mirror of
https://github.com/curl/curl.git
synced 2026-08-11 11:51:33 +03:00
tests/certs: cleanup
Keep only the generated files needed for tests. Place generated intermediaries in `tests/certs/gen` where they are ignored by git. No longer generated `*.dhp` files. Have a shorter naming scheme: `test-ca` instead of `EdelCurlRoot-ca` and `test-localhost` instead of `Server-localhost-sv`, etc. Remove the `stunnel` certificate as it was nearly a duplicate of `test-localhost`. No longer copy a generated certificates to `tests/stunnel.pem`. Let test server default to `certs/test-localhost.pem` instead. Closes #16593
This commit is contained in:
Stefan Eissing
Daniel Stenberg
parent
f5cb83e493
commit
556f722fe3
139 changed files with 2109 additions and 2629 deletions
|
|
@ -36,8 +36,11 @@ command -v "$OPENSSL"
|
|||
|
||||
USAGE='echo Usage is genroot.sh <name>'
|
||||
|
||||
HOME=$(pwd)
|
||||
cd "$HOME"
|
||||
SRCDIR=$(pwd)
|
||||
|
||||
GENDIR=${GENDIR:-$SRCDIR/gen}
|
||||
test -d "$GENDIR" || mkdir "$GENDIR"
|
||||
cd "$GENDIR"
|
||||
|
||||
KEYSIZE=2048
|
||||
DURATION=6000
|
||||
|
|
@ -51,8 +54,8 @@ if [ -z "$PREFIX" ]; then
|
|||
echo 'No configuration prefix'
|
||||
NOTOK=1
|
||||
else
|
||||
if [ ! -f "$PREFIX-ca.prm" ]; then
|
||||
echo "No configuration file $PREFIX-ca.prm"
|
||||
if [ ! -f "$SRCDIR/$PREFIX-ca.prm" ]; then
|
||||
echo "No configuration file $SRCDIR/$PREFIX-ca.prm"
|
||||
NOTOK=1
|
||||
fi
|
||||
fi
|
||||
|
|
@ -70,12 +73,15 @@ set -x
|
|||
"$OPENSSL" genrsa -out "$PREFIX-ca.key" -passout fd:0 "$KEYSIZE" <<EOF
|
||||
pass:secret
|
||||
EOF
|
||||
"$OPENSSL" req -config "$PREFIX-ca.prm" -new -key "$PREFIX-ca.key" -out "$PREFIX-ca.csr" -passin fd:0 <<EOF
|
||||
"$OPENSSL" req -config "$SRCDIR/$PREFIX-ca.prm" -new -key "$PREFIX-ca.key" -out "$PREFIX-ca.csr" -passin fd:0 <<EOF
|
||||
pass:secret
|
||||
EOF
|
||||
"$OPENSSL" x509 -extfile "$PREFIX-ca.prm" -days "$DURATION" -req -signkey "$PREFIX-ca.key" -in "$PREFIX-ca.csr" -out "$PREFIX-raw-ca.cacert" "$DIGESTALGO"
|
||||
"$OPENSSL" x509 -text -in "$PREFIX-raw-ca.cacert" -nameopt multiline > "$PREFIX-ca.cacert"
|
||||
"$OPENSSL" x509 -extfile "$SRCDIR/$PREFIX-ca.prm" -days "$DURATION" -req -signkey "$PREFIX-ca.key" -in "$PREFIX-ca.csr" -out "$PREFIX-ca.raw-cacert" "$DIGESTALGO"
|
||||
"$OPENSSL" x509 -text -in "$PREFIX-ca.raw-cacert" -nameopt multiline > "$PREFIX-ca.cacert"
|
||||
"$OPENSSL" x509 -in "$PREFIX-ca.cacert" -outform der -out "$PREFIX-ca.der"
|
||||
"$OPENSSL" x509 -in "$PREFIX-ca.cacert" -text -nameopt multiline > "$PREFIX-ca.crt"
|
||||
"$OPENSSL" x509 -noout -text -in "$PREFIX-ca.cacert" -nameopt multiline
|
||||
# "$OPENSSL" rsa -in "../keys/$PREFIX-ca.key" -text -noout -pubout
|
||||
|
||||
for ext in key cacert crt; do
|
||||
cp "$PREFIX-ca.$ext" "$SRCDIR"/
|
||||
done
|
||||
echo "ca root $PREFIX generated."
