6 # Debugging. Set V for clica verbosity.
11 clica
--help >/dev
/null
2>&1
13 echo Ensure
time is
set to
2012/11/01 12:34
14 echo use
- date -u 110112342012
15 echo hit
return when ready
18 # Main suite: RSA certs
19 for tld
in com org net
25 # create CAs & server certs
28 # create CA cert + templates
29 clica
$V -D "$idir" -p password
-B 1024 -I -N $iname -F -C http
://crl.
$iname/latest.crl
-O http
://oscp.
$iname/
33 clica
$V -D $idir -p password
-s 101 -S server1.
$iname -m 301 \
34 -8 alternatename.server1.example.
$tld,alternatename2.server1.example.
$tld,*.
test.ex
35 clica
$V -D $idir -p password
-s 102 -S revoked1.
$iname -m 301
36 clica
$V -D $idir -p password
-s 103 -S expired1.
$iname -m 1
38 clica
$V -D $idir -p password
-s 201 -S server2.
$iname -m 301 \
39 -3 'CN=clica CA rsa,O=example.com' -8 '*.test.ex'
40 clica
$V -D $idir -p password
-s 202 -S revoked2.
$iname -m 301
41 clica
$V -D $idir -p password
-s 203 -S expired2.
$iname -m 1
45 # openssl seems to generate a file (ca_chain.pam) in an order it
46 # cannot then use (the key applies to the first cert in the file?).
47 # Generate a shuffled one.
50 cd $idir/server
$n.
$iname
51 openssl pkcs12
-in server
$n.
$iname.p12
-passin file:pwdfile
-cacerts -out cacerts.pem
-nokeys
52 cat server
$n.
$iname.pem cacerts.pem
> fullchain.pem
59 # generate unlocked keys and client cert bundles
60 for server
in server1 revoked1 expired1 server2 revoked2 expired2
62 SDIR
=$idir/$server.
$iname
63 SPFX
=$SDIR/$server.
$iname
64 openssl rsa
-in $SPFX.key
-passin file:$SDIR/pwdfile
-out $SPFX.unlocked.key
65 cat $SPFX.pem
$iname/CA
/Signer.pem
>$SPFX.chain.pem
70 # create OCSP reqs & resps
72 #give ourselves an OSCP key to work with
73 pk12util
-o $CADIR/OCSP.p12
-n 'OCSP Signer rsa' -d $CADIR -K password
-W password
74 openssl pkcs12
-in $CADIR/OCSP.p12
-passin pass
:password
-passout pass
:password
-nodes -nocerts -out $CADIR/OCSP.key
76 # also need variation from Signer
77 pk12util
-o $CADIR/Signer.p12
-n 'Signing Cert rsa' -d $CADIR -K password
-W password
78 openssl pkcs12
-in $CADIR/Signer.p12
-passin pass
:password
-passout pass
:password
-nodes -nocerts -out $CADIR/Signer.key
80 # create some index files for the ocsp responder to work with
82 # 0: Revoked/Expired/Valid letter
83 # 1: Expiry date (ASN1_UTCTIME)
85 # 3: Serial no. (unique)
89 cat >$CADIR/index.valid.txt
<<EOF
90 V 130110200751Z 65 unknown CN=server1.$iname
91 V 130110200751Z 66 unknown CN=revoked1.$iname
92 V 130110200751Z 67 unknown CN=expired1.$iname
93 V 130110200751Z c9 unknown CN=server2.$iname
94 V 130110200751Z ca unknown CN=revoked2.$iname
95 V 130110200751Z cb unknown CN=expired2.$iname
97 cat >$CADIR/index.revoked.txt
<<EOF
98 R 130110200751Z 100201142709Z,superseded 65 unknown CN=server1.$iname
99 R 130110200751Z 100201142709Z,superseded 66 unknown CN=revoked1.$iname
100 R 130110200751Z 100201142709Z,superseded 67 unknown CN=expired1.$iname
101 R 130110200751Z 100201142709Z,superseded c9 unknown CN=server2.$iname
102 R 130110200751Z 100201142709Z,superseded ca unknown CN=revoked2.$iname
103 R 130110200751Z 100201142709Z,superseded cb unknown CN=expired2.$iname
106 # Now create all the ocsp requests and responses
107 IVALID
="-index $CADIR/index.valid.txt"
108 IREVOKED
="-index $CADIR/index.revoked.txt"
110 echo "unique_subject = yes" > $CADIR/index.valid.txt.attr
111 echo "unique_subject = yes" > $CADIR/index.revoked.txt.attr
113 for server
in server1 revoked1 expired1 server2 revoked2 expired2
115 SPFX
=$idir/$server.
