renewcerts.sh 43 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896
  1. #!/usr/bin/env bash
  2. # renewcerts.sh
  3. #
  4. # renews the following certs:
  5. # client-cert.pem
  6. # client-cert.der
  7. # client-ecc-cert.pem
  8. # client-ecc-cert.der
  9. # ca-cert.pem
  10. # ca-cert.der
  11. # ca-ecc-cert.pem
  12. # ca-ecc-cert.der
  13. # ca-ecc384-cert.pem
  14. # ca-ecc384-cert.der
  15. # server-cert.pem
  16. # server-cert.der
  17. # server-cert-chain.der
  18. # server-ecc-rsa.pem
  19. # server-ecc.pem
  20. # 1024/client-cert.der
  21. # 1024/client-cert.pem
  22. # server-ecc-comp.pem
  23. # client-ca.pem
  24. # test/digsigku.pem
  25. # ecc-privOnlyCert.pem
  26. # client-uri-cert.pem
  27. # client-absolute-uri.pem
  28. # client-relative-uri.pem
  29. # client-crl-dist.pem
  30. # entity-no-ca-bool-cert.pem
  31. # fpki-cert.der
  32. # rid-cert.der
  33. # updates the following crls:
  34. # crl/cliCrl.pem
  35. # crl/crl.pem
  36. # crl/crl.revoked
  37. # crl/eccCliCRL.pem
  38. # crl/eccSrvCRL.pem
  39. #
  40. # pkcs7:
  41. # test-degenerate.p7b
  42. ###############################################################################
  43. ######################## FUNCTIONS SECTION ####################################
  44. ###############################################################################
  45. check_result(){
  46. if [ $1 -ne 0 ]; then
  47. echo "Failed at \"$2\", Abort"
  48. exit 1
  49. else
  50. echo "$2 Succeeded!"
  51. fi
  52. }
  53. #the function that will be called when we are ready to renew the certs.
  54. run_renewcerts(){
  55. #call update for some ecc certs
  56. ./certs/ecc/genecc.sh
  57. check_result $? "Step 0"
  58. cd certs/ || { echo "Couldn't cd to certs directory"; exit 1; }
  59. echo ""
  60. #move the custom cnf into our working directory
  61. cp renewcerts/wolfssl.cnf wolfssl.cnf || exit 1
  62. # To generate these all in sha1 add the flag "-sha1" on appropriate lines
  63. # That is all lines beginning with: "openssl req"
  64. ############################################################
  65. #### update the self-signed (2048-bit) client-uri-cert.pem #
  66. ############################################################
  67. echo "Updating 2048-bit client-uri-cert.pem"
  68. echo ""
  69. #pipe the following arguments to openssl req...
  70. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_2048\\nURI\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key client-key.pem -config ./wolfssl.cnf -nodes -out client-cert.csr
  71. check_result $? "Step 1"
  72. openssl x509 -req -in client-cert.csr -days 1000 -extfile wolfssl.cnf -extensions uri -signkey client-key.pem -out client-uri-cert.pem
  73. check_result $? "Step 2"
  74. rm client-cert.csr
  75. openssl x509 -in client-uri-cert.pem -text > tmp.pem
  76. check_result $? "Step 3"
  77. mv tmp.pem client-uri-cert.pem
  78. echo "End of section"
  79. echo "---------------------------------------------------------------------"
  80. ############################################################
  81. # Public Versions of client-key.pem
  82. ############################################################
  83. openssl rsa -inform pem -in client-key.pem -outform der -out client-keyPub.der -pubout
  84. openssl rsa -inform pem -in client-key.pem -outform pem -out client-keyPub.pem -pubout
  85. ############################################################
  86. # Public Versions of server-key.pem
  87. ############################################################
  88. #openssl rsa -inform pem -in server-key.pem -outform der -out server-keyPub.der -pubout
  89. openssl rsa -inform pem -in server-key.pem -outform pem -out server-keyPub.pem -pubout
  90. ############################################################
  91. # Public Versions of ecc-key.pem
  92. ############################################################
  93. #openssl ec -inform pem -in ecc-key.pem -outform der -out ecc-keyPub.der -pubout
  94. openssl ec -inform pem -in ecc-key.pem -outform pem -out ecc-keyPub.pem -pubout
  95. ############################################################
  96. #### update the self-signed (2048-bit) client-absolute-urn.pem
  97. ############################################################
  98. echo "Updating 2048-bit client-absolute-urn.pem"
  99. echo ""
  100. #pipe the following arguments to openssl req...
  101. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_2048\\nABSOLUTE_URN\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key client-key.pem -config ./wolfssl.cnf -nodes -out client-cert.csr
  102. check_result $? "Step 1"
  103. openssl x509 -req -in client-cert.csr -days 1000 -extfile wolfssl.cnf -extensions absolute_urn -signkey client-key.pem -out client-absolute-urn.pem
  104. check_result $? "Step 2"
  105. rm client-cert.csr
  106. openssl x509 -in client-absolute-urn.pem -text > tmp.pem
  107. check_result $? "Step 3"
  108. mv tmp.pem client-absolute-urn.pem
  109. echo "End of section"
  110. echo "---------------------------------------------------------------------"
  111. ############################################################
  112. #### update the self-signed (2048-bit) client-relative-uri.pem
  113. ############################################################
  114. echo "Updating 2048-bit client-relative-uri.pem"
  115. echo ""
  116. #pipe the following arguments to openssl req...
