| 1 | #!/bin/sh
|
|---|
| 2 | # Copyright 2013-2022 The OpenSSL Project Authors. All Rights Reserved.
|
|---|
| 3 | #
|
|---|
| 4 | # Licensed under the Apache License 2.0 (the "License"). You may not use
|
|---|
| 5 | # this file except in compliance with the License. You can obtain a copy
|
|---|
| 6 | # in the file LICENSE in the source distribution or at
|
|---|
| 7 | # https://www.openssl.org/source/license.html
|
|---|
| 8 |
|
|---|
| 9 |
|
|---|
| 10 | # Utility to recreate S/MIME certificates
|
|---|
| 11 |
|
|---|
| 12 | OPENSSL=../../apps/openssl
|
|---|
| 13 | OPENSSL_CONF=./ca.cnf
|
|---|
| 14 | export OPENSSL_CONF
|
|---|
| 15 |
|
|---|
| 16 | # Root CA: create certificate directly
|
|---|
| 17 | CN="Test S/MIME RSA Root" $OPENSSL req -config ca.cnf -x509 -noenc \
|
|---|
| 18 | -keyout smroot.pem -out smroot.pem -newkey rsa:2048 -days 36501
|
|---|
| 19 |
|
|---|
| 20 | # EE RSA certificates: create request first
|
|---|
| 21 | CN="Test S/MIME EE RSA #1" $OPENSSL req -config ca.cnf -noenc \
|
|---|
| 22 | -keyout smrsa1.pem -out req.pem -newkey rsa:2048
|
|---|
| 23 | # Sign request: end entity extensions
|
|---|
| 24 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \
|
|---|
| 25 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa1.pem
|
|---|
| 26 |
|
|---|
| 27 | CN="Test S/MIME EE RSA #2" $OPENSSL req -config ca.cnf -noenc \
|
|---|
| 28 | -keyout smrsa2.pem -out req.pem -newkey rsa:2048
|
|---|
| 29 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \
|
|---|
| 30 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa2.pem
|
|---|
| 31 |
|
|---|
| 32 | CN="Test S/MIME EE RSA #3" $OPENSSL req -config ca.cnf -noenc \
|
|---|
| 33 | -keyout smrsa3.pem -out req.pem -newkey rsa:2048
|
|---|
| 34 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \
|
|---|
| 35 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa3.pem
|
|---|
| 36 |
|
|---|
| 37 | CN="Test S/MIME EE RSA 1024" $OPENSSL req -config ca.cnf -noenc \
|
|---|
| 38 | -keyout smrsa1024.pem -out req.pem -newkey rsa:1024
|
|---|
| 39 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \
|
|---|
| 40 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa1024.pem
|
|---|
| 41 |
|
|---|
| 42 | # Create DSA parameters
|
|---|
| 43 |
|
|---|
| 44 | $OPENSSL dsaparam -out dsap.pem 2048
|
|---|
| 45 |
|
|---|
| 46 | CN="Test S/MIME EE DSA #1" $OPENSSL req -config ca.cnf -noenc \
|
|---|
| 47 | -keyout smdsa1.pem -out req.pem -newkey dsa:dsap.pem
|
|---|
| 48 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \
|
|---|
| 49 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa1.pem
|
|---|
| 50 | CN="Test S/MIME EE DSA #2" $OPENSSL req -config ca.cnf -noenc \
|
|---|
| 51 | -keyout smdsa2.pem -out req.pem -newkey dsa:dsap.pem
|
|---|
| 52 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \
|
|---|
| 53 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa2.pem
|
|---|
| 54 | CN="Test S/MIME EE DSA #3" $OPENSSL req -config ca.cnf -noenc \
|
|---|
| 55 | -keyout smdsa3.pem -out req.pem -newkey dsa:dsap.pem
|
|---|
| 56 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \
|
|---|
| 57 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa3.pem
|
|---|
| 58 |
|
|---|
| 59 | # Create EC parameters
|
|---|
| 60 |
|
|---|
| 61 | $OPENSSL ecparam -out ecp.pem -name P-256
|
|---|
| 62 | $OPENSSL ecparam -out ecp2.pem -name K-283
|
|---|
| 63 |
|
|---|
| 64 | CN="Test S/MIME EE EC #1" $OPENSSL req -config ca.cnf -noenc \
|
|---|
| 65 | -keyout smec1.pem -out req.pem -newkey ec:ecp.pem
|
|---|
| 66 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \
|
|---|
| 67 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec1.pem
|
|---|
| 68 | CN="Test S/MIME EE EC #2" $OPENSSL req -config ca.cnf -noenc \
|
|---|
| 69 | -keyout smec2.pem -out req.pem -newkey ec:ecp2.pem
|
|---|
| 70 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \
|
|---|
| 71 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec2.pem
|
|---|
| 72 | # Do not renew this cert as it is used for legacy data decrypt test
|
|---|
| 73 | #CN="Test S/MIME EE EC #3" $OPENSSL req -config ca.cnf -noenc \
|
|---|
| 74 | # -keyout smec3.pem -out req.pem -newkey ec:ecp.pem
|
|---|
| 75 | #$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \
|
|---|
| 76 | # -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec3.pem
|
|---|
| 77 | # Create X9.42 DH parameters.
|
|---|
| 78 | $OPENSSL genpkey -genparam -algorithm DHX -out dhp.pem
|
|---|
| 79 | # Generate X9.42 DH key.
|
|---|
| 80 | $OPENSSL genpkey -paramfile dhp.pem -out smdh.pem
|
|---|
| 81 | $OPENSSL pkey -pubout -in smdh.pem -out dhpub.pem
|
|---|
| 82 | # Generate dummy request.
|
|---|
| 83 | CN="Test S/MIME EE DH #1" $OPENSSL req -config ca.cnf -noenc \
|
|---|
| 84 | -keyout smtmp.pem -out req.pem -newkey rsa:2048
|
|---|
| 85 | # Sign request but force public key to DH
|
|---|
| 86 | $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \
|
|---|
| 87 | -force_pubkey dhpub.pem \
|
|---|
| 88 | -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdh.pem
|
|---|
| 89 | # Remove temp files.
|
|---|
| 90 | rm -f req.pem ecp.pem ecp2.pem dsap.pem dhp.pem dhpub.pem smtmp.pem smroot.srl
|
|---|
