You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 
lighttpd2/tests/ca/createca.sh

67 lines
1.8 KiB

#!/bin/bash
set -e
# (requires gnutls >= 3.2.7 (or >= 3.1.17 and < 3.2.0))
KEY_TYPE="${KEY_TYPE:-rsa}"
HASH_ALG="${HASH_ALG:-SHA512}"
function gen_rsa_key() {
local name="$1"
local security="${2:-high}"
local secparam=(--sec-param "${security}")
echo "Generate RSA key into ${name}.key and ${name}.pub"
certtool -p --rsa --outfile "${name}.key" "${secparam[@]}"
certtool --load-privkey "${name}.key" --pubkey-info --outfile "${name}.pub"
}
function gen_ecc_key() {
local name="$1"
local security="${2:-ultra}"
local secparam=(--sec-param "${security}")
echo "Generate ECC key into ${name}.key and ${name}.pub"
certtool -p --ecc --outfile "${name}.key" "${secparam[@]}"
certtool --load-privkey "${name}.key" --pubkey-info --outfile "${name}.pub"
}
function gen_key() {
case "${KEY_TYPE}" in
rsa) gen_rsa_key "$@" ;;
ecc) gen_ecc_key "$@" ;;
*) echo >&2 "Unknown key type: ${KEY_TYPE}"; exit 1 ;;
esac
}
function ca_sign_self() {
local ca_name="$1"
echo "Self signing ${ca_name}"
certtool -s "--hash=${HASH_ALG}" --load-privkey "${ca_name}.key" --outfile "${ca_name}.crt" --template "${ca_name}.template"
}
function ca_sign() {
local ca_name="$1"
local subject_name="$2"
local key_name="${3:-${subject_name}}"
echo "Signing ${subject_name} (key ${key_name}) with ${ca_name}"
certtool -c "--hash=${HASH_ALG}" --load-ca-certificate "${ca_name}.crt" --load-ca-privkey "${ca_name}.key" --load-pubkey "${key_name}.pub" --outfile "${subject_name}.crt" --template "${subject_name}.template"
}
# gen keys
gen_key "ca"
gen_key "intermediate"
gen_key "server"
ca_sign_self "ca"
ca_sign "ca" "intermediate"
for name in test1.ssl test2.ssl; do
ca_sign "intermediate" "server_${name}" "server"
echo "Generate server_${name}.pem"
cat "server.key" "server_${name}.crt" "intermediate.crt" > "server_${name}.pem"
done