OLD | NEW |
| (Empty) |
1 #!/bin/sh | |
2 | |
3 # Copyright 2014 The Chromium Authors. All rights reserved. | |
4 # Use of this source code is governed by a BSD-style license that can be | |
5 # found in the LICENSE file. | |
6 | |
7 # This script generates two chains of test certificates: | |
8 # | |
9 # 1. A (end-entity) -> B -> C -> D (self-signed root) | |
10 # 2. A (end-entity) -> B -> C2 -> E (self-signed root) | |
11 # | |
12 # C and C2 have the same subject and keypair. | |
13 # | |
14 # We use these cert chains in CertVerifyProcChromeOSTest | |
15 # to ensure that multiple verification paths are properly handled. | |
16 | |
17 try () { | |
18 echo "$@" | |
19 "$@" || exit 1 | |
20 } | |
21 | |
22 try rm -rf out | |
23 try mkdir out | |
24 | |
25 echo Create the serial number files. | |
26 serial=1000 | |
27 for i in B C C2 D E | |
28 do | |
29 try /bin/sh -c "echo $serial > out/$i-serial" | |
30 serial=$(expr $serial + 1) | |
31 done | |
32 | |
33 echo Generate the keys. | |
34 try openssl genrsa -out out/A.key 2048 | |
35 try openssl genrsa -out out/B.key 2048 | |
36 try openssl genrsa -out out/C.key 2048 | |
37 try openssl genrsa -out out/D.key 2048 | |
38 try openssl genrsa -out out/E.key 2048 | |
39 | |
40 echo Generate the D CSR. | |
41 CA_COMMON_NAME="D Root CA" \ | |
42 CERTIFICATE=D \ | |
43 try openssl req \ | |
44 -new \ | |
45 -key out/D.key \ | |
46 -out out/D.csr \ | |
47 -config redundant-ca.cnf | |
48 | |
49 echo D signs itself. | |
50 CA_COMMON_NAME="D Root CA" \ | |
51 try openssl x509 \ | |
52 -req -days 3650 \ | |
53 -in out/D.csr \ | |
54 -extensions ca_cert \ | |
55 -extfile redundant-ca.cnf \ | |
56 -signkey out/D.key \ | |
57 -out out/D.pem \ | |
58 -text | |
59 | |
60 echo Generate the E CSR. | |
61 CA_COMMON_NAME="E Root CA" \ | |
62 CERTIFICATE=E \ | |
63 try openssl req \ | |
64 -new \ | |
65 -key out/E.key \ | |
66 -out out/E.csr \ | |
67 -config redundant-ca.cnf | |
68 | |
69 echo E signs itself. | |
70 CA_COMMON_NAME="E Root CA" \ | |
71 try openssl x509 \ | |
72 -req -days 3650 \ | |
73 -in out/E.csr \ | |
74 -extensions ca_cert \ | |
75 -extfile redundant-ca.cnf \ | |
76 -signkey out/E.key \ | |
77 -out out/E.pem \ | |
78 -text | |
79 | |
80 echo Generate the C2 intermediary CSR. | |
81 CA_COMMON_NAME="C CA" \ | |
82 CERTIFICATE=C2 \ | |
83 try openssl req \ | |
84 -new \ | |
85 -key out/C.key \ | |
86 -out out/C2.csr \ | |
87 -config redundant-ca.cnf | |
88 | |
89 echo Generate the B and C intermediaries\' CSRs. | |
90 for i in B C | |
91 do | |
92 CA_COMMON_NAME="$i CA" \ | |
93 CERTIFICATE="$i" \ | |
94 try openssl req \ | |
95 -new \ | |
96 -key "out/$i.key" \ | |
97 -out "out/$i.csr" \ | |
98 -config redundant-ca.cnf | |
99 done | |
100 | |
101 echo D signs the C intermediate. | |
102 # Make sure the signer's DB file exists. | |
103 touch out/D-index.txt | |
104 CA_COMMON_NAME="D Root CA" \ | |
105 CERTIFICATE=D \ | |
106 try openssl ca \ | |
107 -batch \ | |
108 -extensions ca_cert \ | |
109 -in out/C.csr \ | |
110 -out out/C.pem \ | |
111 -config redundant-ca.cnf | |
112 | |
113 echo E signs the C2 intermediate. | |
114 # Make sure the signer's DB file exists. | |
115 touch out/E-index.txt | |
116 CA_COMMON_NAME="E Root CA" \ | |
117 CERTIFICATE=E \ | |
118 try openssl ca \ | |
119 -batch \ | |
120 -extensions ca_cert \ | |
121 -in out/C2.csr \ | |
122 -out out/C2.pem \ | |
123 -config redundant-ca.cnf | |
124 | |
125 echo C signs the B intermediate. | |
126 touch out/C-index.txt | |
127 CA_COMMON_NAME="C CA" \ | |
128 CERTIFICATE=C \ | |
129 try openssl ca \ | |
130 -batch \ | |
131 -extensions ca_cert \ | |
132 -in out/B.csr \ | |
133 -out out/B.pem \ | |
134 -config redundant-ca.cnf | |
135 | |
136 echo Generate the A end-entity CSR. | |
137 try openssl req \ | |
138 -new \ | |
139 -key out/A.key \ | |
140 -out out/A.csr \ | |
141 -config ee.cnf | |
142 | |
143 echo B signs A. | |
144 touch out/B-index.txt | |
145 CA_COMMON_NAME="B CA" \ | |
146 CERTIFICATE=B \ | |
147 try openssl ca \ | |
148 -batch \ | |
149 -extensions user_cert \ | |
150 -in out/A.csr \ | |
151 -out out/A.pem \ | |
152 -config redundant-ca.cnf | |
153 | |
154 echo Create multi-root-chain1.pem | |
155 try /bin/sh -c "cat out/A.key out/A.pem out/B.pem out/C.pem out/D.pem \ | |
156 > ../certificates/multi-root-chain1.pem" | |
157 | |
158 echo Create multi-root-chain2.pem | |
159 try /bin/sh -c "cat out/A.key out/A.pem out/B.pem out/C2.pem out/E.pem \ | |
160 > ../certificates/multi-root-chain2.pem" | |
161 | |
OLD | NEW |