1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
|
#!/bin/sh
##
## gentestcrt -- Create self-signed test certificate
## (C) 2001 Jean-Michel Dault <jmdault@mandrakesoft.com> and Mandrakesoft
## Based on cca.sh script by Ralf S. Engelschall
##
# external tools
openssl="/usr/bin/openssl"
# some optional terminal sequences
case $TERM in
xterm|xterm*|vt220|vt220*)
T_MD=`echo dummy | awk '{ printf("%c%c%c%c", 27, 91, 49, 109); }'`
T_ME=`echo dummy | awk '{ printf("%c%c%c", 27, 91, 109); }'`
;;
vt100|vt100*)
T_MD=`echo dummy | awk '{ printf("%c%c%c%c%c%c", 27, 91, 49, 109, 0, 0); }'`
T_ME=`echo dummy | awk '{ printf("%c%c%c%c%c", 27, 91, 109, 0, 0); }'`
;;
default)
T_MD=''
T_ME=''
;;
esac
# find some random files
# (do not use /dev/random here, because this device
# doesn't work as expected on all platforms)
randfiles=''
for file in /var/log/messages /var/adm/messages \
/kernel /vmunix /vmlinuz \
/etc/hosts /etc/resolv.conf; do
if [ -f $file ]; then
if [ ".$randfiles" = . ]; then
randfiles="$file"
else
randfiles="${randfiles}:$file"
fi
fi
done
echo "${T_MD}maketestcrt -- Create self-signed test certificate${T_ME}"
echo "(C) 2001 Jean-Michel Dault <jmdault@mandrakesoft.com> and Mandrakesoft"
echo "Based on cca.sh script by Ralf S. Engelschall"
echo ""
grep -q -s DUMMY server.crt && mv server.crt server.crt.dummy
grep -q -s DUMMY server.key && mv server.key server.key.dummy
echo ""
echo ""
if [ ! -e ./server.crt -a ! -e ./server.key ];then
echo "Will create server.key and server.crt in `pwd`"
else
echo "server.key and server.crt already exist, dying"
exit
fi
echo ""
mkdir -p /tmp/tmpssl-$$
pushd /tmp/tmpssl-$$ > /dev/null
echo "${T_MD}INITIALIZATION${T_ME}"
echo ""
echo "${T_MD}Generating custom Certificate Authority (CA)${T_ME}"
echo "______________________________________________________________________"
echo ""
echo "${T_MD}STEP 1: Generating RSA private key for CA (1024 bit)${T_ME}"
cp /dev/null ca.rnd
echo '01' >ca.ser
if [ ".$randfiles" != . ]; then
$openssl genrsa -rand $randfiles -out ca.key 1024
else
$openssl genrsa -out ca.key 1024
fi
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to generate RSA private key" 1>&2
exit 1
fi
echo "______________________________________________________________________"
echo ""
echo "${T_MD}STEP 2: Generating X.509 certificate signing request for CA${T_ME}"
cat >.cfg <<EOT
[ req ]
default_bits = 1024
distinguished_name = req_DN
RANDFILE = ca.rnd
[ req_DN ]
countryName = "1. Country Name (2 letter code)"
#countryName_default = CA
#countryName_min = 2
countryName_max = 2
stateOrProvinceName = "2. State or Province Name (full name) "
#stateOrProvinceName_default = "Quebec"
localityName = "3. Locality Name (eg, city) "
#localityName_default = "Montreal"
0.organizationName = "4. Organization Name (eg, company) "
0.organizationName_default = "Apache HTTP Server"
organizationalUnitName = "5. Organizational Unit Name (eg, section) "
organizationalUnitName_default = "For testing purposes only"
commonName = "6. Common Name (eg, CA name) "
commonName_max = 64
commonName_default = "localhost"
emailAddress = "7. Email Address (eg, name@FQDN)"
emailAddress_max = 40
#emailAddress_default = "root@localhost"
EOT
$openssl req -config .cfg -new -key ca.key -out ca.csr
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to generate certificate signing request" 1>&2
exit 1
fi
echo "______________________________________________________________________"
echo ""
echo "${T_MD}STEP 3: Generating X.509 certificate for CA signed by itself${T_ME}"
cat >.cfg <<EOT
#extensions = x509v3
#[ x509v3 ]
#subjectAltName = email:copy
#basicConstraints = CA:true,pathlen:0
#nsComment = "CCA generated custom CA certificate"
