1*e0c4386eSCy Schubert#!/bin/sh 2*e0c4386eSCy Schubert 3*e0c4386eSCy Schubert# Recreate the demo certificates in the apps directory. 4*e0c4386eSCy Schubert 5*e0c4386eSCy SchubertOPENSSL=openssl 6*e0c4386eSCy Schubert 7*e0c4386eSCy Schubert# Root CA: create certificate directly 8*e0c4386eSCy SchubertCN="OpenSSL Test Root CA" $OPENSSL req -config apps.cnf -x509 -nodes \ 9*e0c4386eSCy Schubert -keyout root.pem -out root.pem -key rootkey.pem -new -days 3650 10*e0c4386eSCy Schubert# Intermediate CA: request first 11*e0c4386eSCy SchubertCN="OpenSSL Test Intermediate CA" $OPENSSL req -config apps.cnf -nodes \ 12*e0c4386eSCy Schubert -key intkey.pem -out intreq.pem -new 13*e0c4386eSCy Schubert# Sign request: CA extensions 14*e0c4386eSCy Schubert$OPENSSL x509 -req -in intreq.pem -CA root.pem -CAkey rootkey.pem -days 3630 \ 15*e0c4386eSCy Schubert -extfile apps.cnf -extensions v3_ca -CAcreateserial -out intca.pem 16*e0c4386eSCy Schubert# Client certificate: request first 17*e0c4386eSCy SchubertCN="Test Client Cert" $OPENSSL req -config apps.cnf -nodes \ 18*e0c4386eSCy Schubert -key ckey.pem -out creq.pem -new 19*e0c4386eSCy Schubert# Sign using intermediate CA 20*e0c4386eSCy Schubert$OPENSSL x509 -req -in creq.pem -CA intca.pem -CAkey intkey.pem -days 3600 \ 21*e0c4386eSCy Schubert -extfile apps.cnf -extensions usr_cert -CAcreateserial | \ 22*e0c4386eSCy Schubert $OPENSSL x509 -nameopt oneline -subject -issuer >client.pem 23*e0c4386eSCy Schubert# Server certificate: request first 24*e0c4386eSCy SchubertCN="Test Server Cert" $OPENSSL req -config apps.cnf -nodes \ 25*e0c4386eSCy Schubert -key skey.pem -out sreq.pem -new 26*e0c4386eSCy Schubert# Sign using intermediate CA 27*e0c4386eSCy Schubert$OPENSSL x509 -req -in sreq.pem -CA intca.pem -CAkey intkey.pem -days 3600 \ 28*e0c4386eSCy Schubert -extfile apps.cnf -extensions usr_cert -CAcreateserial | \ 29*e0c4386eSCy Schubert $OPENSSL x509 -nameopt oneline -subject -issuer >server.pem 30*e0c4386eSCy Schubert# Server certificate #2: request first 31*e0c4386eSCy SchubertCN="Test Server Cert #2" $OPENSSL req -config apps.cnf -nodes \ 32*e0c4386eSCy Schubert -key skey2.pem -out sreq2.pem -new 33*e0c4386eSCy Schubert# Sign using intermediate CA 34*e0c4386eSCy Schubert$OPENSSL x509 -req -in sreq2.pem -CA intca.pem -CAkey intkey.pem -days 3600 \ 35*e0c4386eSCy Schubert -extfile apps.cnf -extensions usr_cert -CAcreateserial | \ 36*e0c4386eSCy Schubert $OPENSSL x509 -nameopt oneline -subject -issuer >server2.pem 37*e0c4386eSCy Schubert 38*e0c4386eSCy Schubert# Append keys to file. 39*e0c4386eSCy Schubert 40*e0c4386eSCy Schubertcat skey.pem >>server.pem 41*e0c4386eSCy Schubertcat skey2.pem >>server2.pem 42*e0c4386eSCy Schubertcat ckey.pem >>client.pem 43*e0c4386eSCy Schubert 44*e0c4386eSCy Schubert$OPENSSL verify -CAfile root.pem -untrusted intca.pem \ 45*e0c4386eSCy Schubert server2.pem server.pem client.pem 46