|
||||
|
|
|
|||
|
|
@ -36,8 +36,11 @@ command -v "$OPENSSL"
|
|||
|
||||
USAGE='echo Usage is genserv.sh <prefix> <caprefix>'
|
||||
|
||||
HOME=$(pwd)
|
||||
cd "$HOME"
|
||||
SRCDIR=$(pwd)
|
||||
|
||||
GENDIR=${GENDIR:-$SRCDIR/gen}
|
||||
test -d "$GENDIR" || mkdir "$GENDIR"
|
||||
cd "$GENDIR"
|
||||
|
||||
KEYSIZE=2048
|
||||
DURATION=300
|
||||
|
|
@ -46,7 +49,6 @@ DIGESTALGO=-sha256
|
|||
|
||||
REQ=YES
|
||||
P12=NO
|
||||
DHP=NO
|
||||
|
||||
NOTOK=
|
||||
|
||||
|
|
@ -55,8 +57,8 @@ if [ -z "$PREFIX" ]; then
|
|||
echo 'No configuration prefix'
|
||||
NOTOK=1
|
||||
else
|
||||
if [ ! -f "$PREFIX-sv.prm" ]; then
|
||||
echo "No configuration file $PREFIX-sv.prm"
|
||||
if [ ! -f "$SRCDIR/$PREFIX.prm" ]; then
|
||||
echo "No configuration file $SRCDIR/$PREFIX.prm"
|
||||
NOTOK=1
|
||||
fi
|
||||
fi
|
||||
|
|
@ -86,48 +88,44 @@ echo "PREFIX=$PREFIX CAPREFIX=$CAPREFIX DURATION=$DURATION KEYSIZE=$KEYSIZE"
|
|||
|
||||
set -x
|
||||
|
||||
if [ "$DHP" = YES ]; then
|
||||
"$OPENSSL" dhparam -2 -out "$PREFIX-sv.dhp" "$KEYSIZE"
|
||||
fi
|
||||
if [ "$REQ" = YES ]; then
|
||||
"$OPENSSL" req -config "$PREFIX-sv.prm" -newkey "rsa:$KEYSIZE" -keyout "$PREFIX-sv.key" -out "$PREFIX-sv.csr" -passout fd:0 <<EOF
|
||||
"$OPENSSL" req -config "$SRCDIR/$PREFIX.prm" -newkey "rsa:$KEYSIZE" -keyout "$PREFIX.key" -out "$PREFIX.csr" -passout fd:0 <<EOF
|
||||
pass:secret
|
||||
EOF
|
||||
fi
|
||||
|
||||
"$OPENSSL" rsa -in "$PREFIX-sv.key" -out "$PREFIX-sv.key" -passin fd:0 <<EOF
|
||||
"$OPENSSL" rsa -in "$PREFIX.key" -out "$PREFIX.key" -passin fd:0 <<EOF
|
||||
pass:secret
|
||||
EOF
|
||||
|
||||
echo 'pseudo secrets generated'
|
||||
|
||||
"$OPENSSL" rsa -in "$PREFIX-sv.key" -pubout -outform DER -out "$PREFIX-sv.pub.der"
|
||||
"$OPENSSL" rsa -in "$PREFIX-sv.key" -pubout -outform PEM -out "$PREFIX-sv.pub.pem"
|
||||
"$OPENSSL" x509 -extfile "$PREFIX-sv.prm" -days "$DURATION" -CA "$CAPREFIX-ca.cacert" -CAkey "$CAPREFIX-ca.key" -CAcreateserial -in "$PREFIX-sv.csr" -req -text -nameopt multiline "$DIGESTALGO" > "$PREFIX-sv.crt"
|
||||
"$OPENSSL" rsa -in "$PREFIX.key" -pubout -outform DER -out "$PREFIX.pub.der"
|
||||
"$OPENSSL" rsa -in "$PREFIX.key" -pubout -outform PEM -out "$PREFIX.pub.pem"
