6 # Debugging. Set V for clica verbosity.
11 clica
--help >/dev
/null
2>&1
13 echo Ensure
time is
set to
2012/11/01 12:34
14 echo use
- date -u 110112342012
15 echo hit
return when ready
18 # Main suite: RSA certs
19 for tld
in com org net
25 # create CAs & server certs
28 # create CA cert + templates
34 # -F create sub-signing cert
36 # -O create OCSP responder cert
37 clica
$V -D "$idir" -p password
-B 2048 -I -N $iname -F -C http
://crl.
$iname/latest.crl
-O http
://oscp.
$iname/
41 clica
$V -D $idir -p password
-s 101 -S server1.
$iname -m 301 \
42 -8 alternatename.server1.example.
$tld,alternatename2.server1.example.
$tld,*.
test.ex
43 clica
$V -D $idir -p password
-s 102 -S revoked1.
$iname -m 301
44 clica
$V -D $idir -p password
-s 103 -S expired1.
$iname -m 1
46 clica
$V -D $idir -p password
-s 201 -S server2.
$iname -m 301 \
47 -3 'CN=clica CA rsa,O=example.com' -8 '*.test.ex'
48 clica
$V -D $idir -p password
-s 202 -S revoked2.
$iname -m 301
49 clica
$V -D $idir -p password
-s 203 -S expired2.
$iname -m 1
53 # openssl seems to generate a file (ca_chain.pam) in an order it
54 # cannot then use (the key applies to the first cert in the file?).
55 # Generate a shuffled one.
58 cd $idir/server
$n.
$iname
59 openssl pkcs12
-in server
$n.
$iname.p12
-passin file:pwdfile
-cacerts -out cacerts.pem
-nokeys
60 cat server
$n.
$iname.pem cacerts.pem
> fullchain.pem
67 # generate unlocked keys and client cert bundles
68 for server
in server1 revoked1 expired1 server2 revoked2 expired2
70 SDIR
=$idir/$server.
$iname
71 SPFX
=$SDIR/$server.
$iname
72 openssl rsa
-in $SPFX.key
-passin file:$SDIR/pwdfile
-out $SPFX.unlocked.key
73 cat $SPFX.pem
$iname/CA
/Signer.pem
>$SPFX.chain.pem
78 # create OCSP reqs & resps
81 #give ourselves an OSCP key to work with
82 pk12util
-o $CADIR/OCSP.p12
-n 'OCSP Signer rsa' -d $CADIR -K password
-W password
83 openssl pkcs12
-in $CADIR/OCSP.p12
-passin pass
:password
-passout pass
:password
-nodes -nocerts -out $CADIR/OCSP.key
85 # also need variation from Signer
86 pk12util
-o $CADIR/Signer.p12
-n 'Signing Cert rsa' -d $CADIR -K password
-W password
87 openssl pkcs12
-in $CADIR/Signer.p12
-passin pass
:password
-passout pass
:password
-nodes -nocerts -out $CADIR/Signer.key
90 # - the "-n names" here appear to be hardcoded in clica
91 pk12util
-o $CADIR/CA.p12
-n 'Certificate Authority rsa' -d $CADIR -K password
-W password
92 openssl pkcs12
-in $CADIR/CA.p12
-passin pass
:password
-passout pass
:password
-nodes -nocerts -out $CADIR/CA.key
94 # create some index files for the ocsp responder to work with
95 # tab-sep, and fields can be empty
96 # 0: Revoked/Expired/Valid letter
97 # 1: Expiry date (ASN1_UTCTIME)
99 # 3: Serial no. (unique, in hex)
103 cat >$CADIR/index.valid.txt
<<EOF
104 V 130110200751Z 65 unknown CN=server1.$iname
105 V 130110200751Z 66 unknown CN=revoked1.$iname
106 V 130110200751Z 67 unknown CN=expired1.$iname
107 V 130110200751Z c9 unknown CN=server2.$iname
108 V 130110200751Z ca unknown CN=revoked2.$iname
109 V 130110200751Z cb unknown CN=expired2.$iname
110 V 130110200751Z 42 unknown CN=clica Signing Cert rsa
111 V 130110200751Z 41 unknown CN=clica CA rsa
113 cat >$CADIR/index.revoked.txt
<<EOF
114 R 130110200751Z 100201142709Z,superseded 65 unknown CN=server1.$iname
115 R 130110200751Z 100201142709Z,superseded 66 unknown CN=revoked1.$iname
116 R 130110200751Z 100201142709Z,superseded 67 unknown CN=expired1.$iname
117 R 130110200751Z 100201142709Z,superseded c9 unknown CN=server2.$iname
118 R 130110200751Z 100201142709Z,superseded ca unknown CN=revoked2.$iname
119 R 130110200751Z 100201142709Z,superseded cb unknown CN=expired2.$iname
120 R 130110200751Z 100201142709Z,superseded 42 unknown CN=clica Signing Cert rsa
123 # Now create all the ocsp requests and responses for the leaf certs
124 IVALID
="-index $CADIR/index.valid.txt"
125 IREVOKED
="-index $CADIR/index.revoked.txt"
127 echo "unique_subject = yes" > $CADIR/index.valid.txt.attr
128 echo "unique_subject = yes" > $CADIR/index.revoked.txt.attr
130 for server
in server1 revoked1 expired1 server2 revoked2 expired2
132 SPFX
=$idir/$server.
