1#!/bin/sh 2 3digest='-sha1' 4reqcmd="../util/shlib_wrap.sh ../apps/openssl req" 5x509cmd="../util/shlib_wrap.sh ../apps/openssl x509 $digest" 6verifycmd="../util/shlib_wrap.sh ../apps/openssl verify" 7dummycnf="../apps/openssl.cnf" 8 9CAkey="keyCA.ss" 10CAcert="certCA.ss" 11CAreq="reqCA.ss" 12CAconf="CAss.cnf" 13CAreq2="req2CA.ss" # temp 14 15Uconf="Uss.cnf" 16Ukey="keyU.ss" 17Ureq="reqU.ss" 18Ucert="certU.ss" 19 20P1conf="P1ss.cnf" 21P1key="keyP1.ss" 22P1req="reqP1.ss" 23P1cert="certP1.ss" 24P1intermediate="tmp_intP1.ss" 25 26P2conf="P2ss.cnf" 27P2key="keyP2.ss" 28P2req="reqP2.ss" 29P2cert="certP2.ss" 30P2intermediate="tmp_intP2.ss" 31 32echo 33echo "make a certificate request using 'req'" 34 35echo "string to make the random number generator think it has entropy" >> ./.rnd 36 37if ../util/shlib_wrap.sh ../apps/openssl no-rsa; then 38 req_new='-newkey dsa:../apps/dsa512.pem' 39else 40 req_new='-new' 41fi 42 43$reqcmd -config $CAconf -out $CAreq -keyout $CAkey $req_new #>err.ss 44if [ $? != 0 ]; then 45 echo "error using 'req' to generate a certificate request" 46 exit 1 47fi 48echo 49echo "convert the certificate request into a self signed certificate using 'x509'" 50$x509cmd -CAcreateserial -in $CAreq -days 30 -req -out $CAcert -signkey $CAkey -extfile $CAconf -extensions v3_ca >err.ss 51if [ $? != 0 ]; then 52 echo "error using 'x509' to self sign a certificate request" 53 exit 1 54fi 55 56echo 57echo "convert a certificate into a certificate request using 'x509'" 58$x509cmd -in $CAcert -x509toreq -signkey $CAkey -out $CAreq2 >err.ss 59if [ $? != 0 ]; then 60 echo "error using 'x509' convert a certificate to a certificate request" 61 exit 1 62fi 63 64$reqcmd -config $dummycnf -verify -in $CAreq -noout 65if [ $? != 0 ]; then 66 echo first generated request is invalid 67 exit 1 68fi 69 70$reqcmd -config $dummycnf -verify -in $CAreq2 -noout 71if [ $? != 0 ]; then 72 echo second generated request is invalid 73 exit 1 74fi 75 76$verifycmd -CAfile $CAcert $CAcert 77if [ $? != 0 ]; then 78 echo first generated cert is invalid 79 exit 1 80fi 81 82echo 83echo "make a user certificate request using 'req'" 84$reqcmd -config $Uconf -out $Ureq -keyout $Ukey $req_new >err.ss 85if [ $? != 0 ]; then 86 echo "error using 'req' to generate a user certificate request" 87 exit 1 88fi 89 90echo 91echo "sign user certificate request with the just created CA via 'x509'" 92$x509cmd -CAcreateserial -in $Ureq -days 30 -req -out $Ucert -CA $CAcert -CAkey $CAkey -extfile $Uconf -extensions v3_ee >err.ss 93if [ $? != 0 ]; then 94 echo "error using 'x509' to sign a user certificate request" 95 exit 1 96fi 97 98$verifycmd -CAfile $CAcert $Ucert 99echo 100echo "Certificate details" 101$x509cmd -subject -issuer -startdate -enddate -noout -in $Ucert 102 103echo 104echo "make a proxy certificate request using 'req'" 105$reqcmd -config $P1conf -out $P1req -keyout $P1key $req_new >err.ss 106if [ $? != 0 ]; then 107 echo "error using 'req' to generate a proxy certificate request" 108 exit 1 109fi 110 111echo 112echo "sign proxy certificate request with the just created user certificate via 'x509'" 113$x509cmd -CAcreateserial -in $P1req -days 30 -req -out $P1cert -CA $Ucert -CAkey $Ukey -extfile $P1conf -extensions v3_proxy >err.ss 114if [ $? != 0 ]; then 115 echo "error using 'x509' to sign a proxy certificate request" 116 exit 1 117fi 118 119cat $Ucert > $P1intermediate 120$verifycmd -CAfile $CAcert -untrusted $P1intermediate $P1cert 121echo 122echo "Certificate details" 123$x509cmd -subject -issuer -startdate -enddate -noout -in $P1cert 124 125echo 126echo "make another proxy certificate request using 'req'" 127$reqcmd -config $P2conf -out $P2req -keyout $P2key $req_new >err.ss 128if [ $? != 0 ]; then 129 echo "error using 'req' to generate another proxy certificate request" 130 exit 1 131fi 132 133echo 134echo "sign second proxy certificate request with the first proxy certificate via 'x509'" 135$x509cmd -CAcreateserial -in $P2req -days 30 -req -out $P2cert -CA $P1cert -CAkey $P1key -extfile $P2conf -extensions v3_proxy >err.ss 136if [ $? != 0 ]; then 137 echo "error using 'x509' to sign a second proxy certificate request" 138 exit 1 139fi 140 141cat $Ucert $P1cert > $P2intermediate 142$verifycmd -CAfile $CAcert -untrusted $P2intermediate $P2cert 143echo 144echo "Certificate details" 145$x509cmd -subject -issuer -startdate -enddate -noout -in $P2cert 146 147echo 148echo The generated CA certificate is $CAcert 149echo The generated CA private key is $CAkey 150 151echo The generated user certificate is $Ucert 152echo The generated user private key is $Ukey 153 154echo The first generated proxy certificate is $P1cert 155echo The first generated proxy private key is $P1key 156 157echo The second generated proxy certificate is $P2cert 158echo The second generated proxy private key is $P2key 159 160/bin/rm err.ss 161#/bin/rm $P1intermediate 162#/bin/rm $P2intermediate 163exit 0 164