wolfssl/certs/intermediate/genintcerts.sh

#!/bin/sh

# Script for generating RSA and ECC Intermediate CA and server/client certs based on it.

# Result is chains that looks like:
# RSA Server
#  ROOT: ./certs/ca-cert.pem
#      C=US, ST=Montana, L=Bozeman, O=Sawtooth, OU=Consulting, CN=www.wolfssl.com/emailAddress=info@wolfssl.com)
#    INTERMEDIATE: ./certs/intermediate/ca-int-cert.pem 
#        C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=wolfSSL Intermediate CA/emailAddress=info@wolfssl.com
#      INTERMEDIATE2: ./certs/intermediate/ca-int2-cert.pem 
#          C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=wolfSSL Intermediate2 CA/emailAddress=info@wolfssl.com
#        SERVER: ./certs/intermediate/server-int-cert.pem
#            C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=wolfSSL Server Chain/emailAddress=info@wolfssl.com

# RSA Client
#  ROOT: ./certs/ca-cert.pem
#      C=US, ST=Montana, L=Bozeman, O=Sawtooth, OU=Consulting, CN=www.wolfssl.com/emailAddress=info@wolfssl.com)
#    INTERMEDIATE: ./certs/intermediate/ca-int-cert.pem 
#        C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=wolfSSL Intermediate CA/emailAddress=info@wolfssl.com
#      INTERMEDIATE: ./certs/intermediate/ca-int2-cert.pem 
#          C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=wolfSSL Intermediate2 CA/emailAddress=info@wolfssl.com
#        CLIENT: ./certs/intermediate/client-int-cert.pem
#            C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=wolfSSL Client Chain/emailAddress=info@wolfssl.com

# ECC Server
#  ROOT: ./certs/ca-ecc-cert.pem
#      C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=www.wolfssl.com/emailAddress=info@wolfssl.com
#    INTERMEDIATE: ./certs/intermediate/ca-int-ecc-cert.pem 
#        C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=wolfSSL Intermediate CA ECC/emailAddress=info@wolfssl.com
#      INTERMEDIATE2: ./certs/intermediate/ca-int-ecc-cert.pem 
#          C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=wolfSSL Intermediate2 CA ECC/emailAddress=info@wolfssl.com
#        SERVER: ./certs/intermediate/server-int-ecc-cert.pem
#            C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=wolfSSL Server Chain ECC/emailAddress=info@wolfssl.com

# ECC Client
#  ROOT: ./certs/ca-ecc-cert.pem
#      C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=www.wolfssl.com/emailAddress=info@wolfssl.com
#    INTERMEDIATE: ./certs/intermediate/ca-int-ecc-cert.pem 
#        C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=wolfSSL Intermediate CA ECC/emailAddress=info@wolfssl.com
#      INTERMEDIATE2: ./certs/intermediate/ca-int2-ecc-cert.pem 
#          C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=wolfSSL Intermediate2 CA ECC/emailAddress=info@wolfssl.com
#        CLIENT: ./certs/intermediate/client-int-ecc-cert.pem
#            C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=wolfSSL Client Chain ECC/emailAddress=info@wolfssl.com


# Run from wolfssl-root as  `./certs/intermediate/genintcerts.sh`
# To cleanup temp files use `./certs/intermediate/genintcerts.sh clean`
# To cleanup all files use  `./certs/intermediate/genintcerts.sh cleanall`

dir="."

cleanup_files(){
    rm -f ./certs/intermediate/index.*
    rm -f ./certs/intermediate/*.old
    rm -f ./certs/intermediate/serial
    rm -f ./certs/intermediate/crlnumber
    rm -f ./certs/intermediate/*.cnf
    rm -rf ./certs/intermediate/new_certs
    exit 0
}

check_result() {
    if [ $1 -ne 0 ]; then
        echo "Step Failed, Abort"
        exit 1
    else
        echo "Step Succeeded!"
    fi
}

