blob: 0e3feb25e3b0861940b4aa265e90cd8c948a6093 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
#!/bin/bash
#
echo Ensure time is set to 2012/11/01 12:34
echo use - date -u 110112342012
echo hit return when ready
read junk
for tld in com org net
do
clica -D example.$tld -p password -B 1024 -I -N example.$tld -F \
-C http://crl.example.$tld/latest.crl -O http://oscp/example.$tld/
clica -D example.$tld -p password -s 101 -S server1.example.$tld \
-8 alternatename.server1.example.$tld,alternatename2.server1.example.$tld
clica -D example.$tld -p password -s 102 -S revoked1.example.$tld
clica -D example.$tld -p password -s 103 -S expired1.example.$tld -m 1
clica -D example.$tld -p password -s 201 -S server2.example.$tld
clica -D example.$tld -p password -s 202 -S revoked2.example.$tld
clica -D example.$tld -p password -s 203 -S expired2.example.$tld -m 1
# openssl seems to generate a file (ca_chain.pam) in an order it
# cannot then use (the key applies to the first cert in the file?).
# Generate a shuffled one.
cd example.$tld/server1.example.$tld
openssl pkcs12 -in server1.example.com.p12 -passin file:pwdfile -cacerts -out cacerts.pem -nokeys
cat server1.example.com.pem cacerts.pem > fullchain.pem
rm cacerts.pem
cd ../..
done
# and loop again
for tld in com org net
do
CADIR=example.$tld/CA
#give ourselves an OSCP key to work with
pk12util -o $CADIR/OCSP.p12 -n 'OCSP Signer' -d $CADIR -K password -W password
openssl pkcs12 -in $CADIR/OCSP.p12 -passin pass:password -passout pass:password -nodes -nocerts -out $CADIR/OCSP.key
# create some index files for the ocsp responder to work with
cat >$CADIR/index.valid.txt <<EOF
V 130110200751Z 65 unknown CN=server1.example.$tld
V 130110200751Z 66 unknown CN=revoked1.example.$tld
V 130110200751Z 67 unknown CN=expired1.example.$tld
V 130110200751Z c9 unknown CN=server2.example.$tld
V 130110200751Z ca unknown CN=revoked2.example.$tld
V 130110200751Z cb unknown CN=expired2.example.$tld
EOF
cat >$CADIR/index.revoked.txt <<EOF
R 130110200751Z 100201142709Z,superseded 65 unknown CN=server1.example.$tld
R 130110200751Z 100201142709Z,superseded 66 unknown CN=revoked1.example.$tld
R 130110200751Z 100201142709Z,superseded 67 unknown CN=expired1.example.$tld
R 130110200751Z 100201142709Z,superseded c9 unknown CN=server2.example.$tld
R 130110200751Z 100201142709Z,superseded ca unknown CN=revoked2.example.$tld
R 130110200751Z 100201142709Z,superseded cb unknown CN=expired2.example.$tld
EOF
# Now create all the ocsp requests and responses
OGENCOMMON="-rsigner $CADIR/OCSP.pem -rkey $CADIR/OCSP.key -CA $CADIR/Signer.pem -noverify"
for server in server1 revoked1 expired1 server2 revoked2 expired2
do
SPFX=example.$tld/$server.example.$tld/$server.example.$tld
openssl ocsp -issuer $CADIR/Signer.pem -cert $SPFX.pem -reqout $SPFX.ocsp.req
openssl ocsp -index $CADIR/index.valid.txt $OGENCOMMON -ndays 3652 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.good.resp
openssl ocsp -index $CADIR/index.valid.txt $OGENCOMMON -ndays 30 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.dated.resp
openssl ocsp -index $CADIR/index.revoked.txt $OGENCOMMON -ndays 3652 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.revoked.resp
done
done
# and loop again to generate unlocked keys and client cert bundles
for tld in com org net
do
for server in server1 revoked1 expired1 server2 revoked2 expired2
do
SDIR=example.$tld/$server.example.$tld
SPFX=$SDIR/$server.example.$tld
openssl rsa -in $SPFX.key -passin file:$SDIR/pwdfile -out $SPFX.unlocked.key
cat $SPFX.pem example.$tld/CA/Signer.pem >$SPFX.chain.pem
done
done
echo Please to reset date to now.
echo service ntpdate start
echo
echo Then hit return
read junk
# Create CRL files in .der and .pem
# empty versions, and ones with the revoked servers
for tld in com org net
do
CADIR=example.$tld/CA
CRLIN=$CADIR/crl.empty.in.txt
DATENOW=`date -u +%Y%m%d%H%M%SZ`
echo "update=$DATENOW " >$CRLIN
crlutil -G -d $CADIR -f $CADIR/pwdfile \
-n 'Signing Cert' -c $CRLIN -o $CADIR/crl.empty
openssl crl -in $CADIR/crl.empty -inform der -out $CADIR/crl.empty.pem
done
sleep 2
for tld in com org net
do
CADIR=example.$tld/CA
CRLIN=$CADIR/crl.v2.in.txt
DATENOW=`date -u +%Y%m%d%H%M%SZ`
echo "update=$DATENOW " >$CRLIN
echo "addcert 102 $DATENOW" >>$CRLIN
echo "addcert 202 $DATENOW" >>$CRLIN
crlutil -G -d $CADIR -f $CADIR/pwdfile \
-n 'Signing Cert' -c $CRLIN -o $CADIR/crl.v2
openssl crl -in $CADIR/crl.v2 -inform der -out $CADIR/crl.v2.pem
done
find example.* -type d -print0 | xargs -0 chmod 755
find example.* -type f -print0 | xargs -0 chmod 644
echo "CA, Certificate, CRL and OSCP Response generation complete"
|
