1#!/bin/sh 2# Copyright 2013-2022 The OpenSSL Project Authors. All Rights Reserved. 3# 4# Licensed under the Apache License 2.0 (the "License"). You may not use 5# this file except in compliance with the License. You can obtain a copy 6# in the file LICENSE in the source distribution or at 7# https://www.openssl.org/source/license.html 8 9 10# Utility to recreate S/MIME certificates 11 12OPENSSL=../../apps/openssl 13OPENSSL_CONF=./ca.cnf 14export OPENSSL_CONF 15 16# Root CA: create certificate directly 17CN="Test S/MIME RSA Root" $OPENSSL req -config ca.cnf -x509 -noenc \ 18 -keyout smroot.pem -out smroot.pem -newkey rsa:2048 -days 36501 19 20# EE RSA certificates: create request first 21CN="Test S/MIME EE RSA #1" $OPENSSL req -config ca.cnf -noenc \ 22 -keyout smrsa1.pem -out req.pem -newkey rsa:2048 23# Sign request: end entity extensions 24$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 25 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa1.pem 26 27CN="Test S/MIME EE RSA #2" $OPENSSL req -config ca.cnf -noenc \ 28 -keyout smrsa2.pem -out req.pem -newkey rsa:2048 29$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 30 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa2.pem 31 32CN="Test S/MIME EE RSA #3" $OPENSSL req -config ca.cnf -noenc \ 33 -keyout smrsa3.pem -out req.pem -newkey rsa:2048 34$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 35 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa3.pem 36 37# Create DSA parameters 38 39$OPENSSL dsaparam -out dsap.pem 2048 40 41CN="Test S/MIME EE DSA #1" $OPENSSL req -config ca.cnf -noenc \ 42 -keyout smdsa1.pem -out req.pem -newkey dsa:dsap.pem 43$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 44 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa1.pem 45CN="Test S/MIME EE DSA #2" $OPENSSL req -config ca.cnf -noenc \ 46 -keyout smdsa2.pem -out req.pem -newkey dsa:dsap.pem 47$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 48 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa2.pem 49CN="Test S/MIME EE DSA #3" $OPENSSL req -config ca.cnf -noenc \ 50 -keyout smdsa3.pem -out req.pem -newkey dsa:dsap.pem 51$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 52 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa3.pem 53 54# Create EC parameters 55 56$OPENSSL ecparam -out ecp.pem -name P-256 57$OPENSSL ecparam -out ecp2.pem -name K-283 58 59CN="Test S/MIME EE EC #1" $OPENSSL req -config ca.cnf -noenc \ 60 -keyout smec1.pem -out req.pem -newkey ec:ecp.pem 61$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 62 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec1.pem 63CN="Test S/MIME EE EC #2" $OPENSSL req -config ca.cnf -noenc \ 64 -keyout smec2.pem -out req.pem -newkey ec:ecp2.pem 65$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 66 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec2.pem 67# Do not renew this cert as it is used for legacy data decrypt test 68#CN="Test S/MIME EE EC #3" $OPENSSL req -config ca.cnf -noenc \ 69# -keyout smec3.pem -out req.pem -newkey ec:ecp.pem 70#$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 71# -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec3.pem 72# Create X9.42 DH parameters. 73$OPENSSL genpkey -genparam -algorithm DHX -out dhp.pem 74# Generate X9.42 DH key. 75$OPENSSL genpkey -paramfile dhp.pem -out smdh.pem 76$OPENSSL pkey -pubout -in smdh.pem -out dhpub.pem 77# Generate dummy request. 78CN="Test S/MIME EE DH #1" $OPENSSL req -config ca.cnf -noenc \ 79 -keyout smtmp.pem -out req.pem -newkey rsa:2048 80# Sign request but force public key to DH 81$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 82 -force_pubkey dhpub.pem \ 83 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdh.pem 84# Remove temp files. 85rm -f req.pem ecp.pem ecp2.pem dsap.pem dhp.pem dhpub.pem smtmp.pem smroot.srl 86