# Args: 1=CnfFile, 2=Key, 3=Cert
create_ca_config() {
    echo "# Generated openssl conf"                              > "$1"
    echo "[ ca ]"                                               >> "$1"
    echo "default_ca = CA_default"                              >> "$1"
    echo ""                                                     >> "$1"
    echo "[ CA_default ]"                                       >> "$1"
    echo "certs             = $dir/certs/intermediate"          >> "$1"
    echo "new_certs_dir     = $dir/certs/intermediate/new_certs">> "$1"
    echo "database          = $dir/certs/intermediate/index.txt">> "$1"
    echo "serial            = $dir/certs/intermediate/serial"   >> "$1"
    echo "RANDFILE          = $dir/private/.rand"               >> "$1"
    echo ""                                                     >> "$1"
    echo "private_key       = $dir/$2"                          >> "$1"
    echo "certificate       = $dir/$3"                          >> "$1"
    echo ""                                                     >> "$1"
    echo "crlnumber         = $dir/certs/intermediate/crlnumber">> "$1"
    echo "crl_extensions    = crl_ext"                          >> "$1"
    echo "default_crl_days  = 1000"                             >> "$1"
    echo "default_md        = sha256"                           >> "$1"
    echo ""                                                     >> "$1"
    echo "name_opt          = ca_default"                       >> "$1"
    echo "cert_opt          = ca_default"                       >> "$1"
    echo "default_days      = 3650"                             >> "$1"
    echo "preserve          = no"                               >> "$1"
    echo "policy            = policy_loose"                     >> "$1"
    echo ""                                                     >> "$1"
    echo "[ policy_strict ]"                                    >> "$1"
    echo "countryName             = match"                      >> "$1"
    echo "stateOrProvinceName     = match"                      >> "$1"
    echo "organizationName        = match"                      >> "$1"
    echo "organizationalUnitName  = optional"                   >> "$1"
    echo "commonName              = supplied"                   >> "$1"
    echo "emailAddress            = optional"                   >> "$1"
    echo ""                                                     >> "$1"
    echo "[ policy_loose ]"                                     >> "$1"
    echo "countryName             = optional"                   >> "$1"
    echo "stateOrProvinceName     = optional"                   >> "$1"
    echo "localityName            = optional"                   >> "$1"
    echo "organizationName        = optional"                   >> "$1"
    echo "organizationalUnitName  = optional"                   >> "$1"
    echo "commonName              = supplied"                   >> "$1"
    echo "emailAddress            = optional"                   >> "$1"
    echo ""                                                     >> "$1"
    echo "[ req ]"                                              >> "$1"
    echo "default_bits        = 2048"                           >> "$1"
    echo "distinguished_name  = req_distinguished_name"         >> "$1"
    echo "string_mask         = utf8only"                       >> "$1"
    echo "default_md          = sha256"                         >> "$1"
    echo "x509_extensions     = v3_ca"                          >> "$1"
    echo ""                                                     >> "$1"
    echo "[ req_distinguished_name ]"                           >> "$1"
    echo "countryName                     = US"                 >> "$1"
    echo "stateOrProvinceName             = Washington"         >> "$1"
    echo "localityName                    = Seattle"            >> "$1"
    echo "organizationName                = wolfSSL"            >> "$1"
    echo "organizationalUnitName          = Development"        >> "$1"
    echo "commonName                      = www.wolfssl.com"    >> "$1"
    echo "emailAddress                    = info@wolfssl.com"   >> "$1"
    echo ""                                                     >> "$1"
    echo "[ v3_ca ]"                                            >> "$1"
    echo "subjectKeyIdentifier = hash"                          >> "$1"
    echo "authorityKeyIdentifier = keyid:always,issuer"         >> "$1"
    echo "basicConstraints = critical, CA:true"                 >> "$1"
    echo "keyUsage = critical, digitalSignature, cRLSign, keyCertSign">> "$1"
    echo ""                                                     >> "$1"
    echo "[ v3_intermediate_ca ]"                               >> "$1"
    echo "subjectKeyIdentifier = hash"                          >> "$1"
    echo "authorityKeyIdentifier = keyid:always,issuer"         >> "$1"
    echo "basicConstraints = critical, CA:true, pathlen:1"      >> "$1"
    echo "keyUsage = critical, digitalSignature, cRLSign, keyCertSign">> "$1"
    echo ""                                                     >> "$1"
    echo "[ v3_intermediate2_ca ]"                              >> "$1"
    echo "subjectKeyIdentifier = hash"                          >> "$1"
    echo "authorityKeyIdentifier = keyid:always,issuer"         >> "$1"
    echo "basicConstraints = critical, CA:true, pathlen:1"      >> "$1"
    echo "keyUsage = critical, digitalSignature, cRLSign, keyCertSign">> "$1"
    echo ""                                                     >> "$1"
    echo "[ usr_cert ]"                                         >> "$1"
    echo "basicConstraints = CA:FALSE"                          >> "$1"
    echo "nsCertType = client, email"                           >> "$1"
    echo "subjectKeyIdentifier = hash"                          >> "$1"
    echo "authorityKeyIdentifier = keyid,issuer"                >> "$1"
    echo "keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment">> "$1"
    echo "extendedKeyUsage = clientAuth, emailProtection"       >> "$1"
    echo ""                                                     >> "$1"
    echo "[ server_cert ]"                                      >> "$1"
    echo "basicConstraints = CA:FALSE"                          >> "$1"
    echo "nsCertType = server"                                  >> "$1"
    echo "subjectKeyIdentifier = hash"                          >> "$1"
    echo "authorityKeyIdentifier = keyid,issuer:always"         >> "$1"
    echo "keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement">> "$1"
    echo "extendedKeyUsage = serverAuth"                        >> "$1"
    echo ""                                                     >> "$1"
    echo "[ crl_ext ]"                                          >> "$1"
    echo "authorityKeyIdentifier=keyid:always"                  >> "$1"
}

