15821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#!/bin/sh 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)# Copyright (c) 2011 The Chromium Authors. All rights reserved. 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)# Use of this source code is governed by a BSD-style license that can be 55821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)# found in the LICENSE file. 65821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 75821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)# This script generates a set of test (end-entity, intermediate, root) 85821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)# certificates with (weak, strong), (RSA, DSA, ECDSA) key pairs. 95821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)key_types="768-rsa 1024-rsa 2048-rsa prime256v1-ecdsa" 115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)try () { 135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) echo "$@" 145d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) "$@" || exit 1 155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)generate_key_command () { 185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) case "$1" in 195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) dsa) 205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) echo "dsaparam -genkey" 215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ;; 225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ecdsa) 235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) echo "ecparam -genkey" 245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ;; 255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) rsa) 265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) echo genrsa 275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ;; 285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *) 295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) exit 1 305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) esac 315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)try rm -rf out 345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)try mkdir out 355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)# Create the serial number files. 375d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)try /bin/sh -c "echo 01 > out/2048-rsa-root-serial" 385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)for key_type in $key_types 395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)do 405d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) try /bin/sh -c "echo 01 > out/$key_type-intermediate-serial" 415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)done 425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)# Generate one root CA certificate. 445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)try openssl genrsa -out out/2048-rsa-root.key 2048 455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)CA_COMMON_NAME="2048 RSA Test Root CA" \ 475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CA_DIR=out \ 485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CA_NAME=req_env_dn \ 495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) KEY_SIZE=2048 \ 505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ALGO=rsa \ 515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CERT_TYPE=root \ 525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) try openssl req \ 535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -new \ 545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -key out/2048-rsa-root.key \ 55eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch -extensions ca_cert \ 565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -out out/2048-rsa-root.csr \ 575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -config ca.cnf 585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)CA_COMMON_NAME="2048 RSA Test Root CA" \ 605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CA_DIR=out \ 615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CA_NAME=req_env_dn \ 625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) try openssl x509 \ 635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -req -days 3650 \ 645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -in out/2048-rsa-root.csr \ 65eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch -extensions ca_cert \ 665d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) -extfile ca.cnf \ 675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -signkey out/2048-rsa-root.key \ 685d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) -out out/2048-rsa-root.pem \ 695d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) -text 705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)# Generate private keys of all types and strengths for intermediate CAs and 725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)# end-entities. 735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)for key_type in $key_types 745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)do 755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) key_size=$(echo "$key_type" | sed -E 's/-.+//') 765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) algo=$(echo "$key_type" | sed -E 's/.+-//') 775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if [ ecdsa = $algo ] 795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) then 805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) key_size="-name $key_size" 815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) fi 825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) try openssl $(generate_key_command $algo) \ 845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -out out/$key_type-intermediate.key $key_size 855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)done 865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)for key_type in $key_types 885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)do 895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) key_size=$(echo "$key_type" | sed -E 's/-.+//') 905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) algo=$(echo "$key_type" | sed -E 's/.+-//') 915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if [ ecdsa = $algo ] 935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) then 945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) key_size="-name $key_size" 955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) fi 965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for signer_key_type in $key_types 985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) do 995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) try openssl $(generate_key_command $algo) \ 1005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -out out/$key_type-ee-by-$signer_key_type-intermediate.key $key_size 1015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) done 1025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)done 1035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)# The root signs the intermediates. 1055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)for key_type in $key_types 1065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)do 1075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) key_size=$(echo "$key_type" | sed -E 's/-.+//') 1085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) algo=$(echo "$key_type" | sed -E 's/.+-//') 1095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CA_COMMON_NAME="$key_size $algo Test intermediate CA" \ 1115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CA_DIR=out \ 1125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CA_NAME=req_env_dn \ 1135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) KEY_SIZE=$key_size \ 1145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ALGO=$algo \ 1155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CERT_TYPE=intermediate \ 1165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) try openssl req \ 1175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -new \ 1185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -key out/$key_type-intermediate.key \ 1195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -out out/$key_type-intermediate.csr \ 1205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -config ca.cnf 1215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) # Make sure the signer's DB file exists. 1235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) touch out/2048-rsa-root-index.txt 1245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CA_COMMON_NAME="2048 RSA Test Root CA" \ 1265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CA_DIR=out \ 1275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CA_NAME=req_env_dn \ 1285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) KEY_SIZE=2048 \ 1295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ALGO=rsa \ 1305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CERT_TYPE=root \ 1315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) try openssl ca \ 1325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -batch \ 1335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -extensions ca_cert \ 1345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -in out/$key_type-intermediate.csr \ 1355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -out out/$key_type-intermediate.pem \ 1365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -config ca.cnf 1375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)done 1385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)# The intermediates sign the end-entities. 1405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)for key_type in $key_types 1415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)do 1425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for signer_key_type in $key_types 1435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) do 1445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) key_size=$(echo "$key_type" | sed -E 's/-.+//') 1455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) algo=$(echo "$key_type" | sed -E 's/.+-//') 1465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) signer_key_size=$(echo "$signer_key_type" | sed -E 's/-.+//') 1475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) signer_algo=$(echo "$signer_key_type" | sed -E 's/.+-//') 1485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) touch out/$signer_key_type-intermediate-index.txt 1495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) KEY_SIZE=$key_size \ 1515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) try openssl req \ 1525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -new \ 1535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -key out/$key_type-ee-by-$signer_key_type-intermediate.key \ 1545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -out out/$key_type-ee-by-$signer_key_type-intermediate.csr \ 1555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -config ee.cnf 1565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CA_COMMON_NAME="$signer_key_size $algo Test intermediate CA" \ 1585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CA_DIR=out \ 1595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CA_NAME=req_env_dn \ 1605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) KEY_SIZE=$signer_key_size \ 1615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ALGO=$signer_algo \ 1625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CERT_TYPE=intermediate \ 1635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) try openssl ca \ 1645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -batch \ 1655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -in out/$key_type-ee-by-$signer_key_type-intermediate.csr \ 1665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -out out/$key_type-ee-by-$signer_key_type-intermediate.pem \ 1675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) -config ca.cnf 1685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) done 1695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)done 1705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1715d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)# Copy final outputs. 1725d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)try cp out/*root*pem out/*intermediate*pem ../certificates 173