1#!/bin/sh
2
3OPENSSL=openssl
4
5CURVE=prime256v1
6DIGEST="-sha256"
7DIGEST_CA="-md sha256"
8
9echo
10echo "---[ Root CA ]----------------------------------------------------------"
11echo
12
13cat ec-ca-openssl.cnf |
14	sed "s/#@CN@/commonName_default = Suite B 128-bit Root CA/" \
15	> ec-ca-openssl.cnf.tmp
16$OPENSSL ecparam -out ec-ca.key -name $CURVE -genkey
17$OPENSSL req -config ec-ca-openssl.cnf.tmp -batch -x509 -new -key ec-ca.key -out ec-ca.pem -outform PEM -days 3650 $DIGEST
18mkdir -p ec-ca/certs ec-ca/crl ec-ca/newcerts ec-ca/private
19touch ec-ca/index.txt
20rm ec-ca-openssl.cnf.tmp
21
22echo
23echo "---[ Server ]-----------------------------------------------------------"
24echo
25
26cat ec-ca-openssl.cnf |
27	sed "s/#@CN@/commonName_default = server.w1.fi/" |
28	sed "s/#@ALTNAME@/subjectAltName=critical,DNS:server.w1.fi/" \
29	> ec-ca-openssl.cnf.tmp
30$OPENSSL ecparam -out ec-server.key -name $CURVE -genkey
31$OPENSSL req -config ec-ca-openssl.cnf.tmp -batch -new -nodes -key ec-server.key -out ec-server.req -outform PEM $DIGEST
32$OPENSSL ca -config ec-ca-openssl.cnf.tmp -batch -keyfile ec-ca.key -cert ec-ca.pem -create_serial -in ec-server.req -out ec-server.pem -extensions ext_server $DIGEST_CA
33rm ec-ca-openssl.cnf.tmp
34
35echo
36echo "---[ User ]-------------------------------------------------------------"
37echo
38
39cat ec-ca-openssl.cnf |
40	sed "s/#@CN@/commonName_default = user/" |
41	sed "s/#@ALTNAME@/subjectAltName=email:user@w1.fi/" \
42	> ec-ca-openssl.cnf.tmp
43$OPENSSL ecparam -out ec-user.key -name $CURVE -genkey
44$OPENSSL req -config ec-ca-openssl.cnf.tmp -batch -new -nodes -key ec-user.key -out ec-user.req -outform PEM -extensions ext_client $DIGEST
45$OPENSSL ca -config ec-ca-openssl.cnf.tmp -batch -keyfile ec-ca.key -cert ec-ca.pem -create_serial -in ec-user.req -out ec-user.pem -extensions ext_client $DIGEST_CA
46rm ec-ca-openssl.cnf.tmp
47
48echo
49echo "---[ Verify ]-----------------------------------------------------------"
50echo
51
52$OPENSSL verify -CAfile ec-ca.pem ec-server.pem
53$OPENSSL verify -CAfile ec-ca.pem ec-user.pem
54