  117. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_2048\\nRELATIVE_URI\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key client-key.pem -config ./wolfssl.cnf -nodes -out client-cert.csr
  118. check_result $? "Step 1"
  119. openssl x509 -req -in client-cert.csr -days 1000 -extfile wolfssl.cnf -extensions relative_uri -signkey client-key.pem -out client-relative-uri.pem
  120. check_result $? "Step 2"
  121. rm client-cert.csr
  122. openssl x509 -in client-relative-uri.pem -text > tmp.pem
  123. check_result $? "Step 3"
  124. mv tmp.pem client-relative-uri.pem
  125. echo "End of section"
  126. echo "---------------------------------------------------------------------"
  127. ############################################################
  128. #### update the self-signed (2048-bit) client-cert-ext.pem
  129. ############################################################
  130. echo "Updating 2048-bit client-cert-ext.pem"
  131. echo ""
  132. #pipe the following arguments to openssl req...
  133. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_2048\\nProgramming-2048\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key client-key.pem -config ./wolfssl.cnf -nodes -out client-cert.csr
  134. check_result $? "Step 1"
  135. openssl x509 -req -in client-cert.csr -days 1000 -extfile wolfssl.cnf -extensions client_cert_ext -signkey client-key.pem -out client-cert-ext.pem
  136. check_result $? "Step 2"
  137. rm client-cert.csr
  138. openssl x509 -in client-cert-ext.pem -outform DER -out client-cert-ext.der
  139. check_result $? "Step 3"
  140. openssl x509 -in client-cert-ext.pem -text > tmp.pem
  141. check_result $? "Step 4"
  142. mv tmp.pem client-cert-ext.pem
  143. echo "End of section"
  144. echo "---------------------------------------------------------------------"
  145. ############################################################
  146. #### update the self-signed (2048-bit) client-crl-dist.pem
  147. ############################################################
  148. echo "Updating 2048-bit client-crl-dist.pem"
  149. echo ""
  150. #pipe the following arguments to openssl req...
  151. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_2048\\nCRL_DIST\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key client-key.pem -config ./wolfssl.cnf -nodes -out client-cert.csr
  152. check_result $? "Step 1"
  153. openssl x509 -req -in client-cert.csr -days 1000 -extfile wolfssl.cnf -extensions crl_dist_points -signkey client-key.pem -out client-crl-dist.pem
  154. check_result $? "Step 2"
  155. rm client-cert.csr
  156. openssl x509 -in client-crl-dist.pem -text > tmp.pem
  157. check_result $? "Step 3"
  158. mv tmp.pem client-crl-dist.pem
  159. openssl x509 -in client-crl-dist.pem -outform der -out client-crl-dist.der
  160. echo "End of section"
  161. echo "---------------------------------------------------------------------"
  162. ############################################################
  163. #### update the self-signed (2048-bit) client-cert.pem #####
  164. ############################################################
  165. echo "Updating 2048-bit client-cert.pem"
  166. echo ""
  167. #pipe the following arguments to openssl req...
  168. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_2048\\nProgramming-2048\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key client-key.pem -config ./wolfssl.cnf -nodes -out client-cert.csr
  169. check_result $? "Step 1"
  170. openssl x509 -req -in client-cert.csr -days 1000 -extfile wolfssl.cnf -extensions wolfssl_opts -signkey client-key.pem -out client-cert.pem
  171. check_result $? "Step 2"
  172. rm client-cert.csr
  173. openssl x509 -in client-cert.pem -text > tmp.pem
  174. check_result $? "Step 3"
  175. mv tmp.pem client-cert.pem
  176. echo "End of section"
  177. echo "---------------------------------------------------------------------"
  178. ############################################################
  179. #### update the self-signed (1024-bit) client-cert.pem #####
  180. ############################################################
  181. echo "Updating 1024-bit client-cert.pem"
  182. echo ""
  183. #pipe the following arguments to openssl req...
  184. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_1024\\nProgramming-1024\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ./1024/client-key.pem -config ./wolfssl.cnf -nodes -out ./1024/client-cert.csr
  185. check_result $? "Step 1"
  186. openssl x509 -req -in ./1024/client-cert.csr -days 1000 -extfile wolfssl.cnf -extensions wolfssl_opts -signkey ./1024/client-key.pem -out ./1024/client-cert.pem
  187. check_result $? "Step 2"
  188. rm ./1024/client-cert.csr
  189. openssl x509 -in ./1024/client-cert.pem -text > ./1024/tmp.pem
  190. check_result $? "Step 3"
  191. mv ./1024/tmp.pem ./1024/client-cert.pem
  192. echo "End of section"
  193. echo "---------------------------------------------------------------------"
  194. ############################################################
  195. #### update the self-signed (3072-bit) client-cert.pem #####
  196. ############################################################
  197. echo "Updating 3072-bit client-cert.pem"
  198. echo ""
  199. #pipe the following arguments to openssl req...
