54 lines
2.7 KiB
Bash
54 lines
2.7 KiB
Bash
# Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
|
|
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
#
|
|
# This code is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU General Public License version 2 only, as
|
|
# published by the Free Software Foundation.
|
|
#
|
|
# This code is distributed in the hope that it will be useful, but WITHOUT
|
|
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
# version 2 for more details (a copy is included in the LICENSE file that
|
|
# accompanied this code).
|
|
#
|
|
# You should have received a copy of the GNU General Public License version
|
|
# 2 along with this work; if not, write to the Free Software Foundation,
|
|
# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
#
|
|
# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
|
# or visit www.oracle.com if you need additional information or have any
|
|
# questions.
|
|
|
|
# Generate OpenSSL configuration file
|
|
echo "[req]" > openssl.conf
|
|
echo "distinguished_name = dn" >> openssl.conf
|
|
echo "x509_extensions = v3_ext" >> openssl.conf
|
|
echo "[dn]" >> openssl.conf
|
|
echo "[v3_ext]" >> openssl.conf
|
|
echo "subjectKeyIdentifier = hash" >> openssl.conf
|
|
echo "authorityKeyIdentifier = keyid" >> openssl.conf
|
|
echo "basicConstraints = critical,CA:FALSE" >> openssl.conf
|
|
|
|
# Generate X.509 version 3 extension file
|
|
echo "subjectKeyIdentifier = hash" > v3.ext
|
|
echo "authorityKeyIdentifier = keyid,issuer" >> v3.ext
|
|
|
|
# Generate good cert
|
|
openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:65537 -out good.key
|
|
openssl req -config openssl.conf -new -key good.key -subj "/CN=localhost" -sha256 -out good.csr
|
|
openssl x509 -extfile v3.ext -req -CAcreateserial -days 3650 -in good.csr -sha256 -signkey good.key -out good.cer
|
|
|
|
# Generate bad cert
|
|
openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:65537 -out bad.key
|
|
openssl req -config openssl.conf -new -key bad.key -subj "/CN=evil" -sha256 -out bad.csr
|
|
openssl x509 -extfile v3.ext -req -CAcreateserial -days 3650 -in bad.csr -sha256 -signkey bad.key -out bad.cer
|
|
|
|
# Generate loopback cert with subject alternative name
|
|
echo "subjectAltName = @alt_names" >> v3.ext
|
|
echo "[alt_names]" >> v3.ext
|
|
echo "IP.1 = 127.0.0.1" >> v3.ext
|
|
|
|
openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:65537 -out loopback.key
|
|
openssl req -config openssl.conf -new -key loopback.key -subj "/CN=unknown" -sha256 -out loopback.csr
|
|
openssl x509 -extfile v3.ext -req -CAcreateserial -days 3650 -in loopback.csr -sha256 -signkey loopback.key -out loopback.cer
|