net/data/ssl/scripts/generate-multi-root-test-chains.sh

   1 #!/bin/sh
   2
   3 # Copyright 2014 The Chromium Authors. All rights reserved.
   4 # Use of this source code is governed by a BSD-style license that can be
   5 # found in the LICENSE file.
   6
   7 # This script generates two chains of test certificates:
   8 #
   9 #     1. A (end-entity) -> B -> C -> D (self-signed root)
  10 #     2. A (end-entity) -> B -> C2 -> E (self-signed root)
  11 #
  12 # C and C2 have the same subject and keypair.
  13 #
  14 # We use these cert chains in CertVerifyProcChromeOSTest
  15 # to ensure that multiple verification paths are properly handled.
  16
  17 try () {
  18   echo "$@"
  19   "$@" || exit 1
  20 }
  21
  22 try rm -rf out
  23 try mkdir out
  24
  25 echo Create the serial number files.
  26 serial=1000
  27 for i in B C C2 D E
  28 do
  29   try /bin/sh -c "echo $serial > out/$i-serial"
  30   serial=$(expr $serial + 1)
  31 done
  32
  33 echo Generate the keys.
  34 try openssl genrsa -out out/A.key 2048
  35 try openssl genrsa -out out/B.key 2048
  36 try openssl genrsa -out out/C.key 2048
  37 try openssl genrsa -out out/D.key 2048
  38 try openssl genrsa -out out/E.key 2048
  39
  40 echo Generate the D CSR.
  41 CA_COMMON_NAME="D Root CA" \
  42   CERTIFICATE=D \
  43   try openssl req \
  44     -new \
  45     -key out/D.key \
  46     -out out/D.csr \
  47     -config redundant-ca.cnf
  48
  49 echo D signs itself.
  50 CA_COMMON_NAME="D Root CA" \
  51   try openssl x509 \
  52     -req -days 3650 \
  53     -in out/D.csr \
  54     -extensions ca_cert \
  55     -extfile redundant-ca.cnf \
  56     -signkey out/D.key \
  57     -out out/D.pem \
  58     -text
  59
  60 echo Generate the E CSR.
  61 CA_COMMON_NAME="E Root CA" \
  62   CERTIFICATE=E \
  63   try openssl req \
  64     -new \
  65     -key out/E.key \
  66     -out out/E.csr \
  67     -config redundant-ca.cnf
  68
  69 echo E signs itself.
  70 CA_COMMON_NAME="E Root CA" \
  71   try openssl x509 \
  72     -req -days 3650 \
  73     -in out/E.csr \
  74     -extensions ca_cert \
  75     -extfile redundant-ca.cnf \
  76     -signkey out/E.key \
  77     -out out/E.pem \
  78     -text
  79
  80 echo Generate the C2 intermediary CSR.
  81 CA_COMMON_NAME="C CA" \
  82   CERTIFICATE=C2 \
  83   try openssl req \
  84     -new \
  85     -key out/C.key \
  86     -out out/C2.csr \
  87     -config redundant-ca.cnf
  88
  89 echo Generate the B and C intermediaries\' CSRs.
  90 for i in B C
  91 do
  92   CA_COMMON_NAME="$i CA" \
  93     CERTIFICATE="$i" \
  94     try openssl req \
  95       -new \
  96       -key "out/$i.key" \
  97       -out "out/$i.csr" \
  98       -config redundant-ca.cnf
  99 done
 100
 101 echo D signs the C intermediate.
 102 # Make sure the signer's DB file exists.
 103 touch out/D-index.txt
 104 CA_COMMON_NAME="D Root CA" \
 105   CERTIFICATE=D \
 106   try openssl ca \
 107     -batch \
 108     -extensions ca_cert \
 109     -in out/C.csr \
 110     -out out/C.pem \
 111     -config redundant-ca.cnf
 112
 113 echo E signs the C2 intermediate.
 114 # Make sure the signer's DB file exists.
 115 touch out/E-index.txt
 116 CA_COMMON_NAME="E Root CA" \
 117   CERTIFICATE=E \
 118   try openssl ca \
 119     -batch \
 120     -extensions ca_cert \
 121     -in out/C2.csr \
 122     -out out/C2.pem \
 123     -config redundant-ca.cnf
 124
 125 echo C signs the B intermediate.
 126 touch out/C-index.txt
 127 CA_COMMON_NAME="C CA" \
 128   CERTIFICATE=C \
 129   try openssl ca \
 130     -batch \
 131     -extensions ca_cert \
 132     -in out/B.csr \
 133     -out out/B.pem \
 134     -config redundant-ca.cnf
 135
 136 echo Generate the A end-entity CSR.
 137 try openssl req \
 138   -new \
 139   -key out/A.key \
 140   -out out/A.csr \
 141   -config ee.cnf
 142
 143 echo B signs A.
 144 touch out/B-index.txt
 145 CA_COMMON_NAME="B CA" \
 146   CERTIFICATE=B \
 147   try openssl ca \
 148     -batch \
 149     -extensions user_cert \
 150     -in out/A.csr \
 151     -out out/A.pem \
 152     -config redundant-ca.cnf
 153
 154 echo Create multi-root-chain1.pem
 155 try /bin/sh -c "cat out/A.key out/A.pem out/B.pem out/C.pem out/D.pem \
 156     > ../certificates/multi-root-chain1.pem"
 157
 158 echo Create multi-root-chain2.pem
 159 try /bin/sh -c "cat out/A.key out/A.pem out/B.pem out/C2.pem out/E.pem \
 160     > ../certificates/multi-root-chain2.pem"
 161