1 files changed, 91 insertions, 15 deletions

diff --git a/src/regress/lib/libcrypto/CA/Makefile b/src/regress/lib/libcrypto/CA/Makefile
index c31c99c946..3e445d2de0 100644
--- a/src/regress/lib/libcrypto/CA/Makefile
+++ b/src/regress/lib/libcrypto/CA/Makefile
@@ -1,21 +1,97 @@
-#       $OpenBSD: Makefile,v 1.1 2017/01/25 10:29:34 beck Exp $
+#       $OpenBSD: Makefile,v 1.2 2020/12/26 00:48:56 bluhm Exp $
 
-TESTS = \
-        doit.sh
+CLEANFILES +=   *.pem *.serial *.txt *.attr *.old
 
-REGRESS_TARGETS= all_tests
+REGRESS_SETUP_ONCE +=   root.serial intermediate.serial
+root.serial intermediate.serial:
+        echo 1000 >$@
 
-CLEANFILES += \
-1000.pem client.cert.pem intermediate.cert.pem root.cert.pem  server.csr.pem \
-1001.pem client.csr.pem intermediate.csr.pem  root.key.pem  server.key.pem \
-chain.pem client.key.pem intermediate.key.pem  server.cert.pem \
-int.txt  int.txt.attr int.txt.old int.txt.attr.old  \
-root.txt root.txt.attr root.txt.old root.txt.attr.old \
-intserial rootserial intserial.old rootserial.old
+REGRESS_SETUP_ONCE +=   root.txt intermediate.txt
+root.txt intermediate.txt:
+        true >$@
 
-all_tests: ${TESTS}
-        @for test in $>; do \
-                ./$$test; \
-        done
+# Vanna Vanna make me a root cert
+root.key.pem:
+        # generate root rsa 4096 key
+        openssl genrsa -out root.key.pem 4096
+
+root.cert.pem: root.cnf root.key.pem
+        # generate root req
+        openssl req -batch -config ${.CURDIR}/root.cnf -key root.key.pem \
+            -new -x509 -days 365 -sha256 -extensions v3_ca -out root.cert.pem
+
+# Make intermediate
+intermediate.key.pem:
+        # generate intermediate rsa 2048 key
+        openssl genrsa -out intermediate.key.pem 2048
+
+intermediate.csr.pem: intermediate.cnf intermediate.key.pem
+        # generate intermediate req
+        openssl req -batch -config ${.CURDIR}/intermediate.cnf -new -sha256 \
+          -key intermediate.key.pem -out intermediate.csr.pem
+
+# Sign intermediate
+intermediate.cert.pem:  root.cnf root.cert.pem intermediate.csr.pem
+        # sign intermediate
+        openssl ca -batch -config ${.CURDIR}/root.cnf \
+            -extensions v3_intermediate_ca -days 10 -notext -md sha256 \
+            -in intermediate.csr.pem -out intermediate.cert.pem
+
+REGRESS_TARGETS +=      run-verify-intermediate
+# Verify Intermediate
+run-verify-intermediate: root.cert.pem intermediate.cert.pem
+        # validate intermediate CA
+        openssl verify -CAfile root.cert.pem intermediate.cert.pem
+
+chain.pem: intermediate.cert.pem root.cert.pem
+        cat intermediate.cert.pem root.cert.pem > chain.pem
+
+# Make a server certificate
+server.key.pem:
+        # genrsa server
+        openssl genrsa -out server.key.pem 2048
+
+server.csr.pem: intermediate.cnf server.key.pem
+        # server req
+        openssl req -batch -config ${.CURDIR}/intermediate.cnf -new -sha256 \
+            -subj '/CN=server/O=OpenBSD/OU=So and Sos/C=CA' \
+            -key server.key.pem -out server.csr.pem
+
+# Sign server key
+server.cert.pem: intermediate.cnf intermediate.cert.pem server.csr.pem
+        # server sign
+        openssl ca -batch -config ${.CURDIR}/intermediate.cnf \
+            -extensions server_cert -days 5 -notext -md sha256 \
+            -in server.csr.pem -out server.cert.pem
+
+# Make a client certificate
+client.key.pem:
+        # genrsa client
+        openssl genrsa -out client.key.pem 2048
+
+client.csr.pem: intermediate.cnf intermediate.cert.pem client.key.pem
+        # client req
+        openssl req -batch -config ${.CURDIR}/intermediate.cnf -new -sha256 \
+            -subj '/CN=client/O=OpenBSD/OU=So and Sos/C=CA' \
+            -key client.key.pem -out client.csr.pem
+
+# Sign client key
+client.cert.pem: intermediate.cnf intermediate.txt client.csr.pem
+        # client sign
+        openssl ca -batch -config ${.CURDIR}/intermediate.cnf \
+            -extensions usr_cert -days 5 -notext -md sha256 \
+            -in client.csr.pem -out client.cert.pem
+
+REGRESS_TARGETS +=      run-verify-server
+# Verify Intermediate
+run-verify-server: chain.pem server.cert.pem
+        # validate server cert
+        openssl verify -purpose sslserver -CAfile chain.pem server.cert.pem
+
+REGRESS_TARGETS +=      run-verify-client
+# Verify Intermediate
+run-verify-client: chain.pem client.cert.pem
+        # validate client cert
+        openssl verify -purpose sslclient -CAfile chain.pem client.cert.pem
 
 .include <bsd.regress.mk>