1
0

gen-ext-certs.sh 7.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313
  1. #!/bin/sh
  2. TMP="/tmp/`basename $0`"
  3. KEY=certs/server-key.der
  4. gen_cert() {
  5. openssl req -x509 -keyform DER -key $KEY \
  6. -days 1000 -new -outform DER -out $OUT.der -config $CONFIG \
  7. >$TMP 2>&1
  8. if [ "$?" = "0" -a -f $OUT.der ]; then
  9. echo "Created: $OUT"
  10. else
  11. cat $TMP
  12. echo "Failed: $OUT"
  13. fi
  14. openssl x509 -in $OUT.der -inform DER -outform PEM > $OUT.pem
  15. rm $TMP
  16. }
  17. OUT=certs/test/cert-ext-nc
  18. KEYFILE=certs/test/cert-ext-nc-key.der
  19. CONFIG=certs/test/cert-ext-nc.cfg
  20. tee >$CONFIG <<EOF
  21. [ req ]
  22. distinguished_name = req_distinguished_name
  23. prompt = no
  24. x509_extensions = v3_ca
  25. [ req_distinguished_name ]
  26. C = AU
  27. ST = Queensland
  28. L = Brisbane
  29. O = wolfSSL Inc
  30. OU = Engineering
  31. CN = www.wolfssl.com
  32. [ v3_ca ]
  33. subjectKeyIdentifier = hash
  34. authorityKeyIdentifier = keyid:always,issuer
  35. basicConstraints = critical, CA:true, pathlen:0
  36. keyUsage = critical, digitalSignature, cRLSign, keyCertSign
  37. nameConstraints = critical,permitted;email:.wolfssl.com
  38. nsComment = "Testing name constraints"
  39. EOF
  40. gen_cert
  41. OUT=certs/test/cert-ext-mnc
  42. KEYFILE=certs/test/cert-ext-mnc-key.der
  43. CONFIG=certs/test/cert-ext-mnc.cfg
  44. tee >$CONFIG <<EOF
  45. [ req ]
  46. distinguished_name = req_distinguished_name
  47. prompt = no
  48. x509_extensions = v3_ca
  49. [ req_distinguished_name ]
  50. C = AU
  51. ST = Queensland
  52. L = Brisbane
  53. O = wolfSSL Inc
  54. OU = Engineering
  55. CN = www.wolfssl.com
  56. [ v3_ca ]
  57. subjectKeyIdentifier = hash
  58. authorityKeyIdentifier = keyid:always,issuer
  59. basicConstraints = critical, CA:true, pathlen:0
  60. keyUsage = critical, digitalSignature, cRLSign, keyCertSign
  61. nameConstraints = critical,permitted;email:.wolfssl.com, permitted;email:.example.com
  62. nsComment = "Testing name constraints"
  63. EOF
  64. gen_cert
  65. rm -f ./certs/test/cert-ext-mnc.cfg
  66. rm -f ./certs/test/cert-ext-mnc.pem
  67. OUT=certs/test/cert-ext-ncdns
  68. KEYFILE=certs/test/cert-ext-nc-key.der
  69. CONFIG=certs/test/cert-ext-ncdns.cfg
  70. tee >$CONFIG <<EOF
  71. [ req ]
  72. distinguished_name = req_distinguished_name
  73. prompt = no
  74. x509_extensions = v3_ca
  75. [ req_distinguished_name ]
  76. C = AU
  77. ST = Queensland
  78. L = Brisbane
  79. O = wolfSSL Inc
  80. OU = Engineering
  81. CN = www.wolfssl.com
  82. [ v3_ca ]
  83. subjectKeyIdentifier = hash
  84. authorityKeyIdentifier = keyid:always,issuer
  85. basicConstraints = critical, CA:true, pathlen:0
  86. keyUsage = critical, digitalSignature, cRLSign, keyCertSign
  87. nameConstraints = critical,permitted;DNS:wolfssl.com, permitted;DNS:example.com
  88. nsComment = "Testing name constraints"
  89. EOF
  90. gen_cert
  91. rm -f ./certs/test/cert-ext-ncdns.cfg
  92. rm -f ./certs/test/cert-ext-ncdns.pem
  93. OUT=certs/test/cert-ext-ncmixed
  94. KEYFILE=certs/test/cert-ext-ncmixed-key.der
  95. CONFIG=certs/test/cert-ext-ncmixed.cfg
  96. tee >$CONFIG <<EOF
  97. [ req ]
  98. distinguished_name = req_distinguished_name
  99. prompt = no
  100. x509_extensions = v3_ca
  101. [ req_distinguished_name ]
  102. C = AU
  103. ST = Queensland
  104. L = Brisbane
  105. O = wolfSSL Inc
  106. OU = Engineering
  107. CN = www.wolfssl.com
  108. [ v3_ca ]
  109. subjectKeyIdentifier = hash
  110. authorityKeyIdentifier = keyid:always,issuer
  111. basicConstraints = critical, CA:true, pathlen:0
  112. keyUsage = critical, digitalSignature, cRLSign, keyCertSign
  113. nameConstraints = critical,permitted;DNS:example, permitted;email:.wolfssl.com
  114. nsComment = "Testing name constraints"
  115. EOF
  116. gen_cert
  117. rm -f ./certs/test/cert-ext-ncmixed.cfg
  118. rm -f ./certs/test/cert-ext-ncmixed.pem
  119. OUT=certs/test/cert-ext-ia
  120. KEYFILE=certs/test/cert-ext-ia-key.der
  121. CONFIG=certs/test/cert-ext-ia.cfg
