-
Notifications
You must be signed in to change notification settings - Fork 1
/
init-test-data.sh
executable file
·337 lines (259 loc) · 8.84 KB
/
init-test-data.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
#!/usr/bin/env bash
SCRIPT_ROOT=$(cd $(dirname $0); pwd)
export MY_CA_ROOT_DIR=$SCRIPT_ROOT/temp
# Start generating the Root CA.
rm -rf $MY_CA_ROOT_DIR
rm -f $SCRIPT_ROOT/docker/nginx/*.pem
mkdir -p $MY_CA_ROOT_DIR
cd $MY_CA_ROOT_DIR
mkdir -p $MY_CA_ROOT_DIR/{certs,crl,csr,newcerts,private}
MY_CA_RAND_FILE=$MY_CA_ROOT_DIR/.rand
mkdir -p newcerts crl
touch index.txt
openssl rand -out $MY_CA_RAND_FILE 65535
md5sum $MY_CA_RAND_FILE | grep -Po '^\w+' > serial
openssl rand -out $MY_CA_RAND_FILE 1048576
MY_CA_ROOT_KEY_PATH=$MY_CA_ROOT_DIR/root-key.pem
openssl genrsa \
-rand $MY_CA_RAND_FILE \
-out $MY_CA_ROOT_KEY_PATH \
4096
MY_CA_ROOT_REQ_PATH=$MY_CA_ROOT_DIR/req.cnf
cat > $MY_CA_ROOT_REQ_PATH << EOL
[ req ]
distinguished_name = req_distinguished_name
string_mask = utf8only
prompt = no
# SHA-1 is deprecated, so use SHA-2 instead.
default_md = sha384
# Extension to add when the -x509 option is used.
x509_extensions = v3_ca
req_extensions = v3_ca
[ req_distinguished_name ]
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
countryName = CN
0.organizationName = LiteRT ORG
organizationalUnitName = ca.litert.org
commonName = LiteRT CA R1
[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
EOL
MY_CA_ROOT_CERT_PATH=$MY_CA_ROOT_DIR/ca.pem
openssl req -config $MY_CA_ROOT_REQ_PATH \
-new \
-x509 \
-extensions v3_ca \
-days 10950 \
-key $MY_CA_ROOT_KEY_PATH \
-out $MY_CA_ROOT_CERT_PATH
openssl x509 -noout -text -in $MY_CA_ROOT_CERT_PATH
MY_CA_ROOT_CONF_PATH=$MY_CA_ROOT_DIR/ca.cnf
cat > $MY_CA_ROOT_CONF_PATH << EOL
[ ca ]
default_ca = CA_default
[ CA_default ]
# Directory and file locations.
dir = $MY_CA_ROOT_DIR
certs = \$dir/certs
crl_dir = \$dir/crl
new_certs_dir = \$dir/newcerts
database = \$dir/index.txt
serial = \$dir/serial
RANDFILE = \$dir/.rand
# The root key and root certificate.
private_key = \$dir/root-key.pem
certificate = \$dir/ca.pem
# For certificate revocation lists.
crlnumber = \$dir/crlnumber
crl = \$dir/crl/ca.crl.pem
crl_extensions = crl_ext
default_crl_days = 30
copy_extensions = copy
# SHA-1 is deprecated, so use SHA-2 instead.
default_md = sha256
name_opt = ca_default
cert_opt = ca_default
default_days = 375
preserve = no
policy = policy_loose
# [ policy_strict ]
# # The root CA should only sign intermediate certificates that match.
# countryName = match
# stateOrProvinceName = optional
# organizationName = match
# organizationalUnitName = optional
# commonName = supplied
# emailAddress = optional
[ policy_loose ]
# Allow the intermediate CA to sign a more diverse range of certificates.
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ req ]
default_bits = 4096
distinguished_name = req_distinguished_name
string_mask = utf8only
prompt = no
# SHA-1 is deprecated, so use SHA-2 instead.
default_md = sha384
# Extension to add when the -x509 option is used.
x509_extensions = v3_ca
[ req_distinguished_name ]
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
countryName = CN
0.organizationName = LiteRT ORG
organizationalUnitName = ca.litert.org
commonName = LiteRT CA R1
[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
extendedKeyUsage = critical, clientAuth, serverAuth
[ v3_intermediate_ca ]
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
extendedKeyUsage = critical, clientAuth, serverAuth
basicConstraints = critical, CA:true, pathlen:0
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
# authorityInfoAccess = caIssuers;URI:http://demo.org/ca.html
# crlDistributionPoints = URI:http://demo.org/ca.crl
# certificatePolicies = 2.23.140.1.2.1,@policy_issuer_info
# [ policy_issuer_info ]
# policyIdentifier = 1.3.6.1.4.1.44947.1.2.3.4.5.6.7.8
[ client_cert ]
# Extensions for client certificates (man x509v3_config).
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth
[ server_cert ]
# Extensions for server certificates (man x509v3_config).
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
[ crl_ext ]
authorityKeyIdentifier=keyid:always
[ ocsp ]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, OCSPSigning
EOL
echo 'unique_subject = no' > $MY_CA_ROOT_DIR/index.txt.attr
# Generate server certification
MY_CA_L2_DIR=$MY_CA_ROOT_DIR
NEW_CERT_DOMAIN=lwdfx-tls-server
NEW_SERVER_KEY_PATH=$MY_CA_L2_DIR/private/server-$NEW_CERT_DOMAIN.key.pem
openssl ecparam -rand $MY_CA_L2_DIR/.rand -genkey -name prime256v1 -noout -out $NEW_SERVER_KEY_PATH
NEW_SERVER_CERT_REQ_PATH=$MY_CA_L2_DIR/csr/server-$NEW_CERT_DOMAIN.csr.cnf
cat > $NEW_SERVER_CERT_REQ_PATH << EOL
[ req ]
distinguished_name = req_distinguished_name
string_mask = utf8only
req_extensions = req_ext
x509_extensions = v3_req
# SHA-1 is deprecated, so use SHA-2 instead.
default_md = sha256
prompt = no
[ req_distinguished_name ]
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
commonName = $NEW_CERT_DOMAIN
[req_ext]
subjectAltName = @alt_names
[v3_req]
subjectAltName = @alt_names
[alt_names]
# IP.1 = 127.0.0.1
DNS.1 = $NEW_CERT_DOMAIN
EOL
NEW_SERVER_CERT_CSR_PATH=$MY_CA_L2_DIR/csr/server-$NEW_CERT_DOMAIN.csr.pem
openssl req \
-config $NEW_SERVER_CERT_REQ_PATH \
-new -sha256 \
-key $NEW_SERVER_KEY_PATH \
-out $NEW_SERVER_CERT_CSR_PATH
openssl req \
-in $NEW_SERVER_CERT_CSR_PATH \
-noout \
-text
NEW_SERVER_CERT_PATH=$MY_CA_L2_DIR/newcerts/server-$NEW_CERT_DOMAIN.cert.pem
openssl ca \
-config $MY_CA_L2_DIR/ca.cnf \
-extensions server_cert \
-days 180 \
-notext \
-md sha256 \
-batch \
-in $NEW_SERVER_CERT_CSR_PATH \
-out $NEW_SERVER_CERT_PATH
NEW_SERVER_FULLCHAIN_PATH=$MY_CA_L2_DIR/newcerts/server-$NEW_CERT_DOMAIN.fullchain.pem
cat > $NEW_SERVER_FULLCHAIN_PATH << EOL
$(cat $NEW_SERVER_CERT_PATH)
$(cat $MY_CA_L2_DIR/ca.pem)
EOL
cp $NEW_SERVER_FULLCHAIN_PATH $SCRIPT_ROOT/docker/nginx/
cp $NEW_SERVER_KEY_PATH $SCRIPT_ROOT/docker/nginx/
# Generate Nginx certification
NEW_CERT_DOMAIN=lwdfx-nginx
NEW_SERVER_KEY_PATH=$MY_CA_L2_DIR/private/server-$NEW_CERT_DOMAIN.key.pem
openssl ecparam -rand $MY_CA_L2_DIR/.rand -genkey -name prime256v1 -noout -out $NEW_SERVER_KEY_PATH
NEW_SERVER_CERT_REQ_PATH=$MY_CA_L2_DIR/csr/server-$NEW_CERT_DOMAIN.csr.cnf
cat > $NEW_SERVER_CERT_REQ_PATH << EOL
[ req ]
distinguished_name = req_distinguished_name
string_mask = utf8only
req_extensions = req_ext
x509_extensions = v3_req
# SHA-1 is deprecated, so use SHA-2 instead.
default_md = sha256
prompt = no
[ req_distinguished_name ]
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
commonName = $NEW_CERT_DOMAIN
[req_ext]
subjectAltName = @alt_names
[v3_req]
subjectAltName = @alt_names
[alt_names]
# IP.1 = 127.0.0.1
DNS.1 = $NEW_CERT_DOMAIN
EOL
NEW_SERVER_CERT_CSR_PATH=$MY_CA_L2_DIR/csr/server-$NEW_CERT_DOMAIN.csr.pem
openssl req \
-config $NEW_SERVER_CERT_REQ_PATH \
-new -sha256 \
-key $NEW_SERVER_KEY_PATH \
-out $NEW_SERVER_CERT_CSR_PATH
openssl req \
-in $NEW_SERVER_CERT_CSR_PATH \
-noout \
-text
NEW_SERVER_CERT_PATH=$MY_CA_L2_DIR/newcerts/server-$NEW_CERT_DOMAIN.cert.pem
openssl ca \
-config $MY_CA_L2_DIR/ca.cnf \
-extensions server_cert \
-days 180 \
-notext \
-md sha256 \
-batch \
-in $NEW_SERVER_CERT_CSR_PATH \
-out $NEW_SERVER_CERT_PATH
NEW_SERVER_FULLCHAIN_PATH=$MY_CA_L2_DIR/newcerts/server-$NEW_CERT_DOMAIN.fullchain.pem
cat > $NEW_SERVER_FULLCHAIN_PATH << EOL
$(cat $NEW_SERVER_CERT_PATH)
$(cat $MY_CA_L2_DIR/ca.pem)
EOL
cp $NEW_SERVER_FULLCHAIN_PATH $SCRIPT_ROOT/docker/nginx/
cp $NEW_SERVER_KEY_PATH $SCRIPT_ROOT/docker/nginx/