gen-ed25519-certs.sh 4.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105
  1. #!/bin/bash
  2. check_result(){
  3. if [ $1 -ne 0 ]; then
  4. echo "Failed at \"$2\", Abort"
  5. exit 1
  6. else
  7. echo "Step Succeeded!"
  8. fi
  9. }
  10. openssl pkey -in root-ed25519-priv.pem -noout >/dev/null 2>&1
  11. if [ $? -ne 0 ]; then
  12. echo "OpenSSL does not support Ed25519"
  13. echo "Skipping Ed25519 certificate renewal"
  14. exit 0
  15. fi
  16. ############################################################
  17. ###### update the self-signed root-ed25519.pem #############
  18. ############################################################
  19. echo "Updating root-ed25519.pem"
  20. echo ""
  21. #pipe the following arguments to openssl req...
  22. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_Ed25519\\nRoot-Ed25519\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | \
  23. openssl req -new -key root-ed25519-priv.pem -config ../renewcerts/wolfssl.cnf -nodes -out root-ed25519.csr
  24. check_result $? "Generate request"
  25. openssl x509 -req -in root-ed25519.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions ca_ecc_cert -signkey root-ed25519-priv.pem -out root-ed25519.pem
  26. check_result $? "Generate certificate"
  27. rm root-ed25519.csr
  28. openssl x509 -in root-ed25519.pem -outform DER > root-ed25519.der
  29. check_result $? "Convert to DER"
  30. openssl x509 -in root-ed25519.pem -text > tmp.pem
  31. check_result $? "Add text"
  32. mv tmp.pem root-ed25519.pem
  33. echo "End of section"
  34. echo "---------------------------------------------------------------------"
  35. ############################################################
  36. ###### update ca-ed25519.pem signed by root ################
  37. ############################################################
  38. echo "Updating ca-ed25519.pem"
  39. echo ""
  40. #pipe the following arguments to openssl req...
  41. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_ed25519\\nCA-ed25519\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n\\n\\n\\n" | openssl req -new -key ca-ed25519-priv.pem -config ../renewcerts/wolfssl.cnf -nodes -out ca-ed25519.csr
  42. check_result $? "Generate request"
  43. openssl x509 -req -in ca-ed25519.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions ca_ecc_cert -CA root-ed25519.pem -CAkey root-ed25519-priv.pem -set_serial 01 -out ca-ed25519.pem
  44. check_result $? "Generate certificate"
  45. rm ca-ed25519.csr
  46. openssl x509 -in ca-ed25519.pem -outform DER > ca-ed25519.der
  47. check_result $? "Convert to DER"
  48. openssl x509 -in ca-ed25519.pem -text > tmp.pem
  49. check_result $? "Add text"
  50. mv tmp.pem ca-ed25519.pem
  51. echo "End of section"
  52. echo "---------------------------------------------------------------------"
  53. ############################################################
  54. ###### update server-ed25519.pem signed by ca ##############
  55. ############################################################
  56. echo "Updating server-ed25519.pem"
  57. echo ""
  58. #pipe the following arguments to openssl req...
  59. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_ed25519\\nServer-ed25519\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n\\n\\n\\n" | openssl req -new -key server-ed25519-priv.pem -config ../renewcerts/wolfssl.cnf -nodes -out server-ed25519.csr
  60. check_result $? "Generate request"
  61. openssl x509 -req -in server-ed25519.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions server_ecc -CA ca-ed25519.pem -CAkey ca-ed25519-priv.pem -set_serial 01 -out server-ed25519-cert.pem
  62. check_result $? "Generate certificate"
  63. rm server-ed25519.csr
  64. openssl x509 -in server-ed25519-cert.pem -outform DER > server-ed25519.der
  65. check_result $? "Convert to DER"
  66. openssl x509 -in server-ed25519-cert.pem -text > tmp.pem
  67. check_result $? "Add text"
  68. mv tmp.pem server-ed25519-cert.pem
  69. cat server-ed25519-cert.pem ca-ed25519.pem > server-ed25519.pem
  70. check_result $? "Add CA into server cert"
  71. echo "End of section"
  72. echo "---------------------------------------------------------------------"
  73. ############################################################
  74. ###### update the self-signed client-ed25519.pem ###########
  75. ############################################################
  76. echo "Updating client-ed25519.pem"
  77. echo ""
  78. #pipe the following arguments to openssl req...
  79. echo -e "US\\nMontana\\nBozeman\\nwolfSSL_ed25519\\nClient-ed25519\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n\\n\\n\\n" | openssl req -new -key client-ed25519-priv.pem -config ../renewcerts/wolfssl.cnf -nodes -out client-ed25519.csr
  80. check_result $? "Generate request"
  81. openssl x509 -req -in client-ed25519.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions wolfssl_opts -signkey client-ed25519-priv.pem -out client-ed25519.pem
  82. check_result $? "Generate certificate"
  83. rm client-ed25519.csr
  84. openssl x509 -in client-ed25519.pem -outform DER > client-ed25519.der
  85. check_result $? "Convert to DER"
  86. openssl x509 -in client-ed25519.pem -text > tmp.pem
  87. check_result $? "Add text"
  88. mv tmp.pem client-ed25519.pem
  89. echo "End of section"
  90. echo "---------------------------------------------------------------------"