$iname/$server.
$iname
133 openssl ocsp
-issuer $CADIR/Signer.pem
-sha256 -cert $SPFX.pem
-no_nonce -reqout $SPFX.ocsp.req
134 REQIN
="-reqin $SPFX.ocsp.req"
136 # These ones get used by the "traditional" testcases. OCSP resp signed by a cert which is
137 # signed by the signer of the leaf-cert being attested to.
138 OGENCOMMON
="-rsigner $CADIR/OCSP.pem -rkey $CADIR/OCSP.key -CA $CADIR/Signer.pem -noverify"
139 openssl ocsp
$IVALID $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.good.resp
140 openssl ocsp
$IVALID $OGENCOMMON -ndays 30 $REQIN -respout $SPFX.ocsp.dated.resp
141 openssl ocsp
$IREVOKED $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.revoked.resp
143 OGENCOMMON
="-rsigner $CADIR/Signer.pem -rkey $CADIR/Signer.key -CA $CADIR/Signer.pem -noverify"
144 openssl ocsp
$IVALID $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.signer.good.resp
145 openssl ocsp
$IVALID $OGENCOMMON -ndays 30 $REQIN -respout $SPFX.ocsp.signer.dated.resp
146 openssl ocsp
$IREVOKED $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.signer.revoked.resp
148 # These ones get used by the "LetsEncrypt mode" testcases. OCSP resp is signed directly by the
149 # signer of the leaf-cert being attested to.
150 OGENCOMMON
="-rsigner $CADIR/Signer.pem -rkey $CADIR/Signer.key -CA $CADIR/Signer.pem -resp_no_certs -noverify"
151 openssl ocsp
$IVALID $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.signernocert.good.resp
152 openssl ocsp
$IVALID $OGENCOMMON -ndays 30 $REQIN -respout $SPFX.ocsp.signernocert.dated.resp
153 openssl ocsp
$IREVOKED $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.signernocert.revoked.resp
156 # convert one good leaf-resp to PEM
158 RESP
=$idir/$server.
$iname/$server.
$iname.ocsp.signernocert.good.resp
159 ocsptool
-S $RESP -j > $RESP.pem
161 # Then, ocsp request and (valid, revoked) responses for the signer cert
162 REQ
=$CADIR/Signer.ocsp.req
163 RESP
=$CADIR/Signer.ocsp.signernocert.good.resp
164 openssl ocsp
-issuer $CADIR/CA.pem
-sha256 -cert $CADIR/Signer.pem
-no_nonce -reqout $REQ
165 openssl ocsp
$IVALID -rsigner $CADIR/CA.pem
-rkey $CADIR/CA.key
-CA $CADIR/CA.pem
-resp_no_certs -noverify \
166 -ndays 3652 -reqin $REQ -respout $RESP
167 ocsptool
-S $RESP -j > $RESP.pem
169 RESP
=$CADIR/Signer.ocsp.signernocert.revoked.resp
170 openssl ocsp
$IREVOKED -rsigner $CADIR/CA.pem
-rkey $CADIR/CA.key
-CA $CADIR/CA.pem
-resp_no_certs -noverify \
171 -ndays 3652 -reqin $REQ -respout $RESP
172 ocsptool
-S $RESP -j > $RESP.pem
174 # Finally, a full-chain all-good request and response
175 REQ
=$idir/$server.
$iname/fullchain.ocsp.req
176 leafcert
=$idir/$server.
$iname/$server.
$iname.pem
177 signercert
=$CADIR/Signer.pem
179 openssl ocsp
-sha256 -no_nonce -reqout $REQ \
180 -issuer $signercert -cert $leafcert \
181 -issuer $cacert -cert $CADIR/Signer.pem
-cert $CADIR/CA.pem
183 RESP
=$idir/$server.
$iname/fullchain.ocsp.resp
184 authorities
=$idir/$server.
$iname/ca_chain.pem
185 openssl ocsp
$IVALID -rsigner $CADIR/CA.pem
-rkey $CADIR/CA.key
-CA $authorities -resp_no_certs -noverify \
186 -ndays 3652 -reqin $REQ -respout $RESP
187 ocsptool
-S $RESP -j > $RESP.pem
192 # Create one EC leaf cert in the RSA cert tree. It will have an EC pubkey but be signed using its parent
193 # therefore its parent's algo, RSA.
