X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=test%2Fcerts%2Fmkcert.sh;h=39e3a1e28c3f6c7c382f0d13c82b28a9a9b48185;hp=daa0679ee8d2ff0f8e1c23bec4f8265edc73700c;hb=71c8cd20852d43fa142ca3f6e89a33431c506baf;hpb=a7be5759cf9d8e2bf7c1ecd0efa2d53aae9ab706 diff --git a/test/certs/mkcert.sh b/test/certs/mkcert.sh index daa0679ee8..39e3a1e28c 100755 --- a/test/certs/mkcert.sh +++ b/test/certs/mkcert.sh @@ -49,17 +49,18 @@ key() { fi } +# Usage: $0 req keyname dn1 dn2 ... req() { local key=$1; shift - local cn=$1; shift key "$key" local errs stderr_onerror \ openssl req -new -"${OPENSSL_SIGALG}" -key "${key}.pem" \ - -config <(printf "[req]\n%s\n%s\n[dn]\nCN=%s\n" \ - "prompt = no" "distinguished_name = dn" "${cn}") + -config <(printf "[req]\n%s\n%s\n[dn]\n" \ + "prompt = no" "distinguished_name = dn" "${dn}" + for dn in "$@"; do echo "$dn"; done) } req_nocn() { @@ -93,7 +94,7 @@ genroot() { do exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku") done - csr=$(req "$key" "$cn") || return 1 + csr=$(req "$key" "CN = $cn") || return 1 echo "$csr" | cert "$cert" "$exts" -signkey "${key}.pem" -set_serial 1 -days "${DAYS}" } @@ -112,7 +113,7 @@ genca() { do exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku") done - csr=$(req "$key" "$cn") || return 1 + csr=$(req "$key" "CN = $cn") || return 1 echo "$csr" | cert "$cert" "$exts" -CA "${cacert}.pem" -CAkey "${cakey}.pem" \ -set_serial 2 -days "${DAYS}" @@ -133,12 +134,34 @@ gen_nonbc_ca() { do exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku") done - csr=$(req "$key" "$cn") || return 1 + csr=$(req "$key" "CN = $cn") || return 1 echo "$csr" | cert "$cert" "$exts" -CA "${cacert}.pem" -CAkey "${cakey}.pem" \ -set_serial 2 -days "${DAYS}" } +# Usage: $0 genpc keyname certname eekeyname eecertname pcext1 pcext2 ... +# +# Note: takes csr on stdin, so must be used with $0 req like this: +# +# $0 req keyname dn | $0 genpc keyname certname eekeyname eecertname pcext ... +genpc() { + local key=$1; shift + local cert=$1; shift + local cakey=$1; shift + local ca=$1; shift + + exts=$(printf "%s\n%s\n%s\n%s\n" \ + "subjectKeyIdentifier = hash" \ + "authorityKeyIdentifier = keyid, issuer:always" \ + "basicConstraints = CA:false" \ + "proxyCertInfo = critical, @pcexts"; + echo "[pcexts]"; + for x in "$@"; do echo $x; done) + cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \ + -set_serial 2 -days "${DAYS}" +} + genee() { local OPTIND=1 local purpose=serverAuth @@ -165,7 +188,7 @@ genee() { "basicConstraints = CA:false" \ "extendedKeyUsage = $purpose" \ "subjectAltName = @alts" "DNS=${cn}") - csr=$(req "$key" "$cn") || return 1 + csr=$(req "$key" "CN = $cn") || return 1 echo "$csr" | cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \ -set_serial 2 -days "${DAYS}" "$@" @@ -182,7 +205,7 @@ genss() { "basicConstraints = CA:false" \ "extendedKeyUsage = serverAuth" \ "subjectAltName = @alts" "DNS=${cn}") - csr=$(req "$key" "$cn") || return 1 + csr=$(req "$key" "CN = $cn") || return 1 echo "$csr" | cert "$cert" "$exts" -signkey "${key}.pem" \ -set_serial 1 -days "${DAYS}" "$@"