Use SHA1 and not deprecated MD5 in demos.
[openssl.git] / demos / ssltest-ecc / RSAcertgen.sh
1 #!/bin/sh
2
3 # For a list of supported curves, use "apps/openssl ecparam -list_curves".
4
5 # Path to the openssl distribution
6 OPENSSL_DIR=../..
7 # Path to the openssl program
8 OPENSSL_CMD=$OPENSSL_DIR/apps/openssl
9 # Option to find configuration file
10 OPENSSL_CNF="-config $OPENSSL_DIR/apps/openssl.cnf"
11 # Directory where certificates are stored
12 CERTS_DIR=./Certs
13 # Directory where private key files are stored
14 KEYS_DIR=$CERTS_DIR
15 # Directory where combo files (containing a certificate and corresponding
16 # private key together) are stored
17 COMBO_DIR=$CERTS_DIR
18 # cat command
19 CAT=/bin/cat
20 # rm command
21 RM=/bin/rm
22 # mkdir command
23 MKDIR=/bin/mkdir
24 # The certificate will expire these many days after the issue date.
25 DAYS=1500
26 TEST_CA_FILE=rsa1024TestCA
27 TEST_CA_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test CA (1024 bit RSA)"
28
29 TEST_SERVER_FILE=rsa1024TestServer
30 TEST_SERVER_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Server (1024 bit RSA)"
31
32 TEST_CLIENT_FILE=rsa1024TestClient
33 TEST_CLIENT_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Client (1024 bit RSA)"
34
35 # Generating an EC certificate involves the following main steps
36 # 1. Generating curve parameters (if needed)
37 # 2. Generating a certificate request
38 # 3. Signing the certificate request 
39 # 4. [Optional] One can combine the cert and private key into a single
40 #    file and also delete the certificate request
41
42 $MKDIR -p $CERTS_DIR
43 $MKDIR -p $KEYS_DIR
44 $MKDIR -p $COMBO_DIR
45
46 echo "Generating self-signed CA certificate (RSA)"
47 echo "==========================================="
48
49 $OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_CA_DN" \
50     -keyout $KEYS_DIR/$TEST_CA_FILE.key.pem \
51     -newkey rsa:1024 -new \
52     -out $CERTS_DIR/$TEST_CA_FILE.req.pem
53
54 $OPENSSL_CMD x509 -req -days $DAYS \
55     -in $CERTS_DIR/$TEST_CA_FILE.req.pem \
56     -extfile $OPENSSL_DIR/apps/openssl.cnf \
57     -extensions v3_ca \
58     -signkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
59     -out $CERTS_DIR/$TEST_CA_FILE.cert.pem
60
61 # Display the certificate
62 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CA_FILE.cert.pem -text
63
64 # Place the certificate and key in a common file
65 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CA_FILE.cert.pem -issuer -subject \
66          > $COMBO_DIR/$TEST_CA_FILE.pem
67 $CAT $KEYS_DIR/$TEST_CA_FILE.key.pem >> $COMBO_DIR/$TEST_CA_FILE.pem
68
69 # Remove the cert request file (no longer needed)
70 $RM $CERTS_DIR/$TEST_CA_FILE.req.pem
71
72 echo "GENERATING A TEST SERVER CERTIFICATE (RSA)"
73 echo "=========================================="
74
75 $OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_SERVER_DN" \
76     -keyout $KEYS_DIR/$TEST_SERVER_FILE.key.pem \
77     -newkey rsa:1024 -new \
78     -out $CERTS_DIR/$TEST_SERVER_FILE.req.pem
79
80 $OPENSSL_CMD x509 -req -days $DAYS \
81     -in $CERTS_DIR/$TEST_SERVER_FILE.req.pem \
82     -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
83     -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
84     -out $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -CAcreateserial
85
86 # Display the certificate 
87 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -text
88
89 # Place the certificate and key in a common file
90 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -issuer -subject \
91          > $COMBO_DIR/$TEST_SERVER_FILE.pem
92 $CAT $KEYS_DIR/$TEST_SERVER_FILE.key.pem >> $COMBO_DIR/$TEST_SERVER_FILE.pem
93
94 # Remove the cert request file (no longer needed)
95 $RM $CERTS_DIR/$TEST_SERVER_FILE.req.pem
96
97 echo "GENERATING A TEST CLIENT CERTIFICATE (RSA)"
98 echo "=========================================="
99
100 $OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_CLIENT_DN" \
101              -keyout $KEYS_DIR/$TEST_CLIENT_FILE.key.pem \
102              -newkey rsa:1024 -new \
103              -out $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
104
105 $OPENSSL_CMD x509 -req -days $DAYS \
106     -in $CERTS_DIR/$TEST_CLIENT_FILE.req.pem \
107     -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
108     -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
109     -out $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -CAcreateserial
110
111 # Display the certificate 
112 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -text
113
114 # Place the certificate and key in a common file
115 $OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -issuer -subject \
116          > $COMBO_DIR/$TEST_CLIENT_FILE.pem
117 $CAT $KEYS_DIR/$TEST_CLIENT_FILE.key.pem >> $COMBO_DIR/$TEST_CLIENT_FILE.pem
118
119 # Remove the cert request file (no longer needed)
120 $RM $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
121