demos/ssltest-ecc/ECC-RSAcertgen.sh

   1 #!/bin/sh
   2
   3 # For a list of supported curves, use "apps/openssl ecparam -list_curves".
   4
   5 # Path to the openssl distribution
   6 OPENSSL_DIR=../..
   7 # Path to the openssl program
   8 OPENSSL_CMD=$OPENSSL_DIR/apps/openssl
   9 # Option to find configuration file
  10 OPENSSL_CNF="-config $OPENSSL_DIR/apps/openssl.cnf"
  11 # Directory where certificates are stored
  12 CERTS_DIR=./Certs
  13 # Directory where private key files are stored
  14 KEYS_DIR=$CERTS_DIR
  15 # Directory where combo files (containing a certificate and corresponding
  16 # private key together) are stored
  17 COMBO_DIR=$CERTS_DIR
  18 # cat command
  19 CAT=/bin/cat
  20 # rm command
  21 RM=/bin/rm
  22 # The certificate will expire these many days after the issue date.
  23 DAYS=1500
  24 TEST_CA_FILE=rsa1024TestCA
  25
  26 TEST_SERVER_CURVE=sect163r1
  27 TEST_SERVER_FILE=sect163r1-rsaTestServer
  28 TEST_SERVER_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Server (sect163r1 key signed with RSA)"
  29
  30 TEST_CLIENT_CURVE=sect163r1
  31 TEST_CLIENT_FILE=sect163r1-rsaTestClient
  32 TEST_CLIENT_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Client (sect163r1 key signed with RSA)"
  33
  34 # Generating an EC certificate involves the following main steps
  35 # 1. Generating curve parameters (if needed)
  36 # 2. Generating a certificate request
  37 # 3. Signing the certificate request
  38 # 4. [Optional] One can combine the cert and private key into a single
  39 #    file and also delete the certificate request
  40
  41
  42 echo "GENERATING A TEST SERVER CERTIFICATE (ECC key signed with RSA)"
  43 echo "=============================================================="
  44 $OPENSSL_CMD ecparam -name $TEST_SERVER_CURVE -out $TEST_SERVER_CURVE.pem
  45
  46 $OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_SERVER_DN" \
  47     -keyout $KEYS_DIR/$TEST_SERVER_FILE.key.pem \
  48     -newkey ecdsa:$TEST_SERVER_CURVE.pem -new \
  49     -out $CERTS_DIR/$TEST_SERVER_FILE.req.pem
  50
  51 $OPENSSL_CMD x509 -req -days $DAYS \
  52     -in $CERTS_DIR/$TEST_SERVER_FILE.req.pem \
  53     -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
  54     -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
  55     -out $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -CAcreateserial
  56
  57 # Display the certificate
  58 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -text
  59
  60 # Place the certificate and key in a common file
  61 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -issuer -subject \
  62          > $COMBO_DIR/$TEST_SERVER_FILE.pem
  63 $CAT $KEYS_DIR/$TEST_SERVER_FILE.key.pem >> $COMBO_DIR/$TEST_SERVER_FILE.pem
  64
  65 # Remove the cert request file (no longer needed)
  66 $RM $CERTS_DIR/$TEST_SERVER_FILE.req.pem
  67
  68 echo "GENERATING A TEST CLIENT CERTIFICATE (ECC key signed with RSA)"
  69 echo "=============================================================="
  70 $OPENSSL_CMD ecparam -name $TEST_CLIENT_CURVE -out $TEST_CLIENT_CURVE.pem
  71
  72 $OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_CLIENT_DN" \
  73              -keyout $KEYS_DIR/$TEST_CLIENT_FILE.key.pem \
  74              -newkey ecdsa:$TEST_CLIENT_CURVE.pem -new \
  75              -out $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
  76
  77 $OPENSSL_CMD x509 -req -days $DAYS \
  78     -in $CERTS_DIR/$TEST_CLIENT_FILE.req.pem \
  79     -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
  80     -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
  81     -out $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -CAcreateserial
  82
  83 # Display the certificate
  84 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -text
  85
  86 # Place the certificate and key in a common file
  87 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -issuer -subject \
  88          > $COMBO_DIR/$TEST_CLIENT_FILE.pem
  89 $CAT $KEYS_DIR/$TEST_CLIENT_FILE.key.pem >> $COMBO_DIR/$TEST_CLIENT_FILE.pem
  90
  91 # Remove the cert request file (no longer needed)
  92 $RM $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
  93