70 lines
2.1 KiB
Bash
Executable File
70 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Regenerates the committed TLS chain-repair fixtures. The leaf intentionally
|
|
# carries an AIA caIssuers URL that points at an unroutable local test port; the
|
|
# tests inject the fetched intermediate bytes rather than doing network I/O.
|
|
|
|
cd "$(dirname "$0")"
|
|
|
|
rm -f root.pem root.key.pem intermediate.pem intermediate.key.pem intermediate.der leaf.pem leaf.key.pem *.csr *.srl *.cnf *.ext
|
|
|
|
cat > root.cnf <<'EOF'
|
|
[req]
|
|
distinguished_name = dn
|
|
x509_extensions = v3_ca
|
|
prompt = no
|
|
|
|
[dn]
|
|
CN = OpenWork Test Chain Root
|
|
|
|
[v3_ca]
|
|
basicConstraints = critical,CA:TRUE,pathlen:1
|
|
keyUsage = critical,keyCertSign,cRLSign
|
|
subjectKeyIdentifier = hash
|
|
EOF
|
|
|
|
cat > intermediate.cnf <<'EOF'
|
|
[req]
|
|
distinguished_name = dn
|
|
prompt = no
|
|
|
|
[dn]
|
|
CN = OpenWork Test Chain Intermediate
|
|
EOF
|
|
|
|
cat > intermediate.ext <<'EOF'
|
|
basicConstraints = critical,CA:TRUE,pathlen:0
|
|
keyUsage = critical,keyCertSign,cRLSign
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid,issuer
|
|
EOF
|
|
|
|
cat > leaf.cnf <<'EOF'
|
|
[req]
|
|
distinguished_name = dn
|
|
prompt = no
|
|
|
|
[dn]
|
|
CN = localhost
|
|
EOF
|
|
|
|
cat > leaf.ext <<'EOF'
|
|
basicConstraints = critical,CA:FALSE
|
|
keyUsage = critical,digitalSignature,keyEncipherment
|
|
extendedKeyUsage = serverAuth
|
|
subjectAltName = DNS:localhost,IP:127.0.0.1
|
|
authorityInfoAccess = caIssuers;URI:http://127.0.0.1:1/int.der
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid,issuer
|
|
EOF
|
|
|
|
openssl req -x509 -newkey rsa:2048 -nodes -keyout root.key.pem -out root.pem -days 8700 -sha256 -config root.cnf
|
|
openssl req -newkey rsa:2048 -nodes -keyout intermediate.key.pem -out intermediate.csr -config intermediate.cnf
|
|
openssl x509 -req -in intermediate.csr -CA root.pem -CAkey root.key.pem -CAcreateserial -out intermediate.pem -days 8700 -sha256 -extfile intermediate.ext
|
|
openssl req -newkey rsa:2048 -nodes -keyout leaf.key.pem -out leaf.csr -config leaf.cnf
|
|
openssl x509 -req -in leaf.csr -CA intermediate.pem -CAkey intermediate.key.pem -CAcreateserial -out leaf.pem -days 8700 -sha256 -extfile leaf.ext
|
|
openssl x509 -in intermediate.pem -outform DER -out intermediate.der
|
|
|
|
rm -f *.csr *.srl *.cnf *.ext
|