  200. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_3072\\nProgramming-3072\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ./3072/client-key.pem -config ./wolfssl.cnf -nodes -out ./3072/client-cert.csr
  201. check_result $? "Step 1"
  202. openssl x509 -req -in ./3072/client-cert.csr -days 1000 -extfile wolfssl.cnf -extensions wolfssl_opts -signkey ./3072/client-key.pem -out ./3072/client-cert.pem
  203. check_result $? "Step 2"
  204. rm ./3072/client-cert.csr
  205. openssl x509 -in ./3072/client-cert.pem -text > ./3072/tmp.pem
  206. check_result $? "Step 3"
  207. mv ./3072/tmp.pem ./3072/client-cert.pem
  208. openssl rsa -in ./3072/client-key.pem -outform der -out ./3072/client-key.der
  209. openssl rsa -inform pem -in ./3072/client-key.pem -outform der -out ./3072/client-keyPub.der -pubout
  210. openssl x509 -in ./3072/client-cert.pem -outform der -out ./3072/client-cert.der
  211. echo "End of section"
  212. echo "---------------------------------------------------------------------"
  213. ############################################################
  214. #### update the self-signed (4096-bit) client-cert.pem #####
  215. ############################################################
  216. echo "Updating 4096-bit client-cert.pem"
  217. echo ""
  218. #pipe the following arguments to openssl req...
  219. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_4096\\nProgramming-4096\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ./4096/client-key.pem -config ./wolfssl.cnf -nodes -out ./4096/client-cert.csr
  220. check_result $? "Step 1"
  221. openssl x509 -req -in ./4096/client-cert.csr -days 1000 -extfile wolfssl.cnf -extensions wolfssl_opts -signkey ./4096/client-key.pem -out ./4096/client-cert.pem
  222. check_result $? "Step 2"
  223. rm ./4096/client-cert.csr
  224. openssl x509 -in ./4096/client-cert.pem -text > ./4096/tmp.pem
  225. check_result $? "Step 3"
  226. mv ./4096/tmp.pem ./4096/client-cert.pem
  227. openssl rsa -in ./4096/client-key.pem -outform der -out ./4096/client-key.der
  228. openssl rsa -inform pem -in ./4096/client-key.pem -outform der -out ./4096/client-keyPub.der -pubout
  229. openssl x509 -in ./4096/client-cert.pem -outform der -out ./4096/client-cert.der
  230. echo "End of section"
  231. echo "---------------------------------------------------------------------"
  232. ############################################################
  233. ########## update the self-signed ca-cert.pem ##############
  234. ############################################################
  235. echo "Updating ca-cert.pem"
  236. echo ""
  237. #pipe the following arguments to openssl req...
  238. echo -e "US\\nMontana\\nBozeman\\nSawtooth\\nConsulting\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ca-key.pem -config ./wolfssl.cnf -nodes -out ca-cert.csr
  239. check_result $? "Step 1"
  240. openssl x509 -req -in ca-cert.csr -days 1000 -extfile wolfssl.cnf -extensions wolfssl_opts -signkey ca-key.pem -out ca-cert.pem
  241. check_result $? "Step 2"
  242. rm ca-cert.csr
  243. openssl x509 -in ca-cert.pem -text > tmp.pem
  244. check_result $? "Step 3"
  245. mv tmp.pem ca-cert.pem
  246. echo "End of section"
  247. echo "---------------------------------------------------------------------"
  248. ############################################################
  249. ########## update the self-signed ca-cert-chain.der ########
  250. ############################################################
  251. echo "Updating ca-cert-chain.der"
  252. echo ""
  253. #pipe the following arguments to openssl req...
  254. echo -e "US\\nMontana\\nBozeman\\nSawtooth\\nConsulting\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key 1024/ca-key.pem -config ./wolfssl.cnf -nodes -out ca-cert.csr
  255. check_result $? "Step 1"
  256. openssl x509 -req -in ca-cert.csr -days 1000 -extfile wolfssl.cnf -extensions wolfssl_opts -signkey 1024/ca-key.pem -outform DER -out ca-cert-chain.der
  257. check_result $? "Step 2"
  258. rm ca-cert.csr
  259. echo "End of section"
  260. echo "---------------------------------------------------------------------"
  261. ############################################################
  262. ########## update the self-signed ca-ecc-cert.pem ##########
  263. ############################################################
  264. echo "Updating ca-ecc-cert.pem"
  265. echo ""
  266. #pipe the following arguments to openssl req...
  267. echo -e "US\\nWashington\\nSeattle\\nwolfSSL\\nDevelopment\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ca-ecc-key.pem -config ./wolfssl.cnf -nodes -out ca-ecc-cert.csr
  268. check_result $? "Step 1"
  269. openssl x509 -req -in ca-ecc-cert.csr -days 1000 -extfile wolfssl.cnf -extensions ca_ecc_cert -signkey ca-ecc-key.pem -out ca-ecc-cert.pem
  270. check_result $? "Step 2"
  271. rm ca-ecc-cert.csr
  272. openssl x509 -in ca-ecc-cert.pem -text > tmp.pem
  273. check_result $? "Step 3"
  274. mv tmp.pem ca-ecc-cert.pem
  275. echo "End of section"
  276. echo "---------------------------------------------------------------------"
  277. ############################################################
  278. ########## update the self-signed ca-ecc384-cert.pem #######
  279. ############################################################
  280. echo "Updating ca-ecc384-cert.pem"
  281. echo ""
  282. #pipe the following arguments to openssl req...
  283. echo -e "US\\nWashington\\nSeattle\\nwolfSSL\\nDevelopment\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ca-ecc384-key.pem -config ./wolfssl.cnf -nodes -sha384 -out ca-ecc384-cert.csr
  284. check_result $? "Step 1"
  285. openssl x509 -req -in ca-ecc384-cert.csr -days 1000 -extfile wolfssl.cnf -extensions ca_ecc_cert -signkey ca-ecc384-key.pem -sha384 -out ca-ecc384-cert.pem
  286. check_result $? "Step 2"
  287. rm ca-ecc384-cert.csr
  288. openssl x509 -in ca-ecc384-cert.pem -text > tmp.pem
  289. check_result $? "Step 3"
  290. mv tmp.pem ca-ecc384-cert.pem
  291. echo "End of section"
  292. echo "---------------------------------------------------------------------"
  293. ############################################################
  294. ##### update the self-signed (1024-bit) ca-cert.pem ########
  295. ############################################################
  296. echo "Updating 1024-bit ca-cert.pem"
  297. echo ""
  298. #pipe the following arguments to openssl req...
