125 lines
3.2 KiB
Bash
Executable File
125 lines
3.2 KiB
Bash
Executable File
# Root CA certificate
|
|
openssl req \
|
|
-x509 \
|
|
-newkey rsa:4096 \
|
|
-keyout ca_key.pem \
|
|
-out ca_cert.pem \
|
|
-days 3650 \
|
|
-noenc \
|
|
-subj "/CN=Test CA $(date +"%Y-%m-%d")" \
|
|
-text \
|
|
-addext "basicConstraints=critical,CA:TRUE,pathlen:1" \
|
|
-addext "keyUsage=critical,keyCertSign,cRLSign"
|
|
|
|
# Issuing CA certificate
|
|
openssl req \
|
|
-newkey rsa:4096 \
|
|
-keyout issuing_ca_key.pem \
|
|
-noenc \
|
|
-subj "/CN=Issuing Test CA $(date +"%Y-%m-%d")" \
|
|
-addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
|
|
-addext "keyUsage=critical,keyCertSign,cRLSign" |
|
|
openssl x509 \
|
|
-req \
|
|
-CA ca_cert.pem \
|
|
-CAkey ca_key.pem \
|
|
-copy_extensions copyall \
|
|
-days 3650 \
|
|
-text \
|
|
-out issuing_ca_cert.pem
|
|
|
|
# Client signing request
|
|
openssl req \
|
|
-newkey rsa:4096 \
|
|
-keyout client_key.pem \
|
|
-out client_req.pem \
|
|
-noenc \
|
|
-subj "/CN=Test Client" \
|
|
-addext "basicConstraints=critical,CA:FALSE" \
|
|
-addext "keyUsage=critical,digitalSignature,keyEncipherment" \
|
|
-addext "extendedKeyUsage=clientAuth"
|
|
|
|
# Server signing request
|
|
openssl req \
|
|
-newkey rsa:4096 \
|
|
-keyout server_key.pem \
|
|
-out server_req.pem \
|
|
-noenc \
|
|
-subj "/CN=test.example.com" \
|
|
-addext "basicConstraints=critical,CA:FALSE" \
|
|
-addext "keyUsage=critical,digitalSignature,keyEncipherment" \
|
|
-addext "extendedKeyUsage=serverAuth" \
|
|
-addext "subjectAltName=DNS:test.example.com,DNS:test,IP:127.0.0.1"
|
|
|
|
# User signing request
|
|
openssl req \
|
|
-newkey rsa:4096 \
|
|
-keyout user_key.pem \
|
|
-out user_req.pem \
|
|
-noenc \
|
|
-subj "/CN=Test User/emailAddress=testuser@example.com" \
|
|
-addext "basicConstraints=critical,CA:FALSE" \
|
|
-addext "keyUsage=critical,digitalSignature,keyEncipherment" \
|
|
-addext "extendedKeyUsage=clientAuth,emailProtection,codeSigning" \
|
|
-addext "subjectAltName=email:alias@example.com"
|
|
|
|
# Sign client certificate with issuing CA
|
|
openssl x509 \
|
|
-req \
|
|
-in client_req.pem \
|
|
-CA issuing_ca_cert.pem \
|
|
-CAkey issuing_ca_key.pem \
|
|
-copy_extensions copyall \
|
|
-days 365 \
|
|
-out client_cert.pem
|
|
|
|
# Sign server certificate with issuing CA
|
|
openssl x509 \
|
|
-req \
|
|
-in server_req.pem \
|
|
-CA issuing_ca_cert.pem \
|
|
-CAkey issuing_ca_key.pem \
|
|
-copy_extensions copyall \
|
|
-days 365 \
|
|
-out server_cert.pem
|
|
|
|
# Sign user certificate with issuing CA
|
|
openssl x509 \
|
|
-req \
|
|
-in user_req.pem \
|
|
-CA issuing_ca_cert.pem \
|
|
-CAkey issuing_ca_key.pem \
|
|
-copy_extensions copyall \
|
|
-days 365 \
|
|
-out user_cert.pem
|
|
|
|
# Certificate chain for PKCS#12 bundles
|
|
cat issuing_ca_cert.pem ca_cert.pem > ca_chain.pem
|
|
|
|
# Client PKCS#12 bundle
|
|
openssl pkcs12 \
|
|
-export \
|
|
-out client.pfx \
|
|
-inkey client_key.pem \
|
|
-in client_cert.pem \
|
|
-certfile ca_chain.pem \
|
|
-passout pass:changeit
|
|
|
|
# Server PKCS#12 bundle
|
|
openssl pkcs12 \
|
|
-export \
|
|
-out server.pfx \
|
|
-inkey server_key.pem \
|
|
-in server_cert.pem \
|
|
-certfile ca_chain.pem \
|
|
-passout pass:changeit
|
|
|
|
# User PKCS#12 bundle
|
|
openssl pkcs12 \
|
|
-export \
|
|
-out user.pfx \
|
|
-inkey user_key.pem \
|
|
-in user_cert.pem \
|
|
-certfile ca_chain.pem \
|
|
-passout pass:changeit
|