blob: 7dce623a1575f2f27d0fb0c020d2b847df2f7a09 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
|
#!/bin/bash
# Copyright (c) 2012 The Chromium Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
# This script generates certificates that can be used to test SSL client
# authentication. Outputs for automated tests are stored in
# net/data/ssl/certificates, but may be re-generated for manual testing.
#
# This script generates two chains of test client certificates:
#
# 1. A (end-entity) -> B -> C (self-signed root)
# 2. D (end-entity) -> E -> C (self-signed root)
#
# In which A, B, C, D, and E all have distinct keypairs. Both client
# certificates share the same root, but are issued by different
# intermediates. The names of these intermediates are hardcoded within
# unit tests, and thus should not be changed.
try () {
echo "$@"
"$@" || exit 1
}
try rm -rf out
try mkdir out
echo Create the serial number files and indices.
serial=1000
for i in B C E
do
try /bin/sh -c "echo $serial > out/$i-serial"
serial=$(expr $serial + 1)
touch out/$i-index.txt
touch out/$i-index.txt.attr
done
echo Generate the keys.
for i in A B C D E
do
try openssl genrsa -out out/$i.key 2048
done
echo Generate the C CSR
COMMON_NAME="C Root CA" \
CA_DIR=out \
ID=C \
try openssl req \
-new \
-key out/C.key \
-out out/C.csr \
-config client-certs.cnf
echo C signs itself.
COMMON_NAME="C Root CA" \
CA_DIR=out \
ID=C \
try openssl x509 \
-req -days 3650 \
-in out/C.csr \
-extensions ca_cert \
-extfile client-certs.cnf \
-signkey out/C.key \
-out out/C.pem
echo Generate the intermediates
COMMON_NAME="B CA" \
CA_DIR=out \
ID=B \
try openssl req \
-new \
-key out/B.key \
-out out/B.csr \
-config client-certs.cnf
COMMON_NAME="C CA" \
CA_DIR=out \
ID=C \
try openssl ca \
-batch \
-extensions ca_cert \
-in out/B.csr \
-out out/B.pem \
-config client-certs.cnf
COMMON_NAME="E CA" \
CA_DIR=out \
ID=E \
try openssl req \
-new \
-key out/E.key \
-out out/E.csr \
-config client-certs.cnf
COMMON_NAME="C CA" \
CA_DIR=out \
ID=C \
try openssl ca \
-batch \
-extensions ca_cert \
-in out/E.csr \
-out out/E.pem \
-config client-certs.cnf
echo Generate the leaf certs
for id in A D
do
COMMON_NAME="Client Cert $id" \
ID=$id \
try openssl req \
-new \
-key out/$id.key \
-out out/$id.csr \
-config client-certs.cnf
done
echo B signs A
COMMON_NAME="B CA" \
CA_DIR=out \
ID=B \
try openssl ca \
-batch \
-extensions user_cert \
-in out/A.csr \
-out out/A.pem \
-config client-certs.cnf
echo E signs D
COMMON_NAME="E CA" \
CA_DIR=out \
ID=E \
try openssl ca \
-batch \
-extensions user_cert \
-in out/D.csr \
-out out/D.pem \
-config client-certs.cnf
echo Package the client certs and private keys into PKCS12 files
# This is done for easily importing all of the certs needed for clients.
try /bin/sh -c "cat out/A.pem out/A.key out/B.pem out/C.pem > out/A-chain.pem"
try /bin/sh -c "cat out/D.pem out/D.key out/E.pem out/C.pem > out/D-chain.pem"
try openssl pkcs12 \
-in out/A-chain.pem \
-out client_1.p12 \
-export \
-passout pass:chrome
try openssl pkcs12 \
-in out/D-chain.pem \
-out client_2.p12 \
-export \
-passout pass:chrome
echo Package the client certs for unit tests
try cp out/A.pem ../certificates/client_1.pem
try cp out/A.key ../certificates/client_1.key
try cp out/B.pem ../certificates/client_1_ca.pem
try cp out/D.pem ../certificates/client_2.pem
try cp out/D.key ../certificates/client_2.key
try cp out/E.pem ../certificates/client_2_ca.pem
|
