| 1 | #!/bin/sh
|
|---|
| 2 | # Copyright 2013-2023 The OpenSSL Project Authors. All Rights Reserved.
|
|---|
| 3 | #
|
|---|
| 4 | # Licensed under the Apache License 2.0 (the "License"). You may not use
|
|---|
| 5 | # this file except in compliance with the License. You can obtain a copy
|
|---|
| 6 | # in the file LICENSE in the source distribution or at
|
|---|
| 7 | # https://www.openssl.org/source/license.html
|
|---|
| 8 |
|
|---|
| 9 | # Utility to recreate S/MIME certificates in this directory.
|
|---|
| 10 | # Invoke when changes are need from within this directory.
|
|---|
| 11 |
|
|---|
| 12 | OPENSSL=../../apps/openssl
|
|---|
| 13 | CONF=ca.cnf
|
|---|
| 14 | export OPENSSL_CONF=./$CONF
|
|---|
| 15 |
|
|---|
| 16 | gen() {
|
|---|
| 17 | $OPENSSL x509 -CA smroot.pem -new -days 36524 -force_pubkey $1 -subj "$2" \
|
|---|
| 18 | -extfile $CONF -extensions $3
|
|---|
| 19 | }
|
|---|
| 20 |
|
|---|
| 21 | # Root CA: create certificate directly
|
|---|
| 22 | CN="Test S/MIME RSA Root" $OPENSSL req -config ca.cnf -x509 -noenc \
|
|---|
| 23 | -keyout smroot.pem -out smroot.pem -key ../certs/ca-key.pem -days 36524
|
|---|
| 24 |
|
|---|
| 25 | # EE RSA certificates with respective extensions
|
|---|
| 26 | cp ../certs/ee-key.pem smrsa1.pem
|
|---|
| 27 | gen smrsa1.pem "/CN=Test SMIME EE RSA #1" usr_rsa_cert >>smrsa1.pem
|
|---|
| 28 | cp ../certs/ee-key-3072.pem smrsa2.pem
|
|---|
| 29 | gen smrsa2.pem "/CN=Test SMIME EE RSA #2" usr_rsa_cert >>smrsa2.pem
|
|---|
| 30 | cp ../certs/ee-key-4096.pem smrsa3.pem
|
|---|
| 31 | gen smrsa3.pem "/CN=Test SMIME EE RSA #3" usr_rsa_cert >>smrsa3.pem
|
|---|
| 32 |
|
|---|
| 33 | $OPENSSL x509 -in smrsa3.pem > smrsa3-cert.pem
|
|---|
| 34 | $OPENSSL pkey -in smrsa3.pem > smrsa3-key.pem
|
|---|
| 35 |
|
|---|
| 36 | # Create DSA certificates with respective extensions
|
|---|
| 37 |
|
|---|
| 38 | cp ../certs/server-dsa-key.pem smdsa1.pem
|
|---|
| 39 | gen smdsa1.pem "/CN=Test SMIME EE DSA #1" signer_cert >>smdsa1.pem
|
|---|
| 40 | cp ../certs/server-dsa-key.pem smdsa2.pem
|
|---|
| 41 | gen smdsa2.pem "/CN=Test SMIME EE DSA #1" signer_cert >>smdsa2.pem
|
|---|
| 42 | cp ../certs/server-dsa-key.pem smdsa3.pem
|
|---|
| 43 | gen smdsa3.pem "/CN=Test SMIME EE DSA #1" signer_cert >>smdsa3.pem
|
|---|
| 44 |
|
|---|
| 45 | # Create EC certificates with respective extensions
|
|---|
| 46 |
|
|---|
| 47 | cp ../certs/ee-ecdsa-key.pem smec1.pem
|
|---|
| 48 | gen smec1.pem "/CN=Test SMIME EE EC #1" signer_cert >>smec1.pem
|
|---|
| 49 | cp ../certs/server-ecdsa-key.pem smec2.pem
|
|---|
| 50 | gen smec2.pem "/CN=Test SMIME EE EC #2" signer_cert >>smec2.pem
|
|---|
| 51 |
|
|---|
| 52 | # Do not renew this cert as it is used for legacy data decrypt test
|
|---|
| 53 | #$OPENSSL ecparam -out ecp.pem -name P-256
|
|---|
| 54 | #CN="Test S/MIME EE EC #3" $OPENSSL req -config ca.cnf -noenc \
|
|---|
| 55 | # -keyout smec3.pem -out req.pem -newkey ec:ecp.pem
|
|---|
| 56 | #$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36524 \
|
|---|
| 57 | # -extfile ca.cnf -extensions signer_cert -CAcreateserial >>smec3.pem
|
|---|
| 58 | #rm ecp.pem req.pem
|
|---|
| 59 |
|
|---|
| 60 | # Create X9.42 DH parameters and key.
|
|---|
| 61 | $OPENSSL genpkey -genparam -algorithm DHX -out dhp.pem
|
|---|
| 62 | $OPENSSL genpkey -paramfile dhp.pem -out smdh.pem
|
|---|
| 63 | rm dhp.pem
|
|---|
| 64 | # Create X9.42 DH certificate with respective extensions
|
|---|
| 65 | gen smdh.pem "/CN=Test SMIME EE DH" dh_cert >>smdh.pem
|
|---|
| 66 |
|
|---|
| 67 | # EE RSA code signing end entity certificate with respective extensions
|
|---|
| 68 | cp ../certs/ee-key.pem csrsa1.pem
|
|---|
| 69 | gen csrsa1.pem "/CN=Test CodeSign EE RSA" codesign_cert >>csrsa1.pem
|
|---|
