libeap/tests/hwsim/auth_serv/ec2-generate.sh

   1 #!/bin/sh
   2
   3 OPENSSL=openssl
   4
   5 CURVE=secp384r1
   6 DIGEST="-sha384"
   7 DIGEST_CA="-md sha384"
   8
   9 echo
  10 echo "---[ Root CA ]----------------------------------------------------------"
  11 echo
  12
  13 cat ec-ca-openssl.cnf |
  14         sed "s/#@CN@/commonName_default = Suite B 192-bit Root CA/" \
  15         > ec-ca-openssl.cnf.tmp
  16 $OPENSSL ecparam -out ec2-ca.key -name $CURVE -genkey
  17 $OPENSSL req -config ec-ca-openssl.cnf.tmp -batch -x509 -new -key ec2-ca.key -out ec2-ca.pem -outform PEM -days 3650 $DIGEST
  18 mkdir -p ec-ca/certs ec-ca/crl ec-ca/newcerts ec-ca/private
  19 touch ec-ca/index.txt
  20 rm ec-ca-openssl.cnf.tmp
  21
  22 echo
  23 echo "---[ Server ]-----------------------------------------------------------"
  24 echo
  25
  26 cat ec-ca-openssl.cnf |
  27         sed "s/#@CN@/commonName_default = server.w1.fi/" |
  28         sed "s/#@ALTNAME@/subjectAltName=critical,DNS:server.w1.fi/" \
  29         > ec-ca-openssl.cnf.tmp
  30 $OPENSSL ecparam -out ec2-server.key -name $CURVE -genkey
  31 $OPENSSL req -config ec-ca-openssl.cnf.tmp -batch -new -nodes -key ec2-server.key -out ec2-server.req -outform PEM $DIGEST
  32 $OPENSSL ca -config ec-ca-openssl.cnf.tmp -batch -keyfile ec2-ca.key -cert ec2-ca.pem -create_serial -in ec2-server.req -out ec2-server.pem -extensions ext_server $DIGEST_CA
  33 rm ec-ca-openssl.cnf.tmp
  34
  35 echo
  36 echo "---[ User ]-------------------------------------------------------------"
  37 echo
  38
  39 cat ec-ca-openssl.cnf |
  40         sed "s/#@CN@/commonName_default = user/" |
  41         sed "s/#@ALTNAME@/subjectAltName=email:user@w1.fi/" \
  42         > ec-ca-openssl.cnf.tmp
  43 $OPENSSL ecparam -out ec2-user.key -name $CURVE -genkey
  44 $OPENSSL req -config ec-ca-openssl.cnf.tmp -batch -new -nodes -key ec2-user.key -out ec2-user.req -outform PEM -extensions ext_client $DIGEST
  45 $OPENSSL ca -config ec-ca-openssl.cnf.tmp -batch -keyfile ec2-ca.key -cert ec2-ca.pem -create_serial -in ec2-user.req -out ec2-user.pem -extensions ext_client $DIGEST_CA
  46 rm ec-ca-openssl.cnf.tmp
  47
  48 echo
  49 echo "---[ Verify ]-----------------------------------------------------------"
  50 echo
  51
  52 $OPENSSL verify -CAfile ec2-ca.pem ec2-server.pem
  53 $OPENSSL verify -CAfile ec2-ca.pem ec2-user.pem