1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
|
# Create test certificate authorities and certificates
# $Header: /cvsroot/aolserver/nsopenssl/ca/Makefile,v 1.2 2002/10/08 02:33:45 scottg Exp $
# In progress -- figure out if openssl will create the subdirs specified in the ca1.conf file,
# or if I have to manually do that here.
MKDIR = /bin/mkdir -p
TOUCH = /bin/touch
###############################################################################
# CA #1 - Web Server Certificate Signing
CA1 = ca1
ca1: ca1-dirs
@openssl genrsa -des3 \
-passout pass:$(CA1) \
-out $(CA1)/$(CA1).key \
1024
@openssl req -new -x509 -days 365 \
-config $(CA1).conf \
-passin pass:$(CA1) \
-key $(CA1)/$(CA1).key \
-out $(CA1)/$(CA1).pem
ca1-dirs:
@if [ ! -d $(CA1) ]; then \
$(MKDIR) $(CA1); \
$(MKDIR) $(CA1)/certificates; \
$(MKDIR) $(CA1)/keys; \
$(MKDIR) $(CA1)/csr; \
$(MKDIR) $(CA1)/crl; \
$(TOUCH) $(CA1)/index.txt; \
echo '01' > $(CA1)/serial; \
fi
###############################################################################
# CA #1 - Web Server Certificate
CA1_WEB_SERVER = ca1-web-server
ca1-web-server: ca1
@openssl genrsa \
-out $(CA1)/keys/$(CA1_WEB_SERVER).pem \
1024
@openssl req -new \
-config $(CA1).conf \
-key $(CA1)/keys/$(CA1_WEB_SERVER).pem \
-out $(CA1)/csr/$(CA1_WEB_SERVER).pem
@openssl ca \
-config $(CA1).conf \
-key $(CA1) \
-out $(CA1)/certificates/$(CA1_WEB_SERVER).pem \
-infiles $(CA1)/csr/$(CA1_WEB_SERVER).pem
@openssl verify \
-CAfile $(CA1)/$(CA1).pem \
$(CA1)/certificates/$(CA1_WEB_SERVER).pem
###############################################################################
# CA #2 - Client Certificate Signing
CA2 = ca2
CA2_ROOT = $(CA2)
ca2: ca2-dirs
@openssl genrsa -des3 \
-passout pass:$(CA2) \
-out $(CA2_ROOT)/$(CA2).key \
1024
@openssl req -new -x509 -days 365 \
-config $(CA2).conf \
-passin pass:$(CA2) \
-key $(CA2_ROOT)/$(CA2).key \
-out $(CA2_ROOT)/$(CA2).pem
ca2-dirs:
@if [ ! -d $(CA2_ROOT) ]; then \
$(MKDIR) $(CA2_ROOT); \
$(MKDIR) $(CA2_ROOT)/certificates; \
$(MKDIR) $(CA2_ROOT)/crl; \
fi
###############################################################################
### END
# Take a look at the key in readable format
#openssl rsa -noout -text -in ca.key
# Take a look at the certificate in readable format
#openssl x509 -noout -text -in ca.crt
|