$iname/$server.
$iname
116 openssl ocsp
-issuer $CADIR/Signer.pem
-sha256 -cert $SPFX.pem
-no_nonce -reqout $SPFX.ocsp.req
117 REQIN
="-reqin $SPFX.ocsp.req"
119 OGENCOMMON
="-rsigner $CADIR/OCSP.pem -rkey $CADIR/OCSP.key -CA $CADIR/Signer.pem -noverify"
120 openssl ocsp
$IVALID $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.good.resp
121 openssl ocsp
$IVALID $OGENCOMMON -ndays 30 $REQIN -respout $SPFX.ocsp.dated.resp
122 openssl ocsp
$IREVOKED $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.revoked.resp
124 OGENCOMMON
="-rsigner $CADIR/Signer.pem -rkey $CADIR/Signer.key -CA $CADIR/Signer.pem -noverify"
125 openssl ocsp
$IVALID $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.signer.good.resp
126 openssl ocsp
$IVALID $OGENCOMMON -ndays 30 $REQIN -respout $SPFX.ocsp.signer.dated.resp
127 openssl ocsp
$IREVOKED $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.signer.revoked.resp
129 OGENCOMMON
="-rsigner $CADIR/Signer.pem -rkey $CADIR/Signer.key -CA $CADIR/Signer.pem -resp_no_certs -noverify"
130 openssl ocsp
$IVALID $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.signernocert.good.resp
131 openssl ocsp
$IVALID $OGENCOMMON -ndays 30 $REQIN -respout $SPFX.ocsp.signernocert.dated.resp
132 openssl ocsp
$IREVOKED $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.signernocert.revoked.resp
137 # Create one EC leaf cert in the RSA cert tree. It will have an EC pubkey but be signed using its parent
138 # therefore its parent's algo, RSA.
139 clica
$V -D example.com
-p password
-k ec
-q nistp521
-s 1101 -S server1_ec.example.com
-m 301 -8 'server1.example.com,*.test.ex'
140 SDIR
=example.com
/server1_ec.example.com
141 SPFX
=$SDIR/server1_ec.example.com
142 openssl ec
-in $SPFX.key
-passin file:$SDIR/pwdfile
-out $SPFX.unlocked.key
143 cat $SPFX.pem example.com
/CA
/Signer.pem
>$SPFX.chain.pem
147 ###############################################################################
148 # Limited suite: EC certs
149 # separate trust root & chain
150 # .com only, server1 good only, no ocsp
151 # with server1 in SAN of leaf
155 iname
="example_ec.$tld"
159 # create CAs & server certs
162 # create CA cert + templates
163 clica
$V -D "$idir" -p password
-B 1024 -I -N $iname -F \
165 -C http
://crl.example.
$tld/latest.crl
-O http
://oscp.example.
$tld/
167 # create server certs
169 clica
$V -D $idir -p password
-s 2101 -S server1.
$iname -m 301 \
171 -8 server1.example.
$tld,alternatename.server1.example.
$tld,alternatename2.server1.example.
$tld,*.
test.ex
175 # openssl seems to generate a file (ca_chain.pam) in an order it
176 # cannot then use (the key applies to the first cert in the file?).
177 # Generate a shuffled one.
178 cd $idir/server1.
$iname
179 openssl pkcs12
-in server1.
$iname.p12
-passin file:pwdfile
-cacerts -out cacerts.pem
-nokeys
180 cat server1.
$iname.pem cacerts.pem
> fullchain.pem
186 # generate unlocked keys and client cert bundles
187 for server
in server1
189 SDIR
=$idir/$server.
$iname
190 SPFX
=$SDIR/$server.
