You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
98 lines
3.6 KiB
98 lines
3.6 KiB
#!/bin/sh |
|
|
|
# For a list of supported curves, use "apps/openssl ecparam -list_curves". |
|
|
|
# Path to the openssl distribution |
|
OPENSSL_DIR=../.. |
|
# Path to the openssl program |
|
OPENSSL_CMD=$OPENSSL_DIR/apps/openssl |
|
# Option to find configuration file |
|
OPENSSL_CNF="-config $OPENSSL_DIR/apps/openssl.cnf" |
|
# Directory where certificates are stored |
|
CERTS_DIR=./Certs |
|
# Directory where private key files are stored |
|
KEYS_DIR=$CERTS_DIR |
|
# Directory where combo files (containing a certificate and corresponding |
|
# private key together) are stored |
|
COMBO_DIR=$CERTS_DIR |
|
# cat command |
|
CAT=/bin/cat |
|
# rm command |
|
RM=/bin/rm |
|
# mkdir command |
|
MKDIR=/bin/mkdir |
|
# The certificate will expire these many days after the issue date. |
|
DAYS=1500 |
|
TEST_CA_FILE=rsa1024TestCA |
|
|
|
TEST_SERVER_CURVE=sect163r1 |
|
TEST_SERVER_FILE=sect163r1-rsaTestServer |
|
TEST_SERVER_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Server (sect163r1 key signed with RSA)" |
|
|
|
TEST_CLIENT_CURVE=sect163r1 |
|
TEST_CLIENT_FILE=sect163r1-rsaTestClient |
|
TEST_CLIENT_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Client (sect163r1 key signed with RSA)" |
|
|
|
# Generating an EC certificate involves the following main steps |
|
# 1. Generating curve parameters (if needed) |
|
# 2. Generating a certificate request |
|
# 3. Signing the certificate request |
|
# 4. [Optional] One can combine the cert and private key into a single |
|
# file and also delete the certificate request |
|
|
|
$MKDIR -p $CERTS_DIR |
|
$MKDIR -p $KEYS_DIR |
|
$MKDIR -p $COMBO_DIR |
|
|
|
echo "GENERATING A TEST SERVER CERTIFICATE (ECC key signed with RSA)" |
|
echo "==============================================================" |
|
$OPENSSL_CMD ecparam -name $TEST_SERVER_CURVE -out $TEST_SERVER_CURVE.pem |
|
|
|
$OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_SERVER_DN" \ |
|
-keyout $KEYS_DIR/$TEST_SERVER_FILE.key.pem \ |
|
-newkey ec:$TEST_SERVER_CURVE.pem -new \ |
|
-out $CERTS_DIR/$TEST_SERVER_FILE.req.pem |
|
|
|
$OPENSSL_CMD x509 -req -days $DAYS \ |
|
-in $CERTS_DIR/$TEST_SERVER_FILE.req.pem \ |
|
-CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \ |
|
-CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \ |
|
-out $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -CAcreateserial |
|
|
|
# Display the certificate |
|
$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -text |
|
|
|
# Place the certificate and key in a common file |
|
$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -issuer -subject \ |
|
> $COMBO_DIR/$TEST_SERVER_FILE.pem |
|
$CAT $KEYS_DIR/$TEST_SERVER_FILE.key.pem >> $COMBO_DIR/$TEST_SERVER_FILE.pem |
|
|
|
# Remove the cert request file (no longer needed) |
|
$RM $CERTS_DIR/$TEST_SERVER_FILE.req.pem |
|
|
|
echo "GENERATING A TEST CLIENT CERTIFICATE (ECC key signed with RSA)" |
|
echo "==============================================================" |
|
$OPENSSL_CMD ecparam -name $TEST_CLIENT_CURVE -out $TEST_CLIENT_CURVE.pem |
|
|
|
$OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_CLIENT_DN" \ |
|
-keyout $KEYS_DIR/$TEST_CLIENT_FILE.key.pem \ |
|
-newkey ec:$TEST_CLIENT_CURVE.pem -new \ |
|
-out $CERTS_DIR/$TEST_CLIENT_FILE.req.pem |
|
|
|
$OPENSSL_CMD x509 -req -days $DAYS \ |
|
-in $CERTS_DIR/$TEST_CLIENT_FILE.req.pem \ |
|
-CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \ |
|
-CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \ |
|
-out $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -CAcreateserial |
|
|
|
# Display the certificate |
|
$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -text |
|
|
|
# Place the certificate and key in a common file |
|
$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -issuer -subject \ |
|
> $COMBO_DIR/$TEST_CLIENT_FILE.pem |
|
$CAT $KEYS_DIR/$TEST_CLIENT_FILE.key.pem >> $COMBO_DIR/$TEST_CLIENT_FILE.pem |
|
|
|
# Remove the cert request file (no longer needed) |
|
$RM $CERTS_DIR/$TEST_CLIENT_FILE.req.pem |
|
|
|
|