# Args: 1=reqcnf, 2=signcnf, 3=keyfile, 4=certfile, 5=ext, 6=subj, 7=days
create_cert() {
    openssl req -config ./certs/intermediate/$1.cnf -new -sha256 \
        -key $3 \
        -out ./certs/intermediate/tmp.csr \
        -subj "/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=$6/emailAddress=info@wolfssl.com"
    check_result $?
    openssl ca -config ./certs/intermediate/$2.cnf -extensions $5 -days $7 -notext -md sha256 \
        -in ./certs/intermediate/tmp.csr -out ./certs/intermediate/$4.pem -batch
    check_result $?
    rm ./certs/intermediate/tmp.csr

    # Convert Cert to DER
    openssl x509 -in ./certs/intermediate/$4.pem -inform PEM -out ./certs/intermediate/$4.der -outform DER
    check_result $?

    # Add text to cert PEM file
    openssl x509 -in ./certs/intermediate/$4.pem -text > ./certs/intermediate/tmp.pem
    check_result $?
    mv ./certs/intermediate/tmp.pem ./certs/intermediate/$4.pem
}

if [ "$1" == "clean" ]; then
    echo "Cleaning temp files"
    cleanup_files
fi
if [ "$1" == "cleanall" ]; then
    echo "Cleaning all files"
    rm -f ./certs/intermediate/*.pem
    rm -f ./certs/intermediate/*.der
    rm -f ./certs/intermediate/*.csr
    cleanup_files
fi

# Make sure required CA files exist and are populated
rm -f ./certs/intermediate/index.*
touch ./certs/intermediate/index.txt 
if [ ! -f ./certs/intermediate/serial ]; then
    echo 1000 > ./certs/intermediate/serial
fi
if [ ! -f ./certs/intermediate/crlnumber ]; then
    echo 2000 > ./certs/intermediate/crlnumber
fi
if [ ! -d ./certs/intermediate/new_certs ]; then
    mkdir ./certs/intermediate/new_certs
fi


# RSA
echo "Creating RSA CA configuration cnf files"
create_ca_config ./certs/intermediate/wolfssl_root.cnf certs/ca-key.pem certs/ca-cert.pem
create_ca_config ./certs/intermediate/wolfssl_int.cnf certs/intermediate/ca-int-key.pem certs/intermediate/ca-int-cert.pem
create_ca_config ./certs/intermediate/wolfssl_int2.cnf certs/intermediate/ca-int2-key.pem certs/intermediate/ca-int2-cert.pem

if [ ! -f ./certs/intermediate/ca-int-key.pem ]; then
    echo "Make Intermediate RSA CA Key"
    openssl genrsa -out ./certs/intermediate/ca-int-key.pem 2048
    check_result $?
    openssl rsa -in ./certs/intermediate/ca-int-key.pem -inform PEM -out ./certs/intermediate/ca-int-key.der -outform DER
    check_result $?
fi
if [ ! -f ./certs/intermediate/ca-int2-key.pem ]; then
    echo "Make Intermediate2 RSA CA Key"
    openssl genrsa -out ./certs/intermediate/ca-int2-key.pem 2048
    check_result $?
    openssl rsa -in ./certs/intermediate/ca-int2-key.pem -inform PEM -out ./certs/intermediate/ca-int2-key.der -outform DER
    check_result $?
fi

echo "Create RSA Intermediate CA signed by root"
create_cert wolfssl_int wolfssl_root ./certs/intermediate/ca-int-key.pem ca-int-cert v3_intermediate_ca "wolfSSL Intermediate CA" 7300

echo "Create RSA Intermediate2 CA signed by RSA Intermediate"
create_cert wolfssl_int2 wolfssl_int ./certs/intermediate/ca-int2-key.pem ca-int2-cert v3_intermediate2_ca "wolfSSL Intermediate2 CA" 7300

