENT_FILE.req.pem