  299. echo -e "US\\nMontana\\nBozeman\\nSawtooth\\nConsulting_1024\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ./1024/ca-key.pem -config ./wolfssl.cnf -nodes -sha1 -out ./1024/ca-cert.csr
  300. check_result $? "Step 1"
  301. openssl x509 -req -in ./1024/ca-cert.csr -days 1000 -extfile wolfssl.cnf -extensions wolfssl_opts -signkey ./1024/ca-key.pem -out ./1024/ca-cert.pem
  302. check_result $? "Step 2"
  303. rm ./1024/ca-cert.csr
  304. openssl x509 -in ./1024/ca-cert.pem -text > ./1024/tmp.pem
  305. check_result $? "Step 3"
  306. mv ./1024/tmp.pem ./1024/ca-cert.pem
  307. echo "End of section"
  308. echo "---------------------------------------------------------------------"
  309. ###########################################################
  310. ########## update and sign fpki-cert.der ################
  311. ###########################################################
  312. echo "Updating fpki-cert.der"
  313. echo ""
  314. #pipe the following arguments to openssl req...
  315. echo -e "US\\nMontana\\nBozeman\\nwolfSSL\\nFPKI\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key server-key.pem -config ./wolfssl.cnf -nodes > fpki-req.pem
  316. check_result $? "Step 1"
  317. openssl x509 -req -in fpki-req.pem -extfile wolfssl.cnf -extensions fpki_ext -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out fpki-cert.der -outform DER
  318. check_result $? "Step 2"
  319. rm fpki-req.pem
  320. echo "End of section"
  321. echo "---------------------------------------------------------------------"
  322. ###########################################################
  323. ########## update and sign rid-cert.der ################
  324. ###########################################################
  325. echo "Updating rid-cert.der"
  326. echo ""
  327. #pipe the following arguments to openssl req...
  328. echo -e "US\\nMontana\\nBozeman\\nwolfSSL\\nRID\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key server-key.pem -config ./wolfssl.cnf -nodes > rid-req.pem
  329. check_result $? "Step 1"
  330. openssl x509 -req -in rid-req.pem -extfile wolfssl.cnf -extensions rid_ext -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 7 -out rid-cert.der -outform DER
  331. check_result $? "Step 2"
  332. rm rid-req.pem
  333. echo "End of section"
  334. echo "---------------------------------------------------------------------"
  335. ###########################################################
  336. ########## update and sign server-cert.pem ################
  337. ###########################################################
  338. echo "Updating server-cert.pem"
  339. echo ""
  340. #pipe the following arguments to openssl req...
  341. echo -e "US\\nMontana\\nBozeman\\nwolfSSL\\nSupport\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key server-key.pem -config ./wolfssl.cnf -nodes > server-req.pem
  342. check_result $? "Step 1"
  343. openssl x509 -req -in server-req.pem -extfile wolfssl.cnf -extensions wolfssl_opts -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
  344. check_result $? "Step 2"
  345. rm server-req.pem
  346. openssl x509 -in ca-cert.pem -text > ca_tmp.pem
  347. check_result $? "Step 3"
  348. openssl x509 -in server-cert.pem -text > srv_tmp.pem
  349. check_result $? "Step 4"
  350. mv srv_tmp.pem server-cert.pem
  351. cat ca_tmp.pem >> server-cert.pem
  352. rm ca_tmp.pem
  353. echo "End of section"
  354. echo "---------------------------------------------------------------------"
  355. ###########################################################
  356. ########## update and sign server-revoked-key.pem #########
  357. ###########################################################
  358. echo "Updating server-revoked-cert.pem"
  359. echo ""
  360. #pipe the following arguments to openssl req...
  361. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_revoked\\nSupport_revoked\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key server-revoked-key.pem -config ./wolfssl.cnf -nodes > server-revoked-req.pem
  362. check_result $? "Step 1"
  363. openssl x509 -req -in server-revoked-req.pem -extfile wolfssl.cnf -extensions wolfssl_opts -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 02 > server-revoked-cert.pem
  364. check_result $? "Step 2"
  365. rm server-revoked-req.pem
  366. openssl x509 -in ca-cert.pem -text > ca_tmp.pem
  367. check_result $? "Step 3"
  368. openssl x509 -in server-revoked-cert.pem -text > srv_tmp.pem
  369. check_result $? "Step 4"
  370. mv srv_tmp.pem server-revoked-cert.pem
  371. cat ca_tmp.pem >> server-revoked-cert.pem
  372. rm ca_tmp.pem
  373. echo "End of section"
  374. echo "---------------------------------------------------------------------"
  375. ###########################################################
  376. ########## update and sign server-duplicate-policy.pem ####
  377. ###########################################################
  378. echo "Updating server-duplicate-policy.pem"
  379. echo ""
  380. #pipe the following arguments to openssl req...