echo "Create RSA Server Certificate signed by intermediate2"
create_cert wolfssl_int2 wolfssl_int2 ./certs/server-key.pem server-int-cert server_cert "wolfSSL Server Chain" 3650

echo "Create RSA Client Certificate signed by intermediate2"
create_cert wolfssl_int2 wolfssl_int2 ./certs/client-key.pem client-int-cert usr_cert "wolfSSL Client Chain" 3650

echo "Generate CRLs for new certificates"
openssl ca -config ./certs/intermediate/wolfssl_root.cnf -gencrl -crldays 1000 -out ./certs/crl/ca-int.pem -keyfile ./certs/intermediate/ca-int-key.pem -cert ./certs/intermediate/ca-int-cert.pem
check_result $?
openssl ca -config ./certs/intermediate/wolfssl_int.cnf  -gencrl -crldays 1000 -out ./certs/crl/ca-int2.pem -keyfile ./certs/intermediate/ca-int2-key.pem -cert ./certs/intermediate/ca-int2-cert.pem
check_result $?
openssl ca -config ./certs/intermediate/wolfssl_int2.cnf -gencrl -crldays 1000 -out ./certs/crl/server-int.pem -keyfile ./certs/server-key.pem -cert ./certs/intermediate/server-int-cert.pem
check_result $?
openssl ca -config ./certs/intermediate/wolfssl_int2.cnf -gencrl -crldays 1000 -out ./certs/crl/client-int.pem -keyfile ./certs/client-key.pem -cert ./certs/intermediate/client-int-cert.pem
check_result $?

echo "Assemble test chains - peer first, then intermediate2, then intermediate"
openssl x509 -in ./certs/intermediate/server-int-cert.pem  > ./certs/intermediate/server-chain.pem
openssl x509 -in ./certs/intermediate/ca-int2-cert.pem    >> ./certs/intermediate/server-chain.pem
openssl x509 -in ./certs/intermediate/ca-int-cert.pem     >> ./certs/intermediate/server-chain.pem
cat ./certs/intermediate/server-int-cert.der ./certs/intermediate/ca-int2-cert.der ./certs/intermediate/ca-int-cert.der > ./certs/intermediate/server-chain.der

openssl x509 -in ./certs/intermediate/client-int-cert.pem  > ./certs/intermediate/client-chain.pem
openssl x509 -in ./certs/intermediate/ca-int2-cert.pem    >> ./certs/intermediate/client-chain.pem
openssl x509 -in ./certs/intermediate/ca-int-cert.pem     >> ./certs/intermediate/client-chain.pem
cat ./certs/intermediate/client-int-cert.der ./certs/intermediate/ca-int2-cert.der ./certs/intermediate/ca-int-cert.der > ./certs/intermediate/client-chain.der

echo "Assemble cert chain with extra cert for testing alternate chains"
cp ./certs/intermediate/server-chain.pem ./certs/intermediate/server-chain-alt.pem
cp ./certs/intermediate/client-chain.pem ./certs/intermediate/client-chain-alt.pem
openssl x509 -in ./certs/external/ca-google-root.pem      >> ./certs/intermediate/server-chain-alt.pem
openssl x509 -in ./certs/external/ca-google-root.pem      >> ./certs/intermediate/client-chain-alt.pem


# ECC
echo "Creating ECC CA configuration cnf files"
create_ca_config ./certs/intermediate/wolfssl_root_ecc.cnf certs/ca-ecc-key.pem certs/ca-ecc-cert.pem
create_ca_config ./certs/intermediate/wolfssl_int_ecc.cnf certs/intermediate/ca-int-ecc-key.pem certs/intermediate/ca-int-ecc-cert.pem
create_ca_config ./certs/intermediate/wolfssl_int2_ecc.cnf certs/intermediate/ca-int2-ecc-key.pem certs/intermediate/ca-int2-ecc-cert.pem

if [ ! -f ./certs/intermediate/ca-int-ecc-key.pem ]; then
    echo "Make Intermediate ECC CA Key"
    openssl ecparam -name prime256v1 -genkey -noout -out ./certs/intermediate/ca-int-ecc-key.pem
    check_result $?
    openssl ec -in ./certs/intermediate/ca-int-ecc-key.pem -inform PEM -out ./certs/intermediate/ca-int-ecc-key.der -outform DER
    check_result $?
fi
if [ ! -f ./certs/intermediate/ca-int2-ecc-key.pem ]; then
    echo "Make Intermediate2 ECC CA Key"
    openssl ecparam -name prime256v1 -genkey -noout -out ./certs/intermediate/ca-int2-ecc-key.pem
    check_result $?
    openssl ec -in ./certs/intermediate/ca-int2-ecc-key.pem -inform PEM -out ./certs/intermediate/ca-int2-ecc-key.der -outform DER
    check_result $?
fi

