gen-sm2-certs.sh 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124
  1. #!/bin/bash
  2. check_result(){
  3. if [ $1 -ne 0 ]; then
  4. echo "Failed at \"$2\", Abort"
  5. exit 1
  6. else
  7. echo "Step Succeeded!"
  8. fi
  9. }
  10. openssl pkey -in root-sm2-priv.pem -noout >/dev/null 2>&1
  11. if [ $? -ne 0 ]; then
  12. echo "OpenSSL does not support SM2"
  13. echo "Skipping SM2 certificate renewal"
  14. exit 0
  15. fi
  16. ############################################################
  17. ###### update the self-signed root-sm2.pem #############
  18. ############################################################
  19. echo "Updating root-sm2.pem"
  20. echo ""
  21. #pipe the following arguments to openssl req...
  22. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_SM2\\nRoot-SM2\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | \
  23. openssl req -new -key root-sm2-priv.pem -config ../renewcerts/wolfssl.cnf -nodes -out root-sm2.csr
  24. check_result $? "Generate request"
  25. openssl x509 -req -in root-sm2.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions ca_ecc_cert -signkey root-sm2-priv.pem -out root-sm2.pem
  26. check_result $? "Generate certificate"
  27. rm root-sm2.csr
  28. openssl x509 -in root-sm2.pem -outform DER > root-sm2.der
  29. check_result $? "Convert to DER"
  30. openssl x509 -in root-sm2.pem -text > tmp.pem
  31. check_result $? "Add text"
  32. mv tmp.pem root-sm2.pem
  33. echo "End of section"
  34. echo "---------------------------------------------------------------------"
  35. ############################################################
  36. ###### update ca-sm2.pem signed by root ################
  37. ############################################################
  38. echo "Updating ca-sm2.pem"
  39. echo ""
  40. #pipe the following arguments to openssl req...
  41. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_sm2\\nCA-sm2\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n\\n\\n\\n" | openssl req -new -key ca-sm2-priv.pem -config ../renewcerts/wolfssl.cnf -nodes -out ca-sm2.csr
  42. check_result $? "Generate request"
  43. openssl x509 -req -in ca-sm2.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions ca_ecc_cert -CA root-sm2.pem -CAkey root-sm2-priv.pem -set_serial 01 -out ca-sm2.pem
  44. check_result $? "Generate certificate"
  45. rm ca-sm2.csr
  46. openssl x509 -in ca-sm2.pem -outform DER > ca-sm2.der
  47. check_result $? "Convert to DER"
  48. openssl x509 -in ca-sm2.pem -text > tmp.pem
  49. check_result $? "Add text"
  50. mv tmp.pem ca-sm2.pem
  51. echo "End of section"
  52. echo "---------------------------------------------------------------------"
  53. ############################################################
  54. ###### update self-sm2-cert.pem ##############
  55. ############################################################
  56. echo "Updating self-sm2-cert.pem"
  57. echo ""
  58. #pipe the following arguments to openssl req...
  59. echo -e "AU\\nQLD\\n.\\nwolfSSL\\nTesting\\nwolfssl-dev-sm2\\n\\n\\n\\n\\n" | openssl req -new -key self-sm2-priv.pem -config ../renewcerts/wolfssl.cnf -nodes -out self-sm2.csr
  60. check_result $? "Generate request"
  61. openssl x509 -req -in self-sm2.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions ca_ecc_cert -signkey self-sm2-priv.pem -out self-sm2-cert.pem
  62. check_result $? "Generate certificate"
  63. rm self-sm2.csr
  64. openssl x509 -in self-sm2-cert.pem -text > tmp.pem
  65. check_result $? "Add text"
  66. mv tmp.pem self-sm2-cert.pem
  67. echo "End of section"
  68. echo "---------------------------------------------------------------------"
  69. ############################################################
  70. ###### update server-sm2.pem signed by ca ##############
  71. ############################################################
  72. echo "Updating server-sm2.pem"
  73. echo ""
  74. #pipe the following arguments to openssl req...
  75. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_sm2\\nServer-sm2\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n\\n\\n\\n" | openssl req -new -key server-sm2-priv.pem -config ../renewcerts/wolfssl.cnf -nodes -out server-sm2.csr
  76. check_result $? "Generate request"
  77. openssl x509 -req -in server-sm2.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions server_ecc -CA ca-sm2.pem -CAkey ca-sm2-priv.pem -set_serial 01 -out server-sm2-cert.pem
  78. check_result $? "Generate certificate"
  79. rm server-sm2.csr
  80. openssl x509 -in server-sm2-cert.pem -outform DER > server-sm2.der
  81. check_result $? "Convert to DER"
  82. openssl x509 -in server-sm2-cert.pem -text > tmp.pem
  83. check_result $? "Add text"
  84. mv tmp.pem server-sm2-cert.pem
  85. cat server-sm2-cert.pem ca-sm2.pem > server-sm2.pem
  86. check_result $? "Add CA into server cert"
  87. echo "End of section"
  88. echo "---------------------------------------------------------------------"
  89. ############################################################
  90. ###### update the self-signed client-sm2.pem ###########
  91. ############################################################
  92. echo "Updating client-sm2.pem"
  93. echo ""
  94. #pipe the following arguments to openssl req...
  95. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_sm2\\nClient-sm2\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n\\n\\n\\n" | openssl req -new -key client-sm2-priv.pem -config ../renewcerts/wolfssl.cnf -nodes -out client-sm2.csr
  96. check_result $? "Generate request"
  97. openssl x509 -req -in client-sm2.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions wolfssl_opts -signkey client-sm2-priv.pem -out client-sm2.pem
  98. check_result $? "Generate certificate"
  99. rm client-sm2.csr
  100. openssl x509 -in client-sm2.pem -outform DER > client-sm2.der
  101. check_result $? "Convert to DER"
  102. openssl x509 -in client-sm2.pem -text > tmp.pem
  103. check_result $? "Add text"
  104. mv tmp.pem client-sm2.pem
  105. echo "End of section"
  106. echo "---------------------------------------------------------------------"