1*e0c4386eSCy Schubert#!/bin/sh 2*e0c4386eSCy Schubert# Copyright 2013-2022 The OpenSSL Project Authors. All Rights Reserved. 3*e0c4386eSCy Schubert# 4*e0c4386eSCy Schubert# Licensed under the Apache License 2.0 (the "License"). You may not use 5*e0c4386eSCy Schubert# this file except in compliance with the License. You can obtain a copy 6*e0c4386eSCy Schubert# in the file LICENSE in the source distribution or at 7*e0c4386eSCy Schubert# https://www.openssl.org/source/license.html 8*e0c4386eSCy Schubert 9*e0c4386eSCy Schubert 10*e0c4386eSCy Schubert# Utility to recreate S/MIME certificates 11*e0c4386eSCy Schubert 12*e0c4386eSCy SchubertOPENSSL=../../apps/openssl 13*e0c4386eSCy SchubertOPENSSL_CONF=./ca.cnf 14*e0c4386eSCy Schubertexport OPENSSL_CONF 15*e0c4386eSCy Schubert 16*e0c4386eSCy Schubert# Root CA: create certificate directly 17*e0c4386eSCy SchubertCN="Test S/MIME RSA Root" $OPENSSL req -config ca.cnf -x509 -noenc \ 18*e0c4386eSCy Schubert -keyout smroot.pem -out smroot.pem -newkey rsa:2048 -days 36501 19*e0c4386eSCy Schubert 20*e0c4386eSCy Schubert# EE RSA certificates: create request first 21*e0c4386eSCy SchubertCN="Test S/MIME EE RSA #1" $OPENSSL req -config ca.cnf -noenc \ 22*e0c4386eSCy Schubert -keyout smrsa1.pem -out req.pem -newkey rsa:2048 23*e0c4386eSCy Schubert# Sign request: end entity extensions 24*e0c4386eSCy Schubert$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 25*e0c4386eSCy Schubert -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa1.pem 26*e0c4386eSCy Schubert 27*e0c4386eSCy SchubertCN="Test S/MIME EE RSA #2" $OPENSSL req -config ca.cnf -noenc \ 28*e0c4386eSCy Schubert -keyout smrsa2.pem -out req.pem -newkey rsa:2048 29*e0c4386eSCy Schubert$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 30*e0c4386eSCy Schubert -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa2.pem 31*e0c4386eSCy Schubert 32*e0c4386eSCy SchubertCN="Test S/MIME EE RSA #3" $OPENSSL req -config ca.cnf -noenc \ 33*e0c4386eSCy Schubert -keyout smrsa3.pem -out req.pem -newkey rsa:2048 34*e0c4386eSCy Schubert$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 35*e0c4386eSCy Schubert -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa3.pem 36*e0c4386eSCy Schubert 37*e0c4386eSCy Schubert# Create DSA parameters 38*e0c4386eSCy Schubert 39*e0c4386eSCy Schubert$OPENSSL dsaparam -out dsap.pem 2048 40*e0c4386eSCy Schubert 41*e0c4386eSCy SchubertCN="Test S/MIME EE DSA #1" $OPENSSL req -config ca.cnf -noenc \ 42*e0c4386eSCy Schubert -keyout smdsa1.pem -out req.pem -newkey dsa:dsap.pem 43*e0c4386eSCy Schubert$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 44*e0c4386eSCy Schubert -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa1.pem 45*e0c4386eSCy SchubertCN="Test S/MIME EE DSA #2" $OPENSSL req -config ca.cnf -noenc \ 46*e0c4386eSCy Schubert -keyout smdsa2.pem -out req.pem -newkey dsa:dsap.pem 47*e0c4386eSCy Schubert$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 48*e0c4386eSCy Schubert -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa2.pem 49*e0c4386eSCy SchubertCN="Test S/MIME EE DSA #3" $OPENSSL req -config ca.cnf -noenc \ 50*e0c4386eSCy Schubert -keyout smdsa3.pem -out req.pem -newkey dsa:dsap.pem 51*e0c4386eSCy Schubert$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 52*e0c4386eSCy Schubert -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa3.pem 53*e0c4386eSCy Schubert 54*e0c4386eSCy Schubert# Create EC parameters 55*e0c4386eSCy Schubert 56*e0c4386eSCy Schubert$OPENSSL ecparam -out ecp.pem -name P-256 57*e0c4386eSCy Schubert$OPENSSL ecparam -out ecp2.pem -name K-283 58*e0c4386eSCy Schubert 59*e0c4386eSCy SchubertCN="Test S/MIME EE EC #1" $OPENSSL req -config ca.cnf -noenc \ 60*e0c4386eSCy Schubert -keyout smec1.pem -out req.pem -newkey ec:ecp.pem 61*e0c4386eSCy Schubert$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 62*e0c4386eSCy Schubert -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec1.pem 63*e0c4386eSCy SchubertCN="Test S/MIME EE EC #2" $OPENSSL req -config ca.cnf -noenc \ 64*e0c4386eSCy Schubert -keyout smec2.pem -out req.pem -newkey ec:ecp2.pem 65*e0c4386eSCy Schubert$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 66*e0c4386eSCy Schubert -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec2.pem 67*e0c4386eSCy Schubert# Do not renew this cert as it is used for legacy data decrypt test 68*e0c4386eSCy Schubert#CN="Test S/MIME EE EC #3" $OPENSSL req -config ca.cnf -noenc \ 69*e0c4386eSCy Schubert# -keyout smec3.pem -out req.pem -newkey ec:ecp.pem 70*e0c4386eSCy Schubert#$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 71*e0c4386eSCy Schubert# -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec3.pem 72*e0c4386eSCy Schubert# Create X9.42 DH parameters. 73*e0c4386eSCy Schubert$OPENSSL genpkey -genparam -algorithm DHX -out dhp.pem 74*e0c4386eSCy Schubert# Generate X9.42 DH key. 75*e0c4386eSCy Schubert$OPENSSL genpkey -paramfile dhp.pem -out smdh.pem 76*e0c4386eSCy Schubert$OPENSSL pkey -pubout -in smdh.pem -out dhpub.pem 77*e0c4386eSCy Schubert# Generate dummy request. 78*e0c4386eSCy SchubertCN="Test S/MIME EE DH #1" $OPENSSL req -config ca.cnf -noenc \ 79*e0c4386eSCy Schubert -keyout smtmp.pem -out req.pem -newkey rsa:2048 80*e0c4386eSCy Schubert# Sign request but force public key to DH 81*e0c4386eSCy Schubert$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36500 \ 82*e0c4386eSCy Schubert -force_pubkey dhpub.pem \ 83*e0c4386eSCy Schubert -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdh.pem 84*e0c4386eSCy Schubert# Remove temp files. 85*e0c4386eSCy Schubertrm -f req.pem ecp.pem ecp2.pem dsap.pem dhp.pem dhpub.pem smtmp.pem smroot.srl 86