demos/ssltest-ecc/RSAcertgen.sh

   1 #!/bin/sh
   2
   3 # For a list of supported curves, use "apps/openssl ecparam -list_curves".
   4
   5 # Path to the openssl distribution
   6 OPENSSL_DIR=../..
   7 # Path to the openssl program
   8 OPENSSL_CMD=$OPENSSL_DIR/apps/openssl
   9 # Option to find configuration file
  10 OPENSSL_CNF="-config $OPENSSL_DIR/apps/openssl.cnf"
  11 # Directory where certificates are stored
  12 CERTS_DIR=./Certs
  13 # Directory where private key files are stored
  14 KEYS_DIR=$CERTS_DIR
  15 # Directory where combo files (containing a certificate and corresponding
  16 # private key together) are stored
  17 COMBO_DIR=$CERTS_DIR
  18 # cat command
  19 CAT=/bin/cat
  20 # rm command
  21 RM=/bin/rm
  22 # The certificate will expire these many days after the issue date.
  23 DAYS=1500
  24 TEST_CA_FILE=rsa1024TestCA
  25 TEST_CA_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test CA (1024 bit RSA)"
  26
  27 TEST_SERVER_FILE=rsa1024TestServer
  28 TEST_SERVER_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Server (1024 bit RSA)"
  29
  30 TEST_CLIENT_FILE=rsa1024TestClient
  31 TEST_CLIENT_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Client (1024 bit RSA)"
  32
  33 # Generating an EC certificate involves the following main steps
  34 # 1. Generating curve parameters (if needed)
  35 # 2. Generating a certificate request
  36 # 3. Signing the certificate request
  37 # 4. [Optional] One can combine the cert and private key into a single
  38 #    file and also delete the certificate request
  39
  40 echo "Generating self-signed CA certificate (RSA)"
  41 echo "==========================================="
  42
  43 $OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_CA_DN" \
  44     -keyout $KEYS_DIR/$TEST_CA_FILE.key.pem \
  45     -newkey rsa:1024 -new \
  46     -out $CERTS_DIR/$TEST_CA_FILE.req.pem
  47
  48 $OPENSSL_CMD x509 -req -days $DAYS \
  49     -in $CERTS_DIR/$TEST_CA_FILE.req.pem \
  50     -extfile $OPENSSL_DIR/apps/openssl.cnf \
  51     -extensions v3_ca \
  52     -signkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
  53     -out $CERTS_DIR/$TEST_CA_FILE.cert.pem
  54
  55 # Display the certificate
  56 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CA_FILE.cert.pem -text
  57
  58 # Place the certificate and key in a common file
  59 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CA_FILE.cert.pem -issuer -subject \
  60          > $COMBO_DIR/$TEST_CA_FILE.pem
  61 $CAT $KEYS_DIR/$TEST_CA_FILE.key.pem >> $COMBO_DIR/$TEST_CA_FILE.pem
  62
  63 # Remove the cert request file (no longer needed)
  64 $RM $CERTS_DIR/$TEST_CA_FILE.req.pem
  65
  66 echo "GENERATING A TEST SERVER CERTIFICATE (RSA)"
  67 echo "=========================================="
  68
  69 $OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_SERVER_DN" \
  70     -keyout $KEYS_DIR/$TEST_SERVER_FILE.key.pem \
  71     -newkey rsa:1024 -new \
  72     -out $CERTS_DIR/$TEST_SERVER_FILE.req.pem
  73
  74 $OPENSSL_CMD x509 -req -days $DAYS \
  75     -in $CERTS_DIR/$TEST_SERVER_FILE.req.pem \
  76     -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
  77     -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
  78     -out $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -CAcreateserial
  79
  80 # Display the certificate
  81 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -text
  82
  83 # Place the certificate and key in a common file
  84 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -issuer -subject \
  85          > $COMBO_DIR/$TEST_SERVER_FILE.pem
  86 $CAT $KEYS_DIR/$TEST_SERVER_FILE.key.pem >> $COMBO_DIR/$TEST_SERVER_FILE.pem
  87
  88 # Remove the cert request file (no longer needed)
  89 $RM $CERTS_DIR/$TEST_SERVER_FILE.req.pem
  90
  91 echo "GENERATING A TEST CLIENT CERTIFICATE (RSA)"
  92 echo "=========================================="
  93
  94 $OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_CLIENT_DN" \
  95              -keyout $KEYS_DIR/$TEST_CLIENT_FILE.key.pem \
  96              -newkey rsa:1024 -new \
  97              -out $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
  98
  99 $OPENSSL_CMD x509 -req -days $DAYS \
 100     -in $CERTS_DIR/$TEST_CLIENT_FILE.req.pem \
 101     -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
 102     -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
 103     -out $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -CAcreateserial
 104
 105 # Display the certificate
 106 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -text
 107
 108 # Place the certificate and key in a common file
 109 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -issuer -subject \
 110          > $COMBO_DIR/$TEST_CLIENT_FILE.pem
 111 $CAT $KEYS_DIR/$TEST_CLIENT_FILE.key.pem >> $COMBO_DIR/$TEST_CLIENT_FILE.pem
 112
 113 # Remove the cert request file (no longer needed)
 114 $RM $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
 115