#nsCertType = sslCA
EOT
$openssl x509 -extfile .cfg -req -days 365 -signkey ca.key -in ca.csr -out ca.crt
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to generate self-signed CA certificate" 1>&2
exit 1
fi
echo "______________________________________________________________________"
echo ""
echo "${T_MD}RESULT:${T_ME}"
$openssl verify ca.crt
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to verify resulting X.509 certificate" 1>&2
exit 1
fi
$openssl x509 -text -in ca.crt
$openssl rsa -text -in ca.key
echo "${T_MD}CERTIFICATE GENERATION${T_ME}"
user="server"
echo ""
echo "${T_MD}Generating custom USER${T_ME} [$user]"
echo "______________________________________________________________________"
echo ""
echo "${T_MD}STEP 5: Generating RSA private key for USER (1024 bit)${T_ME}"
if [ ".$randfiles" != . ]; then
$openssl genrsa -rand $randfiles -out $user.key 1024
else
$openssl genrsa -out $user.key 1024
fi
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to generate RSA private key" 1>&2
exit 1
fi
echo "______________________________________________________________________"
echo ""
echo "${T_MD}STEP 6: Generating X.509 certificate signing request for USER${T_ME}"
cat >.cfg <<EOT
[ req ]
default_bits = 1024
distinguished_name = req_DN
RANDFILE = ca.rnd
[ req_DN ]
countryName = "1. Country Name (2 letter code)"
#countryName_default = XY
#countryName_min = 2
countryName_max = 2
stateOrProvinceName = "2. State or Province Name (full name) "
#stateOrProvinceName_default = "Unknown"
localityName = "3. Locality Name (eg, city) "
#localityName_default = "Server Room"
0.organizationName = "4. Organization Name (eg, company) "
0.organizationName_default = "Apache HTTP Server"
organizationalUnitName = "5. Organizational Unit Name (eg, section) "
organizationalUnitName_default = "Test Certificate"
commonName = "6. Common Name (eg, DOMAIN NAME) "
commonName_max = 64
commonName_default = "localhost"
emailAddress = "7. Email Address (eg, name@fqdn)"
emailAddress_max = 40
#emailAddress_default = "root@localhost"
EOT
$openssl req -config .cfg -new -key $user.key -out $user.csr
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to generate certificate signing request" 1>&2
exit 1
fi
rm -f .cfg
echo "______________________________________________________________________"
echo ""
echo "${T_MD}STEP 7: Generating X.509 certificate signed by own CA${T_ME}"
cat >.cfg <<EOT
#extensions = x509v3
#[ x509v3 ]
#subjectAltName = email:copy
#basicConstraints = CA:false,pathlen:0
#nsComment = "CCA generated client certificate"
#nsCertType = client
EOT
$openssl x509 -extfile .cfg -days 365 -CAserial ca.ser -CA ca.crt -CAkey ca.key -in $user.csr -req -out $user.crt
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to generate X.509 certificate" 1>&2
exit 1
fi
caname="`$openssl x509 -noout -text -in ca.crt |\
grep Subject: | sed -e 's;.*CN=;;' -e 's;/Em.*;;'`"
username="`$openssl x509 -noout -text -in $user.crt |\
grep Subject: | sed -e 's;.*CN=;;' -e 's;/Em.*;;'`"
# echo "Assembling PKCS#12 package"
# $openssl pkcs12 -export -in $user.crt -inkey $user.key -certfile ca.crt -name "$username" -caname "$caname" -out $user.p12
echo "______________________________________________________________________"
echo ""
echo "${T_MD}RESULT:${T_ME}"
$openssl verify -CAfile ca.crt $user.crt
if [ $? -ne 0 ]; then
echo "cca:Error: Failed to verify resulting X.509 certificate" 1>&2
exit 1
fi
$openssl x509 -text -in $user.crt
$openssl rsa -text -in $user.key
popd >/dev/null
rm -f /tmp/tmpssl-$$/*.csr
rm -f /tmp/tmpssl-$$/ca.*
chmod 400 /tmp/tmpssl-$$/*
echo "Certificate creation done!"
cp /tmp/tmpssl-$$/server.* .
rm -rf /tmp/tmpssl-$$
|
GitWeb