1#!/bin/sh 2 3OPENSSL=openssl 4 5mkdir -p test-ca/newcerts 6 7echo 8echo "---[ DH parameters ]----------------------------------------------------" 9echo 10 11if [ -r dh.conf ]; then 12 echo "Use already generated dh.conf" 13else 14 openssl dhparam -out dh.conf 2048 15fi 16 17echo 18echo "---[ Root CA ]----------------------------------------------------------" 19echo 20 21if [ -r ca-key.pem ]; then 22 echo "Use already generated Root CA" 23else 24 cat openssl2.cnf | 25 sed "s/#@CN@/commonName_default = TEST - Incorrect Root CA/" \ 26 > ca-openssl.cnf.tmp 27 $OPENSSL req -config ca-openssl.cnf.tmp -batch -x509 -new -newkey rsa:2048 -nodes -keyout ca-incorrect-key.pem -out ca-incorrect.der -outform DER -days 3650 -sha256 28 $OPENSSL x509 -in ca-incorrect.der -inform DER -out ca-incorrect.pem -outform PEM -text 29 30 cat openssl2.cnf | 31 sed "s/#@CN@/commonName_default = Root CA/" \ 32 > ca-openssl.cnf.tmp 33 $OPENSSL req -config ca-openssl.cnf.tmp -batch -x509 -new -newkey rsa:2048 -nodes -keyout ca-key.pem -out ca.der -outform DER -days 3650 -sha256 34 $OPENSSL x509 -in ca.der -inform DER -out ca.pem -outform PEM -text 35 mkdir -p test-ca/certs test-ca/crl test-ca/newcerts test-ca/private 36 touch test-ca/index.txt 37 echo 01 > test-ca/crlnumber 38 cp ca.pem test-ca/cacert.pem 39 cp ca-key.pem test-ca/private/cakey.pem 40 $OPENSSL ca -config ca-openssl.cnf.tmp -gencrl -crldays 2922 -out crl.pem 41 cat ca.pem crl.pem > ca-and-crl.pem 42 faketime yesterday $OPENSSL ca -config ca-openssl.cnf.tmp -gencrl -crlhours 1 -out crl.pem 43 cat ca.pem crl.pem > ca-and-crl-expired.pem 44 rm crl.pem 45 rm ca-openssl.cnf.tmp 46fi 47 48echo 49echo "---[ Update server certificates ]---------------------------------------" 50echo 51 52cat openssl2.cnf | 53 sed "s/#@CN@/commonName_default = server.w1.fi/" | 54 sed "s/#@ALTNAME@/subjectAltName=DNS:server.w1.fi/" \ 55 > openssl.cnf.tmp 56if [ ! -r server.csr ]; then 57 $OPENSSL req -config openssl.cnf.tmp -batch -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr -outform PEM -sha256 58fi 59$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -in server.csr -out server.pem -extensions ext_server 60 61$OPENSSL pkcs12 -export -out server.pkcs12 -in server.pem -inkey server.key -passout pass: 62$OPENSSL pkcs12 -export -out server-extra.pkcs12 -in server.pem -inkey server.key -descert -certfile user.pem -passout pass:whatever -name server 63 64cat openssl2.cnf | 65 sed "s/#@CN@/commonName_default = server3.w1.fi/" \ 66 > openssl.cnf.tmp 67if [ ! -r server-no-dnsname.csr ]; then 68 $OPENSSL req -config openssl.cnf.tmp -batch -new -newkey rsa:2048 -nodes -keyout server-no-dnsname.key -out server-no-dnsname.csr -outform PEM -sha256 69fi 70$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -in server-no-dnsname.csr -out server-no-dnsname.pem -extensions ext_server 71 72cat openssl2.cnf | 73 sed "s/#@CN@/commonName_default = server4.w1.fi/" \ 74 > openssl.cnf.tmp 75if [ ! -r server-expired.csr ]; then 76 $OPENSSL req -config openssl.cnf.tmp -batch -new -newkey rsa:2048 -nodes -keyout server-expired.key -out server-expired.csr -outform PEM -sha256 77fi 78$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -in server-expired.csr -out server-expired.pem -extensions ext_server -startdate 200101000000Z -enddate 200102000000Z 79 80cat openssl2.cnf | 81 sed "s/#@CN@/commonName_default = server5.w1.fi/" \ 82 > openssl.cnf.tmp 83if [ ! -r server-eku-client.csr ]; then 84 $OPENSSL req -config openssl.cnf.tmp -batch -new -newkey rsa:2048 -nodes -keyout server-eku-client.key -out server-eku-client.csr -outform PEM -sha256 85fi 86$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -in server-eku-client.csr -out server-eku-client.pem -extensions ext_client 87 88cat openssl2.cnf | 89 sed "s/#@CN@/commonName_default = server6.w1.fi/" \ 90 > openssl.cnf.tmp 91if [ ! -r server-eku-client-server.csr ]; then 92 $OPENSSL req -config openssl.cnf.tmp -batch -new -newkey rsa:2048 -nodes -keyout server-eku-client-server.key -out server-eku-client-server.csr -outform PEM -sha256 93fi 94$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -in server-eku-client-server.csr -out server-eku-client-server.pem -extensions ext_client_server 95 96cat openssl2.cnf | 97 sed "s/#@CN@/commonName_default = server7.w1.fi/" \ 98 > openssl.cnf.tmp 99if [ ! -r server-long-duration.csr ]; then 100 $OPENSSL req -config openssl.cnf.tmp -batch -new -newkey rsa:4096 -nodes -keyout server-long-duration.key -out server-long-duration.csr -outform PEM -sha256 101fi 102$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -in server-long-duration.csr -out server-long-duration.pem -extensions ext_server -days 18250 103 104cat openssl2.cnf | 105 sed "s/#@CN@/commonName_default = server-policies.w1.fi/" | 106 sed "s/#@ALTNAME@/subjectAltName=DNS:server-policies.w1.fi/" | 107 sed "s/#@CERTPOL@/certificatePolicies = 1.3.6.1.4.1.40808.1.3.1/" \ 108 > openssl.cnf.tmp 109if [ ! -r server-certpol.csr ]; then 110 $OPENSSL req -config openssl.cnf.tmp -batch -new -newkey rsa:3072 -nodes -keyout server-certpol.key -out server-certpol.csr -outform PEM -sha256 111fi 112$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -in server-certpol.csr -out server-certpol.pem -extensions ext_server 113 114cat openssl2.cnf | 115 sed "s/#@CN@/commonName_default = server-policies2.w1.fi/" | 116 sed "s/#@ALTNAME@/subjectAltName=DNS:server-policies2.w1.fi/" | 117 sed "s/#@CERTPOL@/certificatePolicies = 1.3.6.1.4.1.40808.1.3.2/" \ 118 > openssl.cnf.tmp 119if [ ! -r server-certpol2.csr ]; then 120 $OPENSSL req -config openssl.cnf.tmp -batch -new -newkey rsa:3072 -nodes -keyout server-certpol2.key -out server-certpol2.csr -outform PEM -sha256 121fi 122$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -in server-certpol2.csr -out server-certpol2.pem -extensions ext_server 123 124echo 125echo "---[ Update user certificates ]-----------------------------------------" 126echo 127 128cat openssl2.cnf | sed "s/#@CN@/commonName_default = Test User/" > openssl.cnf.tmp 129if [ ! -r user.csr ]; then 130 $OPENSSL req -config openssl.cnf.tmp -batch -new -newkey rsa:2048 -nodes -keyout user.key -out user.csr -outform PEM -sha256 131 $OPENSSL rsa -in user.key -out user.rsa-key 132 $OPENSSL pkcs8 -topk8 -in user.key -out user.key.pkcs8 -inform PEM -v2 des-ede3-cbc -v2prf hmacWithSHA1 -passout pass:whatever 133 $OPENSSL pkcs8 -topk8 -in user.key -out user.key.pkcs8.pkcs5v15 -inform PEM -v1 pbeWithMD5AndDES-CBC -passout pass:whatever 134fi 135 136$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -in user.csr -out user.pem -extensions ext_client 137rm openssl.cnf.tmp 138 139$OPENSSL pkcs12 -export -out user.pkcs12 -in user.pem -inkey user.key -descert -passout pass:whatever 140$OPENSSL pkcs12 -export -out user2.pkcs12 -in user.pem -inkey user.key -descert -name Test -certfile server.pem -passout pass:whatever 141$OPENSSL pkcs12 -export -out user3.pkcs12 -in user.pem -inkey user.key -descert -name "my certificates" -certfile ca.pem -passout pass:whatever 142 143echo 144echo "---[ Update OCSP ]------------------------------------------------------" 145echo 146 147cat openssl2.cnf | 148 sed "s/#@CN@/commonName_default = ocsp.w1.fi/" \ 149 > openssl.cnf.tmp 150if [ ! -r ocsp-responder.csr ]; then 151 $OPENSSL req -config openssl.cnf.tmp -batch -new -newkey rsa:2048 -nodes -keyout ocsp-responder.key -out ocsp-responder.csr -outform PEM -sha256 152fi 153$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -in ocsp-responder.csr -out ocsp-responder.pem -extensions v3_OCSP 154 155$OPENSSL ocsp -CAfile test-ca/cacert.pem -issuer test-ca/cacert.pem -cert server.pem -reqout ocsp-req.der -no_nonce 156$OPENSSL ocsp -index test-ca/index.txt -rsigner test-ca/cacert.pem -rkey test-ca/private/cakey.pem -CA test-ca/cacert.pem -resp_no_certs -reqin ocsp-req.der -respout ocsp-server-cache.der 157SIZ=`ls -l ocsp-server-cache.der | cut -f5 -d' '` 158(echo -n 000; echo "obase=16;$SIZ" | bc) | xxd -r -ps > ocsp-multi-server-cache.der 159cat ocsp-server-cache.der >> ocsp-multi-server-cache.der 160 161echo 162echo "---[ Additional steps ]-------------------------------------------------" 163echo 164 165rm ca-openssl.cnf.tmp 166 167echo "test_ap_eap.py: ap_wpa2_eap_ttls_server_cert_hash srv_cert_hash" 168 169$OPENSSL x509 -in server.pem -out server.der -outform DER 170HASH=`sha256sum server.der | cut -f1 -d' '` 171rm server.der 172sed -i "s/srv_cert_hash =.*/srv_cert_hash = \"$HASH\"/" ../test_ap_eap.py 173 174echo "index.txt: server time+serial" 175 176grep -v CN=server.w1.fi index.txt > index.txt.new 177grep CN=server.w1.fi test-ca/index.txt | tail -1 >> index.txt.new 178mv index.txt.new index.txt 179 180echo "start.sh: openssl ocsp -reqout serial" 181 182SERIAL=`grep CN=server.w1.fi test-ca/index.txt | tail -1 | cut -f4` 183sed -i "s/'-serial', '0x[^']*'/'-serial', '0x$SERIAL'/" ../test_ap_eap.py 184