OLD | NEW |
| (Empty) |
1 #!/bin/sh | |
2 | |
3 # Copyright (c) 2013 The Chromium Authors. All rights reserved. | |
4 # Use of this source code is governed by a BSD-style license that can be | |
5 # found in the LICENSE file. | |
6 | |
7 # This script generates two chains of test certificates: | |
8 # 1. A1 (end-entity) -> B (self-signed root) | |
9 # 2. A2 (end-entity) -> B (self-signed root) | |
10 # | |
11 # In which A1 and A2 share the same key, the same subject common name, but have | |
12 # distinct O values in their subjects. | |
13 # | |
14 # This is used to test that NSS can properly generate unique certificate | |
15 # nicknames for both certificates. | |
16 | |
17 try () { | |
18 echo "$@" | |
19 "$@" || exit 1 | |
20 } | |
21 | |
22 try rm -rf out | |
23 try mkdir out | |
24 | |
25 echo Create the serial number and index files. | |
26 try /bin/sh -c "echo 01 > out/B-serial" | |
27 try touch out/B-index.txt | |
28 | |
29 echo Generate the keys. | |
30 try openssl genrsa -out out/A.key 2048 | |
31 try openssl genrsa -out out/B.key 2048 | |
32 | |
33 echo Generate the B CSR. | |
34 CA_COMMON_NAME="B Root CA" \ | |
35 CERTIFICATE=B \ | |
36 try openssl req \ | |
37 -new \ | |
38 -key out/B.key \ | |
39 -out out/B.csr \ | |
40 -config redundant-ca.cnf | |
41 | |
42 echo B signs itself. | |
43 CA_COMMON_NAME="B Root CA" \ | |
44 try openssl x509 \ | |
45 -req -days 3650 \ | |
46 -in out/B.csr \ | |
47 -extfile redundant-ca.cnf \ | |
48 -extensions ca_cert \ | |
49 -signkey out/B.key \ | |
50 -out out/B.pem | |
51 | |
52 echo Generate the A1 end-entity CSR. | |
53 SUBJECT_NAME=req_duplicate_cn_1 \ | |
54 try openssl req \ | |
55 -new \ | |
56 -key out/A.key \ | |
57 -out out/A1.csr \ | |
58 -config ee.cnf | |
59 | |
60 echo Generate the A2 end-entity CSR | |
61 SUBJECT_NAME=req_duplicate_cn_2 \ | |
62 try openssl req \ | |
63 -new \ | |
64 -key out/A.key \ | |
65 -out out/A2.csr \ | |
66 -config ee.cnf | |
67 | |
68 | |
69 echo B signs A1. | |
70 CA_COMMON_NAME="B CA" \ | |
71 CERTIFICATE=B \ | |
72 try openssl ca \ | |
73 -batch \ | |
74 -extensions user_cert \ | |
75 -in out/A1.csr \ | |
76 -out out/A1.pem \ | |
77 -config redundant-ca.cnf | |
78 | |
79 echo B signs A2. | |
80 CA_COMMON_NAME="B CA" \ | |
81 CERTIFICATE=B \ | |
82 try openssl ca \ | |
83 -batch \ | |
84 -extensions user_cert \ | |
85 -in out/A2.csr \ | |
86 -out out/A2.pem \ | |
87 -config redundant-ca.cnf | |
88 | |
89 echo Exporting the certificates to PKCS#12 | |
90 try openssl pkcs12 \ | |
91 -export \ | |
92 -inkey out/A.key \ | |
93 -in out/A1.pem \ | |
94 -out ../certificates/duplicate_cn_1.p12 \ | |
95 -passout pass:chrome | |
96 | |
97 try openssl pkcs12 \ | |
98 -export \ | |
99 -inkey out/A.key \ | |
100 -in out/A2.pem \ | |
101 -out ../certificates/duplicate_cn_2.p12 \ | |
102 -passout pass:chrome | |
103 | |
104 try cp out/A1.pem ../certificates/duplicate_cn_1.pem | |
105 try cp out/A2.pem ../certificates/duplicate_cn_2.pem | |
OLD | NEW |