1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
|
#!/usr/bin/env bash
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0
# immediately bail if any command fails
set -e
echo "generating CA"
openssl req -new -noenc -x509 \
-newkey ec \
-pkeyopt ec_paramgen_curve:P-384 \
-keyout ca-key.pem \
-out ca-cert.pem \
-days 65536 \
-SHA384 \
-subj "/C=US/CN=root" \
-addext "basicConstraints = critical,CA:true" \
-addext "keyUsage = critical,keyCertSign"
echo "generating wombat private key and CSR"
openssl req -new -noenc \
-newkey ec \
-pkeyopt ec_paramgen_curve:P-384 \
-keyout wombat-key.pem \
-out wombat.csr \
-subj "/C=US/CN=wombat" \
-addext "subjectAltName = DNS:www.wombat.com"
echo "generating kangaroo private key and CSR"
openssl req -new -noenc \
-newkey ec \
-pkeyopt ec_paramgen_curve:P-384 \
-keyout kangaroo-key.pem \
-out kangaroo.csr \
-subj "/C=US/CN=kangaroo" \
-addext "subjectAltName = DNS:www.kangaroo.com"
echo "generating localhost private key and CSR"
openssl req -new -noenc \
-newkey ec \
-pkeyopt ec_paramgen_curve:P-384 \
-keyout localhost-key.pem \
-out localhost.csr \
-subj "/C=US/CN=localhost" \
-addext "subjectAltName = DNS:localhost"
echo "generating wombat server certificate and signing it"
openssl x509 -days 65536 \
-req -in wombat.csr \
-SHA384 \
-CA ca-cert.pem \
-CAkey ca-key.pem \
-CAcreateserial \
-out wombat-cert.pem \
-copy_extensions=copyall
echo "generating kangaroo certificate and signing it"
openssl x509 -days 65536 \
-req -in kangaroo.csr \
-SHA384 \
-CA ca-cert.pem \
-CAkey ca-key.pem \
-CAcreateserial \
-out kangaroo-cert.pem \
-copy_extensions=copyall
echo "generating localhost certificate and signing it"
openssl x509 -days 65536 \
-req -in localhost.csr \
-SHA384 \
-CA ca-cert.pem \
-CAkey ca-key.pem \
-CAcreateserial \
-out localhost-cert.pem \
-copy_extensions=copyall
touch wombat-chain.pem
cat wombat-cert.pem >> wombat-chain.pem
cat ca-cert.pem >> wombat-chain.pem
touch kangaroo-chain.pem
cat kangaroo-cert.pem >> kangaroo-chain.pem
cat ca-cert.pem >> kangaroo-chain.pem
touch localhost-chain.pem
cat localhost-cert.pem >> localhost-chain.pem
cat ca-cert.pem >> localhost-chain.pem
echo "verifying server certificates"
openssl verify -CAfile ca-cert.pem wombat-cert.pem
openssl verify -CAfile ca-cert.pem kangaroo-cert.pem
openssl verify -CAfile ca-cert.pem localhost-cert.pem
# certificate signing requests are never used after the certs are generated
rm wombat.csr
rm kangaroo.csr
rm localhost.csr
rm ca-cert.srl
# the private keys of the CA are never needed after signing
rm ca-key.pem
rm wombat-cert.pem
rm kangaroo-cert.pem
rm localhost-cert.pem
|