  381. echo -e "US\\nMontana\\nBozeman\\nwolfSSL\\ntesting duplicate policy\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key server-key.pem -config ./wolfssl.cnf -nodes > ./test/server-duplicate-policy-req.pem
  382. check_result $? "Step 1"
  383. openssl x509 -req -in ./test/server-duplicate-policy-req.pem -extfile wolfssl.cnf -extensions policy_test -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 02 > ./test/server-duplicate-policy.pem
  384. check_result $? "Step 2"
  385. rm ./test/server-duplicate-policy-req.pem
  386. openssl x509 -in ca-cert.pem -text > ca_tmp.pem
  387. check_result $? "Step 3"
  388. openssl x509 -in ./test/server-duplicate-policy.pem -text > srv_tmp.pem
  389. check_result $? "Step 4"
  390. mv srv_tmp.pem ./test/server-duplicate-policy.pem
  391. cat ca_tmp.pem >> ./test/server-duplicate-policy.pem
  392. rm ca_tmp.pem
  393. echo "End of section"
  394. echo "---------------------------------------------------------------------"
  395. ###########################################################
  396. #### update and sign (1024-bit) server-cert.pem ###########
  397. ###########################################################
  398. echo "Updating 1024-bit server-cert.pem"
  399. echo ""
  400. #pipe the following arguments to openssl req...
  401. echo -e "US\\nMontana\\nBozeman\\nwolfSSL\\nSupport_1024\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ./1024/server-key.pem -config ./wolfssl.cnf -nodes -sha1 > ./1024/server-req.pem
  402. check_result $? "Step 1"
  403. openssl x509 -req -in ./1024/server-req.pem -extfile wolfssl.cnf -extensions wolfssl_opts -days 1000 -CA ./1024/ca-cert.pem -CAkey ./1024/ca-key.pem -set_serial 01 > ./1024/server-cert.pem
  404. check_result $? "Step 2"
  405. rm ./1024/server-req.pem
  406. openssl x509 -in ./1024/ca-cert.pem -text > ./1024/ca_tmp.pem
  407. check_result $? "Step 3"
  408. openssl x509 -in ./1024/server-cert.pem -text > ./1024/srv_tmp.pem
  409. check_result $? "Step 4"
  410. mv ./1024/srv_tmp.pem ./1024/server-cert.pem
  411. cat ./1024/ca_tmp.pem >> ./1024/server-cert.pem
  412. rm ./1024/ca_tmp.pem
  413. echo "End of section"
  414. echo "---------------------------------------------------------------------"
  415. ############################################################
  416. ########## update and sign the server-ecc-rsa.pem ##########
  417. ############################################################
  418. echo "Updating server-ecc-rsa.pem"
  419. echo ""
  420. echo -e "US\\nMontana\\nBozeman\\nElliptic - RSAsig\\nECC-RSAsig\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ecc-key.pem -config ./wolfssl.cnf -nodes > server-ecc-req.pem
  421. check_result $? "Step 1"
  422. openssl x509 -req -in server-ecc-req.pem -extfile wolfssl.cnf -extensions wolfssl_opts -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-ecc-rsa.pem
  423. check_result $? "Step 2"
  424. rm server-ecc-req.pem
  425. openssl x509 -in server-ecc-rsa.pem -text > tmp.pem
  426. check_result $? "Step 3"
  427. mv tmp.pem server-ecc-rsa.pem
  428. echo "End of section"
  429. echo "---------------------------------------------------------------------"
  430. ############################################################
  431. ####### update the self-signed client-ecc-cert.pem #########
  432. ############################################################
  433. echo "Updating client-ecc-cert.pem"
  434. echo ""
  435. #pipe the following arguments to openssl req...
  436. echo -e "US\\nOregon\\nSalem\\nClient ECC\\nFast\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ecc-client-key.pem -config ./wolfssl.cnf -nodes -out client-ecc-cert.csr
  437. check_result $? "Step 1"
  438. openssl x509 -req -in client-ecc-cert.csr -days 1000 -extfile wolfssl.cnf -extensions wolfssl_opts -signkey ecc-client-key.pem -out client-ecc-cert.pem
  439. check_result $? "Step 2"
  440. rm client-ecc-cert.csr
  441. openssl x509 -in client-ecc-cert.pem -text > tmp.pem
  442. check_result $? "Step 3"
  443. mv tmp.pem client-ecc-cert.pem
  444. echo "End of section"
  445. echo "---------------------------------------------------------------------"
  446. ############################################################
  447. ########## update the server-ecc.pem #######################
  448. ############################################################
  449. echo "Updating server-ecc.pem"
  450. echo ""
  451. #pipe the following arguments to openssl req...
  452. echo -e "US\\nWashington\\nSeattle\\nElliptic\\nECC\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ecc-key.pem -config ./wolfssl.cnf -nodes -out server-ecc.csr
  453. check_result $? "Step 1"
  454. openssl x509 -req -in server-ecc.csr -days 1000 -extfile wolfssl.cnf -extensions server_ecc -CA ca-ecc-cert.pem -CAkey ca-ecc-key.pem -set_serial 03 -out server-ecc.pem
  455. check_result $? "Step 2"
  456. rm server-ecc.csr
  457. openssl x509 -in server-ecc.pem -text > tmp.pem
  458. check_result $? "Step 3"
  459. mv tmp.pem server-ecc.pem
  460. echo "End of section"
  461. echo "---------------------------------------------------------------------"
  462. ############################################################
  463. ###### update the self-signed server-ecc-comp.pem ##########
  464. ############################################################
  465. echo "Updating server-ecc-comp.pem"
  466. echo ""
  467. #pipe the following arguments to openssl req...
