diff options
Diffstat (limited to '')
-rwxr-xr-x | src/regress/lib/libcrypto/CA/doit.sh | 116 |
1 files changed, 0 insertions, 116 deletions
diff --git a/src/regress/lib/libcrypto/CA/doit.sh b/src/regress/lib/libcrypto/CA/doit.sh deleted file mode 100755 index 110d89d67f..0000000000 --- a/src/regress/lib/libcrypto/CA/doit.sh +++ /dev/null | |||
@@ -1,116 +0,0 @@ | |||
1 | #!/bin/sh | ||
2 | # $OpenBSD: doit.sh,v 1.2 2018/07/17 17:06:49 tb Exp $ | ||
3 | |||
4 | rm -rf root intermediate certs | ||
5 | echo 1000 > rootserial | ||
6 | cat /dev/null > root.txt | ||
7 | echo 1000 > intserial | ||
8 | cat /dev/null > int.txt | ||
9 | |||
10 | # Vanna Vanna make me a root cert | ||
11 | openssl genrsa -out root.key.pem 4096 | ||
12 | if [ $? -ne 0 ]; then | ||
13 | echo "*** Fail; Can't generate root rsa 4096 key" | ||
14 | exit 1 | ||
15 | fi | ||
16 | |||
17 | openssl req -batch -config root.cnf -key root.key.pem -new -x509 -days 365 -sha256 -extensions v3_ca -out root.cert.pem | ||
18 | if [ $? -ne 0 ]; then | ||
19 | echo "*** Fail; Can't generate root req" | ||
20 | exit 1 | ||
21 | fi | ||
22 | |||
23 | # Make intermediate | ||
24 | openssl genrsa -out intermediate.key.pem 2048 | ||
25 | if [ $? -ne 0 ]; then | ||
26 | echo "*** Fail; Can't generate intermediate rsa 2048 key" | ||
27 | exit 1 | ||
28 | fi | ||
29 | |||
30 | openssl req -batch -config intermediate.cnf -new -sha256 \ | ||
31 | -key intermediate.key.pem \ | ||
32 | -out intermediate.csr.pem | ||
33 | if [ $? -ne 0 ]; then | ||
34 | echo "*** Fail; Can't generate intermediate req" | ||
35 | exit 1 | ||
36 | fi | ||
37 | |||
38 | # Sign intermediate | ||
39 | openssl ca -batch -config root.cnf -extensions v3_intermediate_ca -days 10 -notext -md sha256 -in intermediate.csr.pem -out intermediate.cert.pem | ||
40 | if [ $? -ne 0 ]; then | ||
41 | echo "*** Fail; Can't sign intermediate" | ||
42 | exit 1 | ||
43 | fi | ||
44 | |||
45 | # Verify Intermediate | ||
46 | openssl verify -CAfile ca.cert.pem intermediate.cert.pem | ||
47 | if [ $? -ne 0]; then | ||
48 | echo "*** Fail; Intermediate CA does not validate" | ||
49 | exit 1 | ||
50 | fi | ||
51 | |||
52 | cat intermediate.cert.pem root.cert.pem > chain.pem | ||
53 | |||
54 | # make a server certificate | ||
55 | |||
56 | openssl genrsa -out server.key.pem 2048 | ||
57 | if [ $? -ne 0]; then | ||
58 | echo "*** Fail; genrsa server" | ||
59 | exit 1 | ||
60 | fi | ||
61 | |||
62 | |||
63 | openssl req -batch -config intermediate.cnf \ | ||
64 | -key server.key.pem \ | ||
65 | -new -sha256 -out server.csr.pem \ | ||
66 | -subj '/CN=server/O=OpenBSD/OU=So and Sos/C=CA' | ||
67 | if [ $? -ne 0]; then | ||
68 | echo "*** Fail; server req" | ||
69 | exit 1 | ||
70 | fi | ||
71 | |||
72 | # sign server key | ||
73 | openssl ca -batch -config intermediate.cnf -extensions server_cert -days 5 -notext -md sha256 -in server.csr.pem -out server.cert.pem | ||
74 | if [ $? -ne 0 ]; then | ||
75 | echo "*** Fail; server sign" | ||
76 | exit 1 | ||
77 | fi | ||
78 | |||
79 | # make a client certificate | ||
80 | |||
81 | openssl genrsa -out client.key.pem 2048 | ||
82 | if [ $? -ne 0]; then | ||
83 | echo "*** Fail; genrsa client" | ||
84 | exit 1 | ||
85 | fi | ||
86 | |||
87 | openssl req -batch -config intermediate.cnf \ | ||
88 | -key client.key.pem \ | ||
89 | -new -sha256 -out client.csr.pem \ | ||
90 | -subj '/CN=client/O=OpenBSD/OU=So and Sos/C=CA' | ||
91 | if [ $? -ne 0]; then | ||
92 | echo "*** Fail; client req" | ||
93 | exit 1 | ||
94 | fi | ||
95 | |||
96 | # sign client key | ||
97 | openssl ca -batch -config intermediate.cnf -extensions usr_cert -days 5 -notext -md sha256 -in client.csr.pem -out client.cert.pem | ||
98 | if [ $? -ne 0 ]; then | ||
99 | echo "*** Fail; client sign" | ||
100 | exit 1 | ||
101 | fi | ||
102 | |||
103 | # Verify Intermediate | ||
104 | openssl verify -purpose sslserver -CAfile chain.pem server.cert.pem | ||
105 | if [ $? -ne 0 ]; then | ||
106 | echo "*** Fail; server cert does not validate" | ||
107 | exit 1 | ||
108 | fi | ||
109 | |||
110 | # Verify Intermediate | ||
111 | openssl verify -purpose sslclient -CAfile chain.pem client.cert.pem | ||
112 | if [ $? -ne 0 ]; then | ||
113 | echo "*** Fail; client cert does not validate" | ||
114 | exit 1 | ||
115 | fi | ||
116 | |||