]>
Commit | Line | Data |
---|---|---|
a0957d55 | 1 | #!/bin/sh |
4333b89f | 2 | # Copyright 2013-2021 The OpenSSL Project Authors. All Rights Reserved. |
44c8a5e2 | 3 | # |
909f1a2e | 4 | # Licensed under the Apache License 2.0 (the "License"). You may not use |
44c8a5e2 RS |
5 | # this file except in compliance with the License. You can obtain a copy |
6 | # in the file LICENSE in the source distribution or at | |
7 | # https://www.openssl.org/source/license.html | |
8 | ||
a0957d55 DSH |
9 | |
10 | # Utility to recreate S/MIME certificates | |
11 | ||
12 | OPENSSL=../../apps/openssl | |
13 | OPENSSL_CONF=./ca.cnf | |
14 | export OPENSSL_CONF | |
15 | ||
16 | # Root CA: create certificate directly | |
ef898017 | 17 | CN="Test S/MIME RSA Root" $OPENSSL req -config ca.cnf -x509 -noenc \ |
5d219937 | 18 | -keyout smroot.pem -out smroot.pem -newkey rsa:2048 -days 36501 |
a0957d55 DSH |
19 | |
20 | # EE RSA certificates: create request first | |
ef898017 | 21 | CN="Test S/MIME EE RSA #1" $OPENSSL req -config ca.cnf -noenc \ |
a0957d55 DSH |
22 | -keyout smrsa1.pem -out req.pem -newkey rsa:2048 |
23 | # Sign request: end entity extensions | |
5d219937 | 24 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ |
a0957d55 DSH |
25 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa1.pem |
26 | ||
ef898017 | 27 | CN="Test S/MIME EE RSA #2" $OPENSSL req -config ca.cnf -noenc \ |
a0957d55 | 28 | -keyout smrsa2.pem -out req.pem -newkey rsa:2048 |
5d219937 | 29 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ |
a0957d55 DSH |
30 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa2.pem |
31 | ||
ef898017 | 32 | CN="Test S/MIME EE RSA #3" $OPENSSL req -config ca.cnf -noenc \ |
a0957d55 | 33 | -keyout smrsa3.pem -out req.pem -newkey rsa:2048 |
5d219937 | 34 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ |
a0957d55 DSH |
35 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa3.pem |
36 | ||
6c73ca4a CL |
37 | CN="Test S/MIME EE RSA 1024" $OPENSSL req -config ca.cnf -noenc \ |
38 | -keyout smrsa1024.pem -out req.pem -newkey rsa:1024 | |
39 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ | |
40 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa1024.pem | |
41 | ||
a0957d55 DSH |
42 | # Create DSA parameters |
43 | ||
44 | $OPENSSL dsaparam -out dsap.pem 2048 | |
45 | ||
ef898017 | 46 | CN="Test S/MIME EE DSA #1" $OPENSSL req -config ca.cnf -noenc \ |
a0957d55 | 47 | -keyout smdsa1.pem -out req.pem -newkey dsa:dsap.pem |
5d219937 | 48 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ |
a0957d55 | 49 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa1.pem |
ef898017 | 50 | CN="Test S/MIME EE DSA #2" $OPENSSL req -config ca.cnf -noenc \ |
a0957d55 | 51 | -keyout smdsa2.pem -out req.pem -newkey dsa:dsap.pem |
5d219937 | 52 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ |
a0957d55 | 53 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa2.pem |
ef898017 | 54 | CN="Test S/MIME EE DSA #3" $OPENSSL req -config ca.cnf -noenc \ |
a0957d55 | 55 | -keyout smdsa3.pem -out req.pem -newkey dsa:dsap.pem |
5d219937 | 56 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ |
a0957d55 DSH |
57 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa3.pem |
58 | ||
59 | # Create EC parameters | |
60 | ||
61 | $OPENSSL ecparam -out ecp.pem -name P-256 | |
62 | $OPENSSL ecparam -out ecp2.pem -name K-283 | |
63 | ||
ef898017 | 64 | CN="Test S/MIME EE EC #1" $OPENSSL req -config ca.cnf -noenc \ |
a0957d55 | 65 | -keyout smec1.pem -out req.pem -newkey ec:ecp.pem |
5d219937 | 66 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ |
a0957d55 | 67 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec1.pem |
ef898017 | 68 | CN="Test S/MIME EE EC #2" $OPENSSL req -config ca.cnf -noenc \ |
a0957d55 | 69 | -keyout smec2.pem -out req.pem -newkey ec:ecp2.pem |
5d219937 | 70 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ |
a0957d55 | 71 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec2.pem |
5d219937 TM |
72 | # Do not renew this cert as it is used for legacy data decrypt test |
73 | #CN="Test S/MIME EE EC #3" $OPENSSL req -config ca.cnf -noenc \ | |
74 | # -keyout smec3.pem -out req.pem -newkey ec:ecp.pem | |
75 | #$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ | |
76 | # -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec3.pem | |
75787fd8 | 77 | # Create X9.42 DH parameters. |
24d5be7a | 78 | $OPENSSL genpkey -genparam -algorithm DHX -out dhp.pem |
75787fd8 DSH |
79 | # Generate X9.42 DH key. |
80 | $OPENSSL genpkey -paramfile dhp.pem -out smdh.pem | |
81 | $OPENSSL pkey -pubout -in smdh.pem -out dhpub.pem | |
82 | # Generate dummy request. | |
ef898017 | 83 | CN="Test S/MIME EE DH #1" $OPENSSL req -config ca.cnf -noenc \ |
75787fd8 DSH |
84 | -keyout smtmp.pem -out req.pem -newkey rsa:2048 |
85 | # Sign request but force public key to DH | |
5d219937 | 86 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ |
75787fd8 DSH |
87 | -force_pubkey dhpub.pem \ |
88 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdh.pem | |
19914fec LJ |
89 | |
90 | # EE RSA code signing certificates: create request first | |
91 | CN="Test CodeSign EE RSA #1" $OPENSSL req -config ca.cnf -noenc \ | |
92 | -new -out req.pem -key ../certs/ee-key.pem | |
93 | cat ../certs/ee-key.pem > csrsa1.pem | |
94 | # Sign request: end entity extensions | |
95 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36524 -extfile ca.cnf \ | |
96 | -extensions codesign_cert >>csrsa1.pem | |
97 | ||
a0957d55 | 98 | # Remove temp files. |
75787fd8 | 99 | rm -f req.pem ecp.pem ecp2.pem dsap.pem dhp.pem dhpub.pem smtmp.pem smroot.srl |