$iname
191 openssl ec
-in $SPFX.key
-passin file:$SDIR/pwdfile
-out $SPFX.unlocked.key
192 cat $SPFX.pem
$idir/CA
/Signer.pem
>$SPFX.chain.pem
196 # create OCSP reqs & resps
198 #give ourselves an OSCP key to work with
199 pk12util
-o $CADIR/OCSP.p12
-n 'OCSP Signer ec' -d $CADIR -K password
-W password
200 openssl pkcs12
-in $CADIR/OCSP.p12
-passin pass
:password
-passout pass
:password
-nodes -nocerts -out $CADIR/OCSP.key
202 # create some index files for the ocsp responder to work with
204 # 0: Revoked/Expired/Valid letter
205 # 1: Expiry date (ASN1_UTCTIME)
207 # 3: Serial no. (unique)
211 cat >$CADIR/index.valid.txt
<<EOF
212 V 130110200751Z 65 unknown CN=server1.$iname
215 # Now create all the ocsp requests and responses
216 IVALID
="-index $CADIR/index.valid.txt"
217 for server
in server1
219 SPFX
=$idir/$server.
$iname/$server.
$iname
220 openssl ocsp
-issuer $CADIR/Signer.pem
-sha256 -cert $SPFX.pem
-no_nonce -reqout $SPFX.ocsp.req
221 REQIN
="-reqin $SPFX.ocsp.req"
223 OGENCOMMON
="-rsigner $CADIR/OCSP.pem -rkey $CADIR/OCSP.key -CA $CADIR/Signer.pem -noverify"
224 openssl ocsp
$IVALID $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.good.resp
229 ###############################################################################
231 echo Please to
reset date to now.
232 echo 'service ntpdate start (not on a systemd though...)'
239 # Create CRL files in .der and .pem
240 # empty versions, and ones with the revoked servers
241 DATENOW
=`date -u +%Y%m%d%H%M%SZ`
242 for tld
in com org net
244 CADIR
=example.
$tld/CA
245 CRLIN
=$CADIR/crl.empty.
in.txt
246 echo "update=$DATENOW " >$CRLIN
247 crlutil
-G -d $CADIR -f $CADIR/pwdfile \
248 -n 'Signing Cert rsa' -c $CRLIN -o $CADIR/crl.empty
249 openssl crl
-in $CADIR/crl.empty
-inform der
-out $CADIR/crl.empty.pem
252 DATENOW
=`date -u +%Y%m%d%H%M%SZ`
253 for tld
in com org net
255 CADIR
=example.
$tld/CA
256 CRLIN
=$CADIR/crl.v2.
in.txt
257 echo "update=$DATENOW " >$CRLIN
258 echo "addcert 102 $DATENOW" >>$CRLIN
259 echo "addcert 202 $DATENOW" >>$CRLIN
260 crlutil
-G -d $CADIR -f $CADIR/pwdfile \
261 -n 'Signing Cert rsa' -c $CRLIN -o $CADIR/crl.v2
262 openssl crl
-in $CADIR/crl.v2
-inform der
-out $CADIR/crl.v2.pem
264 CRLIN
=$CADIR/crl.Signer.
in.txt
265 echo "update=$DATENOW " >$CRLIN
266 crlutil
-G -d $CADIR -f $CADIR/pwdfile \
267 -n 'Certificate Authority rsa' -c $CRLIN -o $CADIR/crl.Signer
268 openssl crl
-in $CADIR/crl.Signer
-inform der
-out $CADIR/crl.Signer.pem
270 cat $CADIR/crl.Signer.pem
$CADIR/crl.v2.pem
> $CADIR/crl.chain.pem
273 # Finally, a single certificate-directory
274 cd example.com
/server1.example.com
278 h
=`openssl x509 -hash -noout -in $f`
281 f
=..
/..
/CA
/Signer.pem
282 h
=`openssl x509 -hash -noout -in $f`
290 find example
* -type d
-print0 |
xargs -0 chmod 755
291 find example
* -type f
-print0 |
xargs -0 chmod 644
293 echo "CA, Certificate, CRL and OSCP Response generation complete"