xref: /aosp_15_r20/external/cronet/net/data/ssl/scripts/generate-bad-self-signed.sh (revision 6777b5387eb2ff775bb5750e3f5d96f37fb7352b) 
1#!/bin/bash
2
3# Copyright 2016 The Chromium Authors
4# Use of this source code is governed by a BSD-style license that can be
5# found in the LICENSE file.
6
7# This script generates self-signed-invalid-name.pem and
8# self-signed-invalid-sig.pem, which are "self-signed" test certificates with
9# invalid names/signatures, respectively.
10set -e
11
12 rm -rf out
13 mkdir out
14
15openssl genrsa -out out/bad-self-signed.key 2048
16touch out/bad-self-signed-index.txt
17
18# Create two certificate requests with the same key, but different subjects
19SUBJECT_NAME="req_self_signed_a" \
20openssl req \
21  -new \
22  -key out/bad-self-signed.key \
23  -out out/ss-a.req \
24  -config ee.cnf
25
26SUBJECT_NAME="req_self_signed_b" \
27openssl req \
28  -new \
29  -key out/bad-self-signed.key \
30  -out out/ss-b.req \
31  -config ee.cnf
32
33# Create a normal self-signed certificate from one of these requests
34openssl x509 \
35  -req \
36  -in out/ss-a.req \
37  -out out/bad-self-signed-root-a.pem \
38  -signkey out/bad-self-signed.key \
39  -days 3650
40
41# To invalidate the signature without changing names, replace two bytes from the
42# end of the certificate with 0xdead.
43openssl x509 -in out/bad-self-signed-root-a.pem -outform DER \
44  | head -c -2 \
45  > out/bad-sig.der.1
46echo -n -e "\xde\xad" > out/bad-sig.der.2
47cat out/bad-sig.der.1 out/bad-sig.der.2 \
48  | openssl x509 \
49      -inform DER \
50      -outform PEM \
51      -out out/cert-self-signed-invalid-sig.pem
52
53openssl x509 \
54  -text \
55  -noout \
56  -in out/cert-self-signed-invalid-sig.pem \
57  > out/self-signed-invalid-sig.pem
58cat out/cert-self-signed-invalid-sig.pem >> out/self-signed-invalid-sig.pem
59
60# Make a "self-signed" certificate with mismatched names
61openssl x509 \
62  -req \
63  -in out/ss-b.req \
64  -out out/cert-self-signed-invalid-name.pem \
65  -days 3650 \
66  -CA out/bad-self-signed-root-a.pem \
67  -CAkey out/bad-self-signed.key \
68  -CAserial out/bad-self-signed-serial.txt \
69  -CAcreateserial
70
71openssl x509 \
72  -text \
73  -noout \
74  -in out/cert-self-signed-invalid-name.pem \
75  > out/self-signed-invalid-name.pem
76cat out/cert-self-signed-invalid-name.pem >> out/self-signed-invalid-name.pem
77
78