|
||||
"$OPENSSL" x509 -extfile "$SRCDIR/$PREFIX.prm" -days "$DURATION" -CA "$CAPREFIX-ca.cacert" -CAkey "$CAPREFIX-ca.key" -CAcreateserial -in "$PREFIX.csr" -req -text -nameopt multiline "$DIGESTALGO" > "$PREFIX.crt"
|
||||
|
||||
if [ "$P12" = YES ]; then
|
||||
"$OPENSSL" pkcs12 -export -des3 -out "$PREFIX-sv.p12" -caname "$CAPREFIX" -name "$PREFIX" -inkey "$PREFIX-sv.key" -in "$PREFIX-sv.crt" -certfile "$CAPREFIX-ca.crt"
|
||||
"$OPENSSL" pkcs12 -export -des3 -out "$PREFIX.p12" -caname "$CAPREFIX" -name "$PREFIX" -inkey "$PREFIX.key" -in "$PREFIX.crt" -certfile "$CAPREFIX-ca.crt"
|
||||
fi
|
||||
|
||||
"$OPENSSL" x509 -noout -text -hash -in "$PREFIX-sv.crt" -nameopt multiline
|
||||
"$OPENSSL" x509 -noout -text -hash -in "$PREFIX.crt" -nameopt multiline
|
||||
|
||||
# revoke server cert
|
||||
touch "$CAPREFIX-ca.db"
|
||||
echo 01 > "$CAPREFIX-ca.cnt"
|
||||
"$OPENSSL" ca -config "$CAPREFIX-ca.cnf" -revoke "$PREFIX-sv.crt"
|
||||
"$OPENSSL" ca -config "$SRCDIR/$CAPREFIX-ca.cnf" -revoke "$PREFIX.crt"
|
||||
|
||||
# issue CRL
|
||||
"$OPENSSL" ca -config "$CAPREFIX-ca.cnf" -gencrl -out "$PREFIX-sv.crl"
|
||||
"$OPENSSL" ca -config "$SRCDIR/$CAPREFIX-ca.cnf" -gencrl -out "$PREFIX.crl"
|
||||
|
||||
"$OPENSSL" x509 -in "$PREFIX-sv.crt" -outform der -out "$PREFIX-sv.der"
|
||||
"$OPENSSL" x509 -in "$PREFIX.crt" -outform der -out "$PREFIX.der"
|
||||
|
||||
# all together now
|
||||
touch "$PREFIX-sv.dhp"
|
||||
cat "$PREFIX-sv.prm" "$PREFIX-sv.key" "$PREFIX-sv.crt" "$PREFIX-sv.dhp" > "$PREFIX-sv.pem"
|
||||
chmod o-r "$PREFIX-sv.prm"
|
||||
cat "$SRCDIR/$PREFIX.prm" "$PREFIX.key" "$PREFIX.crt" > "$PREFIX.pem"
|
||||
chmod o-r "$SRCDIR/$PREFIX.prm"
|
||||
|
||||
"$OPENSSL" x509 -in "$PREFIX-sv.pem" -pubkey -noout | \
|
||||
"$OPENSSL" pkey -pubin -outform der | "$OPENSSL" dgst -sha256 -binary | \
|
||||
"$OPENSSL" enc -base64 > "$PREFIX-sv.pubkey-pinned"
|
||||
|
||||
echo "$PREFIX-sv.pem done"
|
||||
#for ext in crl crt csr der key pem pub.der pub.pem; do
|
||||
for ext in crl crt key pem pub.der pub.pem; do
|
||||
cp "$PREFIX.$ext" "$SRCDIR"/
|
||||
done
|
||||
echo "certificates for $PREFIX generated."
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue