:-'Generic Commit'
This commit is contained in:
Your Name
308
dropshell-tool/openssl-1.1.1w/test/certs/mkcert.sh
Executable file
308
dropshell-tool/openssl-1.1.1w/test/certs/mkcert.sh
Executable file
@ -0,0 +1,308 @@
|
||||
#! /bin/bash
|
||||
#
|
||||
# Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
|
||||
# Copyright (c) 2016 Viktor Dukhovni <openssl-users@dukhovni.org>.
|
||||
# All rights reserved.
|
||||
#
|
||||
# Licensed under the OpenSSL license (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
# in the file LICENSE in the source distribution or at
|
||||
# https://www.openssl.org/source/license.html
|
||||
|
||||
# This file is dual-licensed and is also available under other terms.
|
||||
# Please contact the author.
|
||||
|
||||
# 100 years should be enough for now
|
||||
if [ -z "$DAYS" ]; then
|
||||
DAYS=36525
|
||||
fi
|
||||
|
||||
if [ -z "$OPENSSL_SIGALG" ]; then
|
||||
OPENSSL_SIGALG=sha256
|
||||
fi
|
||||
|
||||
if [ -z "$REQMASK" ]; then
|
||||
REQMASK=utf8only
|
||||
fi
|
||||
|
||||
stderr_onerror() {
|
||||
(
|
||||
err=$("$@" >&3 2>&1) || {
|
||||
printf "%s\n" "$err" >&2
|
||||
exit 1
|
||||
}
|
||||
) 3>&1
|
||||
}
|
||||
|
||||
key() {
|
||||
local key=$1; shift
|
||||
|
||||
local alg=rsa
|
||||
if [ -n "$OPENSSL_KEYALG" ]; then
|
||||
alg=$OPENSSL_KEYALG
|
||||
fi
|
||||
|
||||
local bits=2048
|
||||
if [ -n "$OPENSSL_KEYBITS" ]; then
|
||||
bits=$OPENSSL_KEYBITS
|
||||
fi
|
||||
|
||||
if [ ! -f "${key}.pem" ]; then
|
||||
args=(-algorithm "$alg")
|
||||
case $alg in
|
||||
rsa) args=("${args[@]}" -pkeyopt rsa_keygen_bits:$bits );;
|
||||
ec) args=("${args[@]}" -pkeyopt "ec_paramgen_curve:$bits")
|
||||
args=("${args[@]}" -pkeyopt ec_param_enc:named_curve);;
|
||||
dsa) args=(-paramfile "$bits");;
|
||||
ed25519) ;;
|
||||
ed448) ;;
|
||||
*) printf "Unsupported key algorithm: %s\n" "$alg" >&2; return 1;;
|
||||
esac
|
||||
stderr_onerror \
|
||||
openssl genpkey "${args[@]}" -out "${key}.pem"
|
||||
fi
|
||||
}
|
||||
|
||||
# Usage: $0 req keyname dn1 dn2 ...
|
||||
req() {
|
||||
local key=$1; shift
|
||||
|
||||
key "$key"
|
||||
local errs
|
||||
|
||||
stderr_onerror \
|
||||
openssl req -new -"${OPENSSL_SIGALG}" -key "${key}.pem" \
|
||||
-config <(printf "string_mask=%s\n[req]\n%s\n%s\n[dn]\n" \
|
||||
"$REQMASK" "prompt = no" "distinguished_name = dn"
|
||||
for dn in "$@"; do echo "$dn"; done)
|
||||
}
|
||||
|
||||
req_nocn() {
|
||||
local key=$1; shift
|
||||
|
||||
key "$key"
|
||||
stderr_onerror \
|
||||
openssl req -new -"${OPENSSL_SIGALG}" -subj / -key "${key}.pem" \
|
||||
-config <(printf "[req]\n%s\n[dn]\nCN_default =\n" \
|
||||
"distinguished_name = dn")
|
||||
}
|
||||
|
||||
cert() {
|
||||
local cert=$1; shift
|
||||
local exts=$1; shift
|
||||
|
||||
stderr_onerror \
|
||||
openssl x509 -req -"${OPENSSL_SIGALG}" -out "${cert}.pem" \
|
||||
-extfile <(printf "%s\n" "$exts") "$@"
|
||||
}
|
||||
|
||||
genroot() {
|
||||
local cn=$1; shift
|
||||
local key=$1; shift
|
||||
local cert=$1; shift
|
||||
local skid="subjectKeyIdentifier = hash"
|
||||
local akid="authorityKeyIdentifier = keyid"
|
||||
|
||||
exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid" "basicConstraints = critical,CA:true")
|
||||
for eku in "$@"
|
||||
do
|
||||
exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku")
|
||||
done
|
||||
csr=$(req "$key" "CN = $cn") || return 1
|
||||
echo "$csr" |
|
||||
cert "$cert" "$exts" -signkey "${key}.pem" -set_serial 1 -days "${DAYS}"
|
||||
}
|
||||
|
||||
genca() {
|
||||
local OPTIND=1
|
||||
local purpose=
|
||||
|
||||
while getopts p:c: o
|
||||
do
|
||||
case $o in
|
||||
p) purpose="$OPTARG";;
|
||||
c) certpol="$OPTARG";;
|
||||
*) echo "Usage: $0 genca [-p EKU][-c policyoid] cn keyname certname cakeyname cacertname" >&2
|
||||
return 1;;
|
||||
esac
|
||||
done
|
||||
|
||||
shift $((OPTIND - 1))
|
||||
local cn=$1; shift
|
||||
local key=$1; shift
|
||||
local cert=$1; shift
|
||||
local cakey=$1; shift
|
||||
local cacert=$1; shift
|
||||
local skid="subjectKeyIdentifier = hash"
|
||||
local akid="authorityKeyIdentifier = keyid"
|
||||
|
||||
exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid" "basicConstraints = critical,CA:true")
|
||||
if [ -n "$purpose" ]; then
|
||||
exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$purpose")
|
||||
fi
|
||||
if [ -n "$NC" ]; then
|
||||
exts=$(printf "%s\nnameConstraints = %s\n" "$exts" "$NC")
|
||||
fi
|
||||
if [ -n "$certpol" ]; then
|
||||
exts=$(printf "%s\ncertificatePolicies = %s\n" "$exts" "$certpol")
|
||||
fi
|
||||
|
||||
csr=$(req "$key" "CN = $cn") || return 1
|
||||
echo "$csr" |
|
||||
cert "$cert" "$exts" -CA "${cacert}.pem" -CAkey "${cakey}.pem" \
|
||||
-set_serial 2 -days "${DAYS}" "$@"
|
||||
}
|
||||
|
||||
gen_nonbc_ca() {
|
||||
local cn=$1; shift
|
||||
local key=$1; shift
|
||||
local cert=$1; shift
|
||||
local cakey=$1; shift
|
||||
local cacert=$1; shift
|
||||
local skid="subjectKeyIdentifier = hash"
|
||||
local akid="authorityKeyIdentifier = keyid"
|
||||
|
||||
exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid")
|
||||
exts=$(printf "%s\nkeyUsage = %s\n" "$exts" "keyCertSign, cRLSign")
|
||||
for eku in "$@"
|
||||
do
|
||||
exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku")
|
||||
done
|
||||
csr=$(req "$key" "CN = $cn") || return 1
|
||||
echo "$csr" |
|
||||
cert "$cert" "$exts" -CA "${cacert}.pem" -CAkey "${cakey}.pem" \
|
||||
-set_serial 2 -days "${DAYS}"
|
||||
}
|
||||
|
||||
# Usage: $0 genpc keyname certname eekeyname eecertname pcext1 pcext2 ...
|
||||
#
|
||||
# Note: takes csr on stdin, so must be used with $0 req like this:
|
||||
#
|
||||
# $0 req keyname dn | $0 genpc keyname certname eekeyname eecertname pcext ...
|
||||
genpc() {
|
||||
local key=$1; shift
|
||||
local cert=$1; shift
|
||||
local cakey=$1; shift
|
||||
local ca=$1; shift
|
||||
|
||||
exts=$(printf "%s\n%s\n%s\n%s\n" \
|
||||
"subjectKeyIdentifier = hash" \
|
||||
"authorityKeyIdentifier = keyid, issuer:always" \
|
||||
"basicConstraints = CA:false" \
|
||||
"proxyCertInfo = critical, @pcexts";
|
||||
echo "[pcexts]";
|
||||
for x in "$@"; do echo $x; done)
|
||||
cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
|
||||
-set_serial 2 -days "${DAYS}"
|
||||
}
|
||||
|
||||
# Usage: $0 geneealt keyname certname eekeyname eecertname alt1 alt2 ...
|
||||
#
|
||||
# Note: takes csr on stdin, so must be used with $0 req like this:
|
||||
#
|
||||
# $0 req keyname dn | $0 geneealt keyname certname eekeyname eecertname alt ...
|
||||
geneealt() {
|
||||
local key=$1; shift
|
||||
local cert=$1; shift
|
||||
local cakey=$1; shift
|
||||
local ca=$1; shift
|
||||
|
||||
exts=$(printf "%s\n%s\n%s\n%s\n" \
|
||||
"subjectKeyIdentifier = hash" \
|
||||
"authorityKeyIdentifier = keyid" \
|
||||
"basicConstraints = CA:false" \
|
||||
"subjectAltName = @alts";
|
||||
echo "[alts]";
|
||||
for x in "$@"; do echo $x; done)
|
||||
cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
|
||||
-set_serial 2 -days "${DAYS}"
|
||||
}
|
||||
|
||||
genee() {
|
||||
local OPTIND=1
|
||||
local purpose=serverAuth
|
||||
|
||||
while getopts p: o
|
||||
do
|
||||
case $o in
|
||||
p) purpose="$OPTARG";;
|
||||
*) echo "Usage: $0 genee [-p EKU] cn keyname certname cakeyname cacertname" >&2
|
||||
return 1;;
|
||||
esac
|
||||
done
|
||||
|
||||
shift $((OPTIND - 1))
|
||||
local cn=$1; shift
|
||||
local key=$1; shift
|
||||
local cert=$1; shift
|
||||
local cakey=$1; shift
|
||||
local ca=$1; shift
|
||||
|
||||
exts=$(printf "%s\n%s\n%s\n%s\n%s\n[alts]\n%s\n" \
|
||||
"subjectKeyIdentifier = hash" \
|
||||
"authorityKeyIdentifier = keyid, issuer" \
|
||||
"basicConstraints = CA:false" \
|
||||
"extendedKeyUsage = $purpose" \
|
||||
"subjectAltName = @alts" "DNS=${cn}")
|
||||
csr=$(req "$key" "CN = $cn") || return 1
|
||||
echo "$csr" |
|
||||
cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
|
||||
-set_serial 2 -days "${DAYS}" "$@"
|
||||
}
|
||||
|
||||
geneenocsr() {
|
||||
local OPTIND=1
|
||||
local purpose=serverAuth
|
||||
|
||||
while getopts p: o
|
||||
do
|
||||
case $o in
|
||||
p) purpose="$OPTARG";;
|
||||
*) echo "Usage: $0 genee [-p EKU] cn certname cakeyname cacertname" >&2
|
||||
return 1;;
|
||||
esac
|
||||
done
|
||||
|
||||
shift $((OPTIND - 1))
|
||||
local cn=$1; shift
|
||||
local cert=$1; shift
|
||||
local cakey=$1; shift
|
||||
local ca=$1; shift
|
||||
|
||||
exts=$(printf "%s\n%s\n%s\n%s\n%s\n[alts]\n%s\n" \
|
||||
"subjectKeyIdentifier = hash" \
|
||||
"authorityKeyIdentifier = keyid, issuer" \
|
||||
"basicConstraints = CA:false" \
|
||||
"extendedKeyUsage = $purpose" \
|
||||
"subjectAltName = @alts" "DNS=${cn}")
|
||||
cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
|
||||
-set_serial 2 -days "${DAYS}" "$@"
|
||||
}
|
||||
|
||||
genss() {
|
||||
local cn=$1; shift
|
||||
local key=$1; shift
|
||||
local cert=$1; shift
|
||||
|
||||
exts=$(printf "%s\n%s\n%s\n%s\n%s\n[alts]\n%s\n" \
|
||||
"subjectKeyIdentifier = hash" \
|
||||
"authorityKeyIdentifier = keyid, issuer" \
|
||||
"basicConstraints = CA:false" \
|
||||
"extendedKeyUsage = serverAuth" \
|
||||
"subjectAltName = @alts" "DNS=${cn}")
|
||||
csr=$(req "$key" "CN = $cn") || return 1
|
||||
echo "$csr" |
|
||||
cert "$cert" "$exts" -signkey "${key}.pem" \
|
||||
-set_serial 1 -days "${DAYS}" "$@"
|
||||
}
|
||||
|
||||
gennocn() {
|
||||
local key=$1; shift
|
||||
local cert=$1; shift
|
||||
|
||||
csr=$(req_nocn "$key") || return 1
|
||||
echo "$csr" |
|
||||
cert "$cert" "" -signkey "${key}.pem" -set_serial 1 -days -1 "$@"
|
||||
}
|
||||
|
||||
"$@"
|
||||
Reference in New Issue
Block a user