  468. echo -e "US\\nMontana\\nBozeman\\nElliptic - comp\\nServer ECC-comp\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ecc-key-comp.pem -config ./wolfssl.cnf -nodes -out server-ecc-comp.csr
  469. check_result $? "Step 1"
  470. openssl x509 -req -in server-ecc-comp.csr -days 1000 -extfile wolfssl.cnf -extensions wolfssl_opts -signkey ecc-key-comp.pem -out server-ecc-comp.pem
  471. check_result $? "Step 2"
  472. rm server-ecc-comp.csr
  473. openssl x509 -in server-ecc-comp.pem -text > tmp.pem
  474. check_result $? "Step 3"
  475. mv tmp.pem server-ecc-comp.pem
  476. echo "End of section"
  477. echo "---------------------------------------------------------------------"
  478. ############################################################
  479. ############## create the client-ca.pem file ###############
  480. ############################################################
  481. echo "Updating client-ca.pem"
  482. echo ""
  483. cat client-cert.pem client-ecc-cert.pem > client-ca.pem
  484. echo "End of section"
  485. echo "---------------------------------------------------------------------"
  486. ############################################################
  487. ###### update the self-signed ecc-privOnlyCert.pem #########
  488. ############################################################
  489. echo "Updating ecc-privOnlyCert.pem"
  490. echo ""
  491. #pipe the following arguments to openssl req...
  492. echo -e ".\\n.\\n.\\nWR\\n.\\nDE\\n.\\n.\\n.\\n" | openssl req -new -key ecc-privOnlyKey.pem -config ./wolfssl.cnf -nodes -out ecc-privOnly.csr
  493. check_result $? "Step 1"
  494. openssl x509 -req -in ecc-privOnly.csr -days 1000 -signkey ecc-privOnlyKey.pem -out ecc-privOnlyCert.pem
  495. check_result $? "Step 2"
  496. rm ecc-privOnly.csr
  497. echo "End of section"
  498. echo "---------------------------------------------------------------------"
  499. ############################################################
  500. ###### update the self-signed test/digsigku.pem ##########
  501. ############################################################
  502. echo "Updating test/digsigku.pem"
  503. echo ""
  504. #pipe the following arguments to openssl req...
  505. echo -e "US\\nWashington\\nSeattle\\nFoofarah\\nArglebargle\\nfoobarbaz\\ninfo@worlss.com\\n.\\n.\\n" | openssl req -new -key ecc-key.pem -config ./wolfssl.cnf -nodes -sha1 -out digsigku.csr
  506. check_result $? "Step 1"
  507. openssl x509 -req -in digsigku.csr -days 1000 -extfile wolfssl.cnf -extensions digsigku -signkey ecc-key.pem -sha1 -set_serial 16393466893990650224 -out digsigku.pem
  508. check_result $? "Step 2"
  509. rm digsigku.csr
  510. openssl x509 -in digsigku.pem -text > tmp.pem
  511. check_result $? "Step 3"
  512. mv tmp.pem digsigku.pem
  513. mv digsigku.pem test/digsigku.pem
  514. echo "End of section"
  515. echo "---------------------------------------------------------------------"
  516. ###########################################################
  517. #### update and sign entity-no-ca-bool-cert.pem ###########
  518. ###########################################################
  519. echo "Updating entity-no-ca-bool-cert.pem"
  520. echo ""
  521. #pipe the following arguments to openssl req...
  522. echo -e "US\\nMontana\\nBozeman\\nwolfSSL\\nNoCaBool\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key entity-no-ca-bool-key.pem -config ./wolfssl.cnf -nodes > entity-no-ca-bool-req.pem
  523. check_result $? "Step 1"
  524. openssl x509 -req -in entity-no-ca-bool-req.pem -extfile ./wolfssl.cnf -extensions "entity_no_CA_BOOL" -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > entity-no-ca-bool-cert.pem
  525. check_result $? "Step 2"
  526. rm entity-no-ca-bool-req.pem
  527. openssl x509 -in ca-cert.pem -text > ca_tmp.pem
  528. check_result $? "Step 3"
  529. openssl x509 -in entity-no-ca-bool-cert.pem -text > entity_tmp.pem
  530. check_result $? "Step 4"
  531. mv entity_tmp.pem entity-no-ca-bool-cert.pem
  532. cat ca_tmp.pem >> entity-no-ca-bool-cert.pem
  533. rm ca_tmp.pem
  534. echo "End of section"
  535. ############################################################
  536. ########## make .der files from .pem files #################
  537. ############################################################
  538. echo "Creating der formatted certs..."