echo "Create ECC Intermediate CA signed by root"
create_cert wolfssl_int_ecc wolfssl_root_ecc ./certs/intermediate/ca-int-ecc-key.pem ca-int-ecc-cert v3_intermediate_ca "wolfSSL Intermediate CA ECC" 7300

echo "Create ECC Intermediate2 CA signed by Intermediate"
create_cert wolfssl_int2_ecc wolfssl_int_ecc ./certs/intermediate/ca-int2-ecc-key.pem ca-int2-ecc-cert v3_intermediate2_ca "wolfSSL Intermediate2 CA ECC" 7300

echo "Create ECC Server Certificate signed by intermediate2"
create_cert wolfssl_int2_ecc wolfssl_int2_ecc ./certs/ecc-key.pem server-int-ecc-cert server_cert "wolfSSL Server Chain ECC" 3650

echo "Create ECC Client Certificate signed by intermediate2"
create_cert wolfssl_int2_ecc wolfssl_int2_ecc ./certs/ecc-client-key.pem client-int-ecc-cert usr_cert "wolfSSL Client Chain ECC" 3650

echo "Generate CRLs for new certificates"
openssl ca -config ./certs/intermediate/wolfssl_root_ecc.cnf -gencrl -crldays 1000 -out ./certs/crl/ca-int-ecc.pem -keyfile ./certs/intermediate/ca-int-ecc-key.pem -cert ./certs/intermediate/ca-int-ecc-cert.pem
check_result $?
openssl ca -config ./certs/intermediate/wolfssl_int_ecc.cnf -gencrl -crldays 1000 -out ./certs/crl/ca-int2-ecc.pem -keyfile ./certs/intermediate/ca-int2-ecc-key.pem -cert ./certs/intermediate/ca-int2-ecc-cert.pem
check_result $?
openssl ca -config ./certs/intermediate/wolfssl_int2_ecc.cnf -gencrl -crldays 1000 -out ./certs/crl/server-int-ecc.pem -keyfile ./certs/ecc-key.pem -cert ./certs/intermediate/server-int-ecc-cert.pem
check_result $?
openssl ca -config ./certs/intermediate/wolfssl_int2_ecc.cnf -gencrl -crldays 1000 -out ./certs/crl/client-int-ecc.pem -keyfile ./certs/ecc-client-key.pem -cert ./certs/intermediate/client-int-ecc-cert.pem
check_result $?

echo "Assemble test chains - peer first, then intermediate2, then intermediate"
openssl x509 -in ./certs/intermediate/server-int-ecc-cert.pem  > ./certs/intermediate/server-chain-ecc.pem
openssl x509 -in ./certs/intermediate/ca-int2-ecc-cert.pem    >> ./certs/intermediate/server-chain-ecc.pem
openssl x509 -in ./certs/intermediate/ca-int-ecc-cert.pem     >> ./certs/intermediate/server-chain-ecc.pem
cat ./certs/intermediate/server-int-ecc-cert.der ./certs/intermediate/ca-int2-ecc-cert.der ./certs/intermediate/ca-int-ecc-cert.der > ./certs/intermediate/server-chain-ecc.der

openssl x509 -in ./certs/intermediate/client-int-ecc-cert.pem  > ./certs/intermediate/client-chain-ecc.pem
openssl x509 -in ./certs/intermediate/ca-int2-ecc-cert.pem    >> ./certs/intermediate/client-chain-ecc.pem
openssl x509 -in ./certs/intermediate/ca-int-ecc-cert.pem     >> ./certs/intermediate/client-chain-ecc.pem
cat ./certs/intermediate/client-int-ecc-cert.der ./certs/intermediate/ca-int2-ecc-cert.der ./certs/intermediate/ca-int-ecc-cert.der > ./certs/intermediate/client-chain-ecc.der

echo "Assemble cert chain with extra untrusted cert for testing alternate chains"
cp ./certs/intermediate/server-chain-ecc.pem ./certs/intermediate/server-chain-alt-ecc.pem
cp ./certs/intermediate/client-chain-ecc.pem ./certs/intermediate/client-chain-alt-ecc.pem
openssl x509 -in ./certs/external/ca-google-root.pem          >> ./certs/intermediate/server-chain-alt-ecc.pem
openssl x509 -in ./certs/external/ca-google-root.pem          >> ./certs/intermediate/client-chain-alt-ecc.pem