Lines Matching +full:ca +full:- +full:certificates

4 # Use of this source code is governed by a BSD-style license that can be
7 # This script generates two chains of test certificates:
9 #     1. A (end-entity) -> B -> C -> D (self-signed root)
10 #     2. A (end-entity) -> B -> C2 (self-signed root)
12 # in which A, B, C, and D have distinct keypairs. C2 is a self-signed root
27 try rm -rf out
34   try /bin/sh -c "echo $serial > out/$i-serial"
39 try openssl genrsa -out out/A.key 2048
40 try openssl genrsa -out out/B.key 2048
41 try openssl genrsa -out out/C.key 2048
42 try openssl genrsa -out out/D.key 2048
45 CA_COMMON_NAME="D Root CA" \
48     -new \
49     -key out/D.key \
50     -out out/D.csr \
51     -config redundant-ca.cnf
54 CA_COMMON_NAME="D Root CA" \
56     -req -days 3650 \
57     -in out/D.csr \
58     -extensions ca_cert \
59     -extfile redundant-ca.cnf \
60     -signkey out/D.key \
61     -out out/D.pem \
62     -text
65 CA_COMMON_NAME="C CA" \
68     -new \
69     -key out/C.key \
70     -out out/C2.csr \
71     -config redundant-ca.cnf
74 CA_COMMON_NAME="C CA" \
76     -req -days 3650 \
77     -in out/C2.csr \
78     -extensions ca_cert \
79     -extfile redundant-ca.cnf \
80     -signkey out/C.key \
81     -out out/C2.pem \
82     -text
87   name="$i Intermediate CA"
88   CA_COMMON_NAME="$i CA" \
91       -new \
92       -key out/$i.key \
93       -out out/$i.csr \
94       -config redundant-ca.cnf
99 touch out/D-index.txt
100 CA_COMMON_NAME="D Root CA" \
102   try openssl ca \
103     -batch \
104     -extensions ca_cert \
105     -in out/C.csr \
106     -out out/C.pem \
107     -config redundant-ca.cnf
110 touch out/C-index.txt
111 CA_COMMON_NAME="C CA" \
113   try openssl ca \
114     -batch \
115     -extensions ca_cert \
116     -in out/B.csr \
117     -out out/B.pem \
118     -config redundant-ca.cnf
120 echo Generate the A end-entity CSR.
122   -new \
123   -key out/A.key \
124   -out out/A.csr \
125   -config ee.cnf
128 touch out/B-index.txt
129 CA_COMMON_NAME="B CA" \
131   try openssl ca \
132     -batch \
133     -extensions user_cert \
134     -in out/A.csr \
135     -out out/A.pem \
136     -config redundant-ca.cnf
139 try openssl pkcs8 -topk8 -nocrypt -in out/A.key -out out/A-pkcs8.key
141 echo Create redundant-server-chain.pem
142 try /bin/sh -c "cat out/A-pkcs8.key out/A.pem out/B.pem out/C.pem out/D.pem \
143     > ../certificates/redundant-server-chain.pem"
145 echo Create redundant-validated-chain.pem
146 try /bin/sh -c "cat out/A-pkcs8.key out/A.pem out/B.pem out/C2.pem \
147   > ../certificates/redundant-validated-chain.pem"
149 echo Create redundant-validated-chain-root.pem
150 try cp out/C2.pem ../certificates/redundant-validated-chain-root.pem