  539. echo ""
  540. openssl x509 -inform PEM -in ./1024/client-cert.pem -outform DER -out ./1024/client-cert.der
  541. check_result $? "Der Cert 1"
  542. openssl x509 -inform PEM -in ./1024/server-cert.pem -outform DER -out ./1024/server-cert.der
  543. check_result $? "Der Cert 2"
  544. openssl x509 -inform PEM -in ./1024/ca-cert.pem -outform DER -out ./1024/ca-cert.der
  545. check_result $? "Der Cert 3"
  546. openssl x509 -inform PEM -in ca-cert.pem -outform DER -out ca-cert.der
  547. check_result $? "Der Cert 4"
  548. openssl x509 -inform PEM -in ca-ecc-cert.pem -outform DER -out ca-ecc-cert.der
  549. check_result $? "Der Cert 5"
  550. openssl x509 -inform PEM -in ca-ecc384-cert.pem -outform DER -out ca-ecc384-cert.der
  551. check_result $? "Der Cert 6"
  552. openssl x509 -inform PEM -in client-cert.pem -outform DER -out client-cert.der
  553. check_result $? "Der Cert 7"
  554. openssl x509 -inform PEM -in server-cert.pem -outform DER -out server-cert.der
  555. check_result $? "Der Cert 8"
  556. openssl x509 -inform PEM -in client-ecc-cert.pem -outform DER -out client-ecc-cert.der
  557. check_result $? "Der Cert 9"
  558. openssl x509 -inform PEM -in server-ecc-rsa.pem -outform DER -out server-ecc-rsa.der
  559. check_result $? "Der Cert 10"
  560. openssl x509 -inform PEM -in server-ecc.pem -outform DER -out server-ecc.der
  561. check_result $? "Der Cert 11"
  562. openssl x509 -inform PEM -in server-ecc-comp.pem -outform DER -out server-ecc-comp.der
  563. check_result $? "Der Cert 12"
  564. cat server-cert.der ca-cert.der >server-cert-chain.der
  565. check_result $? "Der Cert 13"
  566. echo "End of section"
  567. echo "---------------------------------------------------------------------"
  568. ############################################################
  569. ########## generate RSA-PSS certificates ###################
  570. ############################################################
  571. echo "Renewing RSA-PSS certificates"
  572. cd rsapss
  573. ./renew-rsapss-certs.sh
  574. cd ..
  575. echo "End of section"
  576. echo "---------------------------------------------------------------------"
  577. ############################################################
  578. ########## generate Ed25519 certificates ###################
  579. ############################################################
  580. echo "Renewing Ed25519 certificates"
  581. cd ed25519
  582. ./gen-ed25519-certs.sh
  583. cd ..
  584. echo "End of section"
  585. echo "---------------------------------------------------------------------"
  586. ############################################################
  587. ########## generate Ed448 certificates #####################
  588. ############################################################
  589. echo "Renewing Ed448 certificates"
  590. cd ed448
  591. ./gen-ed448-certs.sh
  592. cd ..
  593. echo "End of section"
  594. echo "---------------------------------------------------------------------"
  595. ############################################################
  596. ########## generate P-521 certificates #####################
  597. ############################################################
  598. echo "Renewing Ed448 certificates"
  599. cd p521
  600. ./gen-p521-certs.sh
  601. cd ..
  602. echo "End of section"
  603. echo "---------------------------------------------------------------------"
  604. ############################################################
  605. ########## update Raw Public Key certificates ##############
  606. ############################################################
  607. echo "Updating certificates"
  608. echo "Updating client-cert-rpk.der"
  609. cp client-keyPub.der ./rpk/client-cert-rpk.der
  610. check_result $? "Step 1"
  611. echo "Updating client-ecc-cert-rpk.der"
  612. cp ecc-client-keyPub.der ./rpk/ecc-client-cert-rpk.der
  613. check_result $? "Step 2"
  614. echo "Updating server-cert-rpk.der"
  615. openssl rsa -inform pem -in server-key.pem -outform der -out ./rpk/server-cert-rpk.der -pubout
  616. check_result $? "Step 3"
  617. echo "Updating server-ecc-cert-rpk.der"
  618. openssl ec -inform pem -in ecc-key.pem -outform der -out ./rpk/server-ecc-cert-rpk.der -pubout
  619. check_result $? "Step 4"
  620. echo "End of section"
  621. echo "---------------------------------------------------------------------"
  622. ############################################################
  623. ###### update the ecc-rsa-server.p12 file ##################
  624. ############################################################
  625. echo "Updating ecc-rsa-server.p12 (password is \"\")"
  626. echo ""
  627. echo "" | openssl pkcs12 -des3 -descert -export -in server-ecc-rsa.pem -inkey ecc-key.pem -certfile server-ecc.pem -out ecc-rsa-server.p12 -password stdin
  628. check_result $? "Step 1"
  629. echo "End of section"
  630. echo "---------------------------------------------------------------------"
  631. ############################################################
  632. ###### update the test-servercert.p12 file #################
  633. ############################################################
  634. echo "Updating test-servercert.p12 (password is \"wolfSSL test\")"
  635. echo ""
  636. echo "wolfSSL test" | openssl pkcs12 -des3 -descert -export -in server-cert.pem -inkey server-key.pem -certfile ca-cert.pem -out test-servercert.p12 -password stdin
  637. check_result $? "Step 1"
  638. echo "End of section"
  639. echo "---------------------------------------------------------------------"
  640. ############################################################
  641. ###### update the test-servercert-rc2.p12 file #############
  642. ############################################################
  643. echo "Updating test-servercert-rc2.p12 (password is \"wolfSSL test\")"
  644. echo ""
  645. echo "wolfSSL test" | openssl pkcs12 -export -in server-cert.pem -inkey server-key.pem -certfile ca-cert.pem -out test-servercert-rc2.p12 -password stdin
  646. check_result $? "Step 1"
  647. echo "End of section"
  648. echo "---------------------------------------------------------------------"
  649. ############################################################
  650. ###### calling gen-ext-certs.sh ##################
  651. ############################################################
  652. echo "Calling gen-ext-certs.sh"
  653. echo ""
  654. cd .. || exit 1
  655. ./certs/test/gen-ext-certs.sh
  656. check_result $? "gen-ext-certs.sh"
  657. cd ./certs || { echo "Couldn't cd to certs directory"; exit 1; }
  658. echo "End of section"
  659. echo "---------------------------------------------------------------------"
  660. ############################################################
  661. ###### calling gen-badsig.sh ##################
  662. ############################################################
  663. echo "Calling gen-badsig.sh"
  664. echo ""
  665. cd ./test || { echo "Failed to switch to dir ./test"; exit 1; }
  666. ./gen-badsig.sh
  667. check_result $? "gen-badsig.sh"
  668. cd ../ || exit 1
  669. echo "End of section"
  670. echo "---------------------------------------------------------------------"
  671. ############################################################
  672. ###### calling gen-testcerts.sh ##################
  673. ############################################################
  674. echo "Calling gen-testcerts.sh"
  675. echo ""
  676. cd ./test || { echo "Failed to switch to dir ./test"; exit 1; }
  677. ./gen-testcerts.sh
  678. check_result $? "gen-testcerts.sh"
  679. cd ../ || exit 1
  680. echo "End of section"
  681. echo "---------------------------------------------------------------------"
  682. ############################################################
  683. ###### generate cms bundles in test directory ##############
  684. ############################################################
  685. echo "Generating CMS bundle"
  686. echo ""
  687. cd ./test || { echo "Failed to switch to dir ./test"; exit 1; }
  688. echo "test" | openssl cms -encrypt -binary -keyid -out ktri-keyid-cms.msg -outform der -recip ../client-cert.pem -nocerts
  689. check_result $? "generate ktri-keyid-cms.msg"
  690. cd ../ || exit 1
  691. echo "End of section"
  692. echo "---------------------------------------------------------------------"
  693. ############################################################
  694. ########## generate ocsp certs ######################
  695. ############################################################
  696. echo "Changing directory to ocsp..."