  122. tee >$CONFIG <<EOF
  123. [ req ]
  124. distinguished_name = req_distinguished_name
  125. prompt = no
  126. x509_extensions = v3_ca
  127. [ req_distinguished_name ]
  128. C = AU
  129. ST = Queensland
  130. L = Brisbane
  131. O = wolfSSL Inc
  132. OU = Engineering
  133. CN = www.wolfssl.com
  134. emailAddress = support@wolfssl.com
  135. [ v3_ca ]
  136. inhibitAnyPolicy = critical,1
  137. nsComment = "Testing inhibit any"
  138. EOF
  139. gen_cert
  140. OUT=certs/test/cert-ext-nct
  141. KEYFILE=certs/test/cert-ext-mct-key.der
  142. CONFIG=certs/test/cert-ext-nct.cfg
  143. tee >$CONFIG <<EOF
  144. [ req ]
  145. distinguished_name = req_distinguished_name
  146. prompt = no
  147. x509_extensions = v3_ca
  148. [ req_distinguished_name ]
  149. C = AU
  150. ST = Queensland
  151. L = Brisbane
  152. O = wolfSSL Inc
  153. OU = Engineering
  154. CN = www.wolfssl.com
  155. emailAddress = support@wolfssl.com
  156. [ v3_ca ]
  157. nsCertType = critical,server
  158. nsComment = "Testing Netscape Certificate Type"
  159. EOF
  160. gen_cert
  161. KEY=certs/ca-key.der
  162. OUT=certs/test/cert-ext-ndir
  163. KEYFILE=certs/ca-key.der
  164. CONFIG=certs/test/cert-ext-ndir.cfg
  165. tee >$CONFIG <<EOF
  166. [ req ]
  167. distinguished_name = req_distinguished_name
  168. prompt = no
  169. x509_extensions = constraints
  170. [ req_distinguished_name ]
  171. C = US
  172. ST = Montana
  173. L = Bozeman
  174. O = Sawtooth
  175. OU = Consulting
  176. CN = www.wolfssl.com
  177. emailAddress = info@wolfsssl.com
  178. [constraints]
  179. subjectKeyIdentifier=hash
  180. authorityKeyIdentifier=keyid:always,issuer:always
  181. basicConstraints=CA:TRUE
  182. nameConstraints=critical,permitted;dirName:dir_name
  183. [dir_name]
  184. countryName = US
  185. EOF
  186. gen_cert
  187. OUT=certs/test/cert-ext-ndir-exc
  188. KEYFILE=certs/ca-key.der
  189. CONFIG=certs/test/cert-ext-ndir-exc.cfg
  190. tee >$CONFIG <<EOF
  191. [ req ]
  192. distinguished_name = req_distinguished_name
  193. prompt = no
  194. x509_extensions = constraints
  195. [ req_distinguished_name ]
  196. C = US
  197. ST = Montana
  198. L = Bozeman
  199. O = Sawtooth
  200. OU = Consulting
  201. CN = www.wolfssl.com
  202. emailAddress = info@wolfsssl.com
  203. [constraints]
  204. subjectKeyIdentifier=hash
  205. authorityKeyIdentifier=keyid:always,issuer:always
  206. basicConstraints=CA:TRUE
  207. nameConstraints=critical,excluded;dirName:dir_name_exclude
  208. [dir_name_exclude]
  209. countryName = US
  210. stateOrProvinceName = California
  211. EOF
  212. gen_cert
  213. OUT=certs/test/cert-ext-joi
  214. KEYFILE=certs/ca-key.der
  215. CONFIG=certs/test/cert-ext-joi.cfg
  216. tee >$CONFIG <<EOF
  217. [ req ]
  218. distinguished_name = req_distinguished_name
  219. prompt = no
  220. x509_extensions = constraints
  221. [ req_distinguished_name ]
  222. C = US
  223. ST = Montana
  224. L = Bozeman
  225. O = Sawtooth
  226. OU = Consulting
  227. CN = www.wolfssl.com
  228. emailAddress = info@wolfsssl.com
  229. jurisdictionC = US
  230. jurisdictionST = California
  231. [constraints]
  232. subjectKeyIdentifier=hash
  233. authorityKeyIdentifier=keyid:always,issuer:always
  234. basicConstraints=CA:TRUE
  235. EOF
  236. gen_cert
  237. OUT=certs/test/cert-ext-multiple
  238. KEYFILE=certs/test/cert-ext-mct-key.der
  239. CONFIG=certs/test/cert-ext-multiple.cfg
  240. tee >$CONFIG <<EOF
  241. [ req ]
  242. distinguished_name = req_distinguished_name
  243. prompt = no
  244. x509_extensions = v3_ca
  245. [ req_distinguished_name ]
  246. C = AU
  247. ST = Queensland
  248. L = Brisbane
  249. O = wolfSSL Inc
  250. OU = Engineering
  251. CN = www.wolfssl.com
  252. emailAddress = support@wolfssl.com
  253. postalCode = 56-131
  254. street = Main St
  255. [ v3_ca ]
  256. nsCertType = server
  257. crlDistributionPoints = URI:http://www.wolfssl.com/crl.pem
  258. extendedKeyUsage = serverAuth
  259. subjectKeyIdentifier = hash
  260. authorityKeyIdentifier = keyid:always,issuer:always
  261. EOF
  262. gen_cert