1#!/bin/bash 2 3# Copyright 2012 The Chromium Authors 4# Use of this source code is governed by a BSD-style license that can be 5# found in the LICENSE file. 6 7# This script generates certificates that can be used to test SSL client 8# authentication. Outputs for automated tests are stored in 9# net/data/ssl/certificates, but may be re-generated for manual testing. 10# 11# This script generates several chains of test client certificates: 12# 13# 1. A (end-entity) -> B -> C (self-signed root) 14# 2. D (end-entity) -> E -> C (self-signed root) 15# 3. F (end-entity) -> E -> C (self-signed root) 16# 4. G (end-entity, P-256) -> E -> C (self-signed root) 17# 5. H (end-entity, P-384) -> E -> C (self-signed root) 18# 6. I (end-entity, P-521) -> E -> C (self-signed root) 19# 7. J (end-entity, RSA-1024) -> E -> C (self-signed root) 20# 21# In which the certificates all have distinct keypairs. The client 22# certificates share the same root, but are issued by different 23# intermediates. The names of these intermediates are hardcoded within 24# unit tests, and thus should not be changed. 25 26try () { 27 echo "$@" 28 "$@" || exit 1 29} 30 31try rm -rf out 32try mkdir out 33 34echo Create the serial number files and indices. 35serial=1000 36for i in B C E 37do 38 try /bin/sh -c "echo $serial > out/$i-serial" 39 serial=$(expr $serial + 1) 40 touch out/$i-index.txt 41 touch out/$i-index.txt.attr 42done 43 44echo Generate the keys. 45for i in A B C D E F 46do 47 try openssl genrsa -out out/$i.key 2048 48done 49 50try openssl ecparam -name prime256v1 -genkey -noout -out out/G.key 51try openssl ecparam -name secp384r1 -genkey -noout -out out/H.key 52try openssl ecparam -name secp521r1 -genkey -noout -out out/I.key 53try openssl genrsa -out out/J.key 1024 54 55echo Generate the C CSR 56COMMON_NAME="C Root CA" \ 57 CA_DIR=out \ 58 ID=C \ 59 try openssl req \ 60 -new \ 61 -key out/C.key \ 62 -out out/C.csr \ 63 -config client-certs.cnf 64 65echo C signs itself. 66COMMON_NAME="C Root CA" \ 67 CA_DIR=out \ 68 ID=C \ 69 try openssl x509 \ 70 -req -days 3650 \ 71 -in out/C.csr \ 72 -extensions ca_cert \ 73 -extfile client-certs.cnf \ 74 -signkey out/C.key \ 75 -out out/C.pem 76 77echo Generate the intermediates 78COMMON_NAME="B CA" \ 79 CA_DIR=out \ 80 ID=B \ 81 try openssl req \ 82 -new \ 83 -key out/B.key \ 84 -out out/B.csr \ 85 -config client-certs.cnf 86 87COMMON_NAME="C CA" \ 88 CA_DIR=out \ 89 ID=C \ 90 try openssl ca \ 91 -batch \ 92 -extensions ca_cert \ 93 -in out/B.csr \ 94 -out out/B.pem \ 95 -config client-certs.cnf 96 97COMMON_NAME="E CA" \ 98 CA_DIR=out \ 99 ID=E \ 100 try openssl req \ 101 -new \ 102 -key out/E.key \ 103 -out out/E.csr \ 104 -config client-certs.cnf 105 106COMMON_NAME="C CA" \ 107 CA_DIR=out \ 108 ID=C \ 109 try openssl ca \ 110 -batch \ 111 -extensions ca_cert \ 112 -in out/E.csr \ 113 -out out/E.pem \ 114 -config client-certs.cnf 115 116echo Generate the leaf certs 117for id in A D F G H I J 118do 119 COMMON_NAME="Client Cert $id" \ 120 ID=$id \ 121 try openssl req \ 122 -new \ 123 -key out/$id.key \ 124 -out out/$id.csr \ 125 -config client-certs.cnf 126 # Store the private key also in PKCS#8 format. 127 try openssl pkcs8 \ 128 -topk8 -nocrypt \ 129 -in out/$id.key \ 130 -outform DER \ 131 -out out/$id.pk8 132done 133 134echo B signs A 135COMMON_NAME="B CA" \ 136 CA_DIR=out \ 137 ID=B \ 138 try openssl ca \ 139 -batch \ 140 -extensions user_cert \ 141 -in out/A.csr \ 142 -out out/A.pem \ 143 -config client-certs.cnf 144 145echo E signs D 146COMMON_NAME="E CA" \ 147 CA_DIR=out \ 148 ID=E \ 149 try openssl ca \ 150 -batch \ 151 -extensions user_cert \ 152 -in out/D.csr \ 153 -out out/D.pem \ 154 -config client-certs.cnf 155 156echo E signs F 157COMMON_NAME="E CA" \ 158 CA_DIR=out \ 159 ID=E \ 160 try openssl ca \ 161 -batch \ 162 -extensions san_user_cert \ 163 -in out/F.csr \ 164 -out out/F.pem \ 165 -config client-certs.cnf 166 167echo E signs G 168COMMON_NAME="E CA" \ 169 CA_DIR=out \ 170 ID=E \ 171 try openssl ca \ 172 -batch \ 173 -extensions user_cert \ 174 -in out/G.csr \ 175 -out out/G.pem \ 176 -config client-certs.cnf 177 178echo E signs H 179COMMON_NAME="E CA" \ 180 CA_DIR=out \ 181 ID=E \ 182 try openssl ca \ 183 -batch \ 184 -extensions user_cert \ 185 -in out/H.csr \ 186 -out out/H.pem \ 187 -config client-certs.cnf 188 189echo E signs I 190COMMON_NAME="E CA" \ 191 CA_DIR=out \ 192 ID=E \ 193 try openssl ca \ 194 -batch \ 195 -extensions user_cert \ 196 -in out/I.csr \ 197 -out out/I.pem \ 198 -config client-certs.cnf 199 200echo E signs J 201COMMON_NAME="E CA" \ 202 CA_DIR=out \ 203 ID=E \ 204 try openssl ca \ 205 -batch \ 206 -extensions user_cert \ 207 -in out/J.csr \ 208 -out out/J.pem \ 209 -config client-certs.cnf 210 211echo Package the client certs and private keys into PKCS12 files 212# This is done for easily importing all of the certs needed for clients. 213try /bin/sh -c "cat out/A.pem out/A.key out/B.pem out/C.pem > out/A-chain.pem" 214try /bin/sh -c "cat out/D.pem out/D.key out/E.pem out/C.pem > out/D-chain.pem" 215try /bin/sh -c "cat out/F.pem out/F.key out/E.pem out/C.pem > out/F-chain.pem" 216try /bin/sh -c "cat out/G.pem out/G.key out/E.pem out/C.pem > out/G-chain.pem" 217try /bin/sh -c "cat out/H.pem out/H.key out/E.pem out/C.pem > out/H-chain.pem" 218try /bin/sh -c "cat out/I.pem out/I.key out/E.pem out/C.pem > out/I-chain.pem" 219try /bin/sh -c "cat out/J.pem out/J.key out/E.pem out/C.pem > out/J-chain.pem" 220 221try openssl pkcs12 \ 222 -in out/A-chain.pem \ 223 -out client_1.p12 \ 224 -export \ 225 -passout pass:chrome 226 227try openssl pkcs12 \ 228 -in out/D-chain.pem \ 229 -out client_2.p12 \ 230 -export \ 231 -passout pass:chrome 232 233try openssl pkcs12 \ 234 -in out/F-chain.pem \ 235 -out client_3.p12 \ 236 -export \ 237 -passout pass:chrome 238 239try openssl pkcs12 \ 240 -in out/G-chain.pem \ 241 -out client_4.p12 \ 242 -export \ 243 -passout pass:chrome 244 245try openssl pkcs12 \ 246 -in out/H-chain.pem \ 247 -out client_5.p12 \ 248 -export \ 249 -passout pass:chrome 250 251try openssl pkcs12 \ 252 -in out/I-chain.pem \ 253 -out client_6.p12 \ 254 -export \ 255 -passout pass:chrome 256 257try openssl pkcs12 \ 258 -in out/J-chain.pem \ 259 -out client_7.p12 \ 260 -export \ 261 -passout pass:chrome 262 263try openssl pkcs12 \ 264 -inkey out/A.key \ 265 -in out/A.pem \ 266 -out out/client_1_u16_password.p12 \ 267 -export \ 268 -passout pass:"Hello, 世界" 269 270echo Package the client certs for unit tests 271try cp out/A.pem ../certificates/client_1.pem 272try cp out/A.key ../certificates/client_1.key 273try cp out/A.pk8 ../certificates/client_1.pk8 274try cp out/B.pem ../certificates/client_1_ca.pem 275 276try cp out/D.pem ../certificates/client_2.pem 277try cp out/D.key ../certificates/client_2.key 278try cp out/D.pk8 ../certificates/client_2.pk8 279try cp out/E.pem ../certificates/client_2_ca.pem 280 281try cp out/F.pem ../certificates/client_3.pem 282try cp out/F.key ../certificates/client_3.key 283try cp out/F.pk8 ../certificates/client_3.pk8 284try cp out/E.pem ../certificates/client_3_ca.pem 285 286try cp out/G.pem ../certificates/client_4.pem 287try cp out/G.key ../certificates/client_4.key 288try cp out/G.pk8 ../certificates/client_4.pk8 289try cp out/E.pem ../certificates/client_4_ca.pem 290 291try cp out/H.pem ../certificates/client_5.pem 292try cp out/H.key ../certificates/client_5.key 293try cp out/H.pk8 ../certificates/client_5.pk8 294try cp out/E.pem ../certificates/client_5_ca.pem 295 296try cp out/I.pem ../certificates/client_6.pem 297try cp out/I.key ../certificates/client_6.key 298try cp out/I.pk8 ../certificates/client_6.pk8 299try cp out/E.pem ../certificates/client_6_ca.pem 300 301try cp out/J.pem ../certificates/client_7.pem 302try cp out/J.key ../certificates/client_7.key 303try cp out/J.pk8 ../certificates/client_7.pk8 304try cp out/E.pem ../certificates/client_7_ca.pem 305 306try cp out/client_1_u16_password.p12 ../certificates/client_1_u16_password.p12 307 308try cp out/C.pem ../certificates/client_root_ca.pem 309