From d0d3c760a338e1e4adb64dafa868cbf215edd4d1 Mon Sep 17 00:00:00 2001
From: Slawomir Koszewski <slawek@koszewscy.waw.pl>
Date: Sat, 17 Oct 2026 16:23:19 +0200
Subject: [PATCH] Added manual certificate creation examples.

---
 README.md     |  17 +------
 make_certs.sh | 124 ++++++++++++++++++++++++++++++++++++++++++++++++++
 show_certs.sh |   6 +++
 3 files changed, 132 insertions(+), 15 deletions(-)
 create mode 100755 make_certs.sh
 create mode 100755 show_certs.sh

diff --git a/README.md b/README.md
index 9551725..1ac0b05 100644
--- a/README.md
+++ b/README.md
@@ -262,19 +262,6 @@ python3 generate-mobileconfig.py \
     --output alice-vpn.mobileconfig
 ```
 
----
+## Example commands
 
-## Self-signed certificate
-
-The following command creates a full-featured self-signed certificate usable as a CA and for client/server authentication:
-
-```bash
-openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-    -keyout "key.pem" \
-    -out "cert.pem" \
-    -subj "/CN=<user name>/O=<user organization>/C=<CC>" \
-    -addext "basicConstraints=critical,CA:TRUE" \
-    -addext "keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign,cRLSign" \
-    -addext "extendedKeyUsage=serverAuth,clientAuth" \
-    -addext "subjectAltName=DNS:<computer_name>"
-```
+Sometimes it is necessary to use customized scripts for a specific environment. Look at ready  to customize and use examples in `make_certs.sh`. `show_certs.sh` displays essential certifcate information for all PEM files in the current working directory.
diff --git a/make_certs.sh b/make_certs.sh
new file mode 100755
index 0000000..5063f30
--- /dev/null
+++ b/make_certs.sh
@@ -0,0 +1,124 @@
+# Root CA certificate
+openssl req \
+    -x509 \
+    -newkey rsa:4096 \
+    -keyout ca_key.pem \
+    -out ca_cert.pem \
+    -days 3650 \
+    -noenc \
+    -subj "/CN=Test CA $(date +"%Y-%m-%d")" \
+    -text \
+    -addext "basicConstraints=critical,CA:TRUE,pathlen:1" \
+    -addext "keyUsage=critical,keyCertSign,cRLSign"
+
+# Issuing CA certificate
+openssl req \
+    -newkey rsa:4096 \
+    -keyout issuing_ca_key.pem \
+    -noenc \
+    -subj "/CN=Issuing Test CA $(date +"%Y-%m-%d")" \
+    -addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
+    -addext "keyUsage=critical,keyCertSign,cRLSign" |
+    openssl x509 \
+        -req \
+        -CA ca_cert.pem \
+        -CAkey ca_key.pem \
+        -copy_extensions copyall \
+        -days 3650 \
+        -text \
+        -out issuing_ca_cert.pem
+
+# Client signing request
+openssl req \
+    -newkey rsa:4096 \
+    -keyout client_key.pem \
+    -out client_req.pem \
+    -noenc \
+    -subj "/CN=Test Client" \
+    -addext "basicConstraints=critical,CA:FALSE" \
+    -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
+    -addext "extendedKeyUsage=clientAuth"
+
+# Server signing request
+openssl req \
+    -newkey rsa:4096 \
+    -keyout server_key.pem \
+    -out server_req.pem \
+    -noenc \
+    -subj "/CN=test.example.com" \
+    -addext "basicConstraints=critical,CA:FALSE" \
+    -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
+    -addext "extendedKeyUsage=serverAuth" \
+    -addext "subjectAltName=DNS:test.example.com,DNS:test,IP:127.0.0.1"
+
+# User signing request
+openssl req \
+    -newkey rsa:4096 \
+    -keyout user_key.pem \
+    -out user_req.pem \
+    -noenc \
+    -subj "/CN=Test User/emailAddress=testuser@example.com" \
+    -addext "basicConstraints=critical,CA:FALSE" \
+    -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
+    -addext "extendedKeyUsage=clientAuth,emailProtection,codeSigning" \
+    -addext "subjectAltName=email:alias@example.com"
+
+# Sign client certificate with issuing CA
+openssl x509 \
+    -req \
+    -in client_req.pem \
+    -CA issuing_ca_cert.pem \
+    -CAkey issuing_ca_key.pem \
+    -copy_extensions copyall \
+    -days 365 \
+    -out client_cert.pem
+
+# Sign server certificate with issuing CA
+openssl x509 \
+    -req \
+    -in server_req.pem \
+    -CA issuing_ca_cert.pem \
+    -CAkey issuing_ca_key.pem \
+    -copy_extensions copyall \
+    -days 365 \
+    -out server_cert.pem
+
+# Sign user certificate with issuing CA
+openssl x509 \
+    -req \
+    -in user_req.pem \
+    -CA issuing_ca_cert.pem \
+    -CAkey issuing_ca_key.pem \
+    -copy_extensions copyall \
+    -days 365 \
+    -out user_cert.pem
+
+# Certificate chain for PKCS#12 bundles
+cat issuing_ca_cert.pem ca_cert.pem > ca_chain.pem
+
+# Client PKCS#12 bundle
+openssl pkcs12 \
+    -export \
+    -out client.pfx \
+    -inkey client_key.pem \
+    -in client_cert.pem \
+    -certfile ca_chain.pem \
+    -passout pass:changeit
+
+# Server PKCS#12 bundle
+openssl pkcs12 \
+    -export \
+    -out server.pfx \
+    -inkey server_key.pem \
+    -in server_cert.pem \
+    -certfile ca_chain.pem \
+    -passout pass:changeit
+
+# User PKCS#12 bundle
+openssl pkcs12 \
+    -export \
+    -out user.pfx \
+    -inkey user_key.pem \
+    -in user_cert.pem \
+    -certfile ca_chain.pem \
+    -passout pass:changeit
diff --git a/show_certs.sh b/show_certs.sh
new file mode 100755
index 0000000..a1ba6e8
--- /dev/null
+++ b/show_certs.sh
@@ -0,0 +1,6 @@
+# Show all certificates
+for cert in *_cert.pem; do
+    echo "Certificate: $cert"
+    openssl x509 -noout -subject -issuer -fingerprint -email -ext subjectAltName -in $cert
+    echo ""
+done