  697. echo ""
  698. # guard against recursive calls to renewcerts.sh
  699. if [ -d ocsp ]; then
  700. cd ./ocsp || { echo "Failed to switch to dir ./ocsp"; exit 1; }
  701. echo "Execute ocsp/renewcerts.sh..."
  702. ./renewcerts.sh
  703. check_result $? "renewcerts.sh"
  704. cd ../ || exit 1
  705. else
  706. echo "Error could not find ocsp directory"
  707. exit 1
  708. fi
  709. echo "End of section"
  710. echo "---------------------------------------------------------------------"
  711. ############################################################
  712. ###### calling assemble-chains.sh ##################
  713. ############################################################
  714. echo "Calling assemble-chains.sh"
  715. echo ""
  716. cd ./test-pathlen || { echo "Failed to switch to dir ./test-pathlen";
  717. exit 1; }
  718. ./assemble-chains.sh
  719. check_result $? "assemble-chains.sh"
  720. cd ../ || exit 1
  721. echo "End of section"
  722. echo "---------------------------------------------------------------------"
  723. ############################################################
  724. ########## store DER files as buffers ######################
  725. ############################################################
  726. echo "Changing directory to wolfssl root..."
  727. echo ""
  728. cd ../ || exit 1
  729. echo "Execute ./gencertbuf.pl..."
  730. echo ""
  731. ./gencertbuf.pl
  732. check_result $? "gencertbuf.pl"
  733. echo "End of section"
  734. echo "---------------------------------------------------------------------"
  735. ############################################################
  736. ########## generate the new crls ###########################
  737. ############################################################
  738. echo "Change directory to wolfssl/certs"
  739. echo ""
  740. cd ./certs || { echo "Failed to switch to dir ./certs"; exit 1; }
  741. echo "We are back in the certs directory"
  742. echo ""
  743. echo "Updating the crls..."
  744. echo ""
  745. cd ./crl || { echo "Failed to switch to dir ./crl"; exit 1; }
  746. echo "changed directory: cd/crl"
  747. echo ""
  748. # has dependency on rsapss generation (rsapss should be ran first)
  749. ./gencrls.sh
  750. check_result $? "gencrls.sh"
  751. echo "ran ./gencrls.sh"
  752. echo ""
  753. ############################################################
  754. ########## generate PKCS7 bundles ##########################
  755. ############################################################
  756. echo "Changing directory to wolfssl certs..."
  757. echo ""
  758. cd ../ || exit 1
  759. echo "Creating test-degenerate.p7b..."
  760. echo ""
  761. openssl crl2pkcs7 -nocrl -certfile ./client-cert.pem -out test-degenerate.p7b -outform DER
  762. check_result $? ""
  763. openssl smime -sign -in ./ca-cert.pem -out test-stream-sign.p7b -signer ./ca-cert.pem -nodetach -nocerts -binary -outform DER -stream -inkey ./ca-key.pem
  764. check_result $? ""
  765. echo "End of section"
  766. echo "---------------------------------------------------------------------"
  767. #cleanup the file system now that we're done
  768. echo "Performing final steps, cleaning up the file system..."
  769. echo ""
  770. rm ../wolfssl.cnf
  771. echo "End of Updates. Everything was successfully updated!"
  772. echo "---------------------------------------------------------------------"
  773. }
  774. ###############################################################################
  775. ##################### THE EXECUTABLE BODY #####################################
  776. ###############################################################################
  777. #start in root.
  778. cd ../ || exit 1
  779. if [ ! -z "$1" ]; then
  780. echo "No arguments expected"
  781. exit 1
  782. fi
  783. echo "Running make clean"
  784. echo ""
  785. make clean
  786. check_result $? "make clean"
  787. touch certs/.rnd || exit 1
  788. run_renewcerts
  789. cd ../ || exit 1
  790. rm ./certs/wolfssl.cnf
  791. exit 0