194 clica
$V -D example.com
-p password
-k ec
-q nistp521
-s 1101 -S server1_ec.example.com
-m 301 -8 'server1.example.com,*.test.ex'
195 SDIR
=example.com
/server1_ec.example.com
196 SPFX
=$SDIR/server1_ec.example.com
197 openssl ec
-in $SPFX.key
-passin file:$SDIR/pwdfile
-out $SPFX.unlocked.key
198 cat $SPFX.pem example.com
/CA
/Signer.pem
>$SPFX.chain.pem
202 ###############################################################################
203 # Limited suite: EC certs
204 # separate trust root & chain
205 # .com only, server1 good only, no ocsp
206 # with server1 in SAN of leaf
210 iname
="example_ec.$tld"
214 # create CAs & server certs
217 # create CA cert + templates
218 clica
$V -D "$idir" -p password
-B 2048 -I -N $iname -F \
220 -C http
://crl.example.
$tld/latest.crl
-O http
://oscp.example.
$tld/
222 # create server certs
224 clica
$V -D $idir -p password
-s 2101 -S server1.
$iname -m 301 \
226 -8 server1.example.
$tld,alternatename.server1.example.
$tld,alternatename2.server1.example.
$tld,*.
test.ex
230 # openssl seems to generate a file (ca_chain.pam) in an order it
231 # cannot then use (the key applies to the first cert in the file?).
232 # Generate a shuffled one.
233 cd $idir/server1.
$iname
234 openssl pkcs12
-in server1.
$iname.p12
-passin file:pwdfile
-cacerts -out cacerts.pem
-nokeys
235 cat server1.
$iname.pem cacerts.pem
> fullchain.pem
241 # generate unlocked keys and client cert bundles
242 for server
in server1
244 SDIR
=$idir/$server.
$iname
245 SPFX
=$SDIR/$server.
$iname
246 openssl ec
-in $SPFX.key
-passin file:$SDIR/pwdfile
-out $SPFX.unlocked.key
247 cat $SPFX.pem
$idir/CA
/Signer.pem
>$SPFX.chain.pem
251 # create OCSP reqs & resps
253 #give ourselves an OSCP key to work with
254 pk12util
-o $CADIR/OCSP.p12
-n 'OCSP Signer ec' -d $CADIR -K password
-W password
255 openssl pkcs12
-in $CADIR/OCSP.p12
-passin pass
:password
-passout pass
:password
-nodes -nocerts -out $CADIR/OCSP.key
257 # create some index files for the ocsp responder to work with
259 # 0: Revoked/Expired/Valid letter
260 # 1: Expiry date (ASN1_UTCTIME)
262 # 3: Serial no. (unique)
266 cat >$CADIR/index.valid.txt
<<EOF
267 V 130110200751Z 835 unknown CN=server1.$iname
270 # Now create all the ocsp requests and responses
271 IVALID
="-index $CADIR/index.valid.txt"
272 for server
in server1
274 SPFX
=$idir/$server.
$iname/$server.
$iname
275 openssl ocsp
-issuer $CADIR/Signer.pem
-sha256 -cert $SPFX.pem
-no_nonce -reqout $SPFX.ocsp.req
276 REQIN
="-reqin $SPFX.ocsp.req"
278 OGENCOMMON
="-rsigner $CADIR/OCSP.pem -rkey $CADIR/OCSP.key -CA $CADIR/Signer.pem -noverify"
279 openssl ocsp
$IVALID $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.good.resp
284 ###############################################################################
286 echo Please to
reset date to now.
287 echo 'service ntpdate start (not on a systemd though...)'
294 # Create CRL files in .der and .pem
295 # empty versions, and ones with the revoked servers
296 DATENOW
=`date -u +%Y%m%d%H%M%SZ`
297 for tld
in com org net
299 CADIR
=example.
$tld/CA
300 CRLIN
=$CADIR/crl.empty.
in.txt
301 echo "update=$DATENOW " >$CRLIN
302 crlutil
-G -d $CADIR -f $CADIR/pwdfile \
303 -n 'Signing Cert rsa' -c $CRLIN -o $CADIR/crl.empty
304 openssl crl
-in $CADIR/crl.empty
-inform der
-out $CADIR/crl.empty.pem
307 DATENOW
=`date -u +%Y%m%d%H%M%SZ`
308 for tld
in com org net
310 CADIR
=example.
$tld/CA
311 CRLIN
=$CADIR/crl.v2.
in.txt
312 echo "update=$DATENOW " >$CRLIN
313 echo "addcert 102 $DATENOW" >>$CRLIN
314 echo "addcert 202 $DATENOW" >>$CRLIN
315 crlutil
-G -d $CADIR -f $CADIR/pwdfile \
316 -n 'Signing Cert rsa' -c $CRLIN -o $CADIR/crl.v2
317 openssl crl
-in $CADIR/crl.v2
-inform der
-out $CADIR/crl.v2.pem
319 CRLIN
=$CADIR/crl.Signer.
in.txt
320 echo "update=$DATENOW " >$CRLIN
321 crlutil
-G -d $CADIR -f $CADIR/pwdfile \
322 -n 'Certificate Authority rsa' -c $CRLIN -o $CADIR/crl.Signer
323 openssl crl
-in $CADIR/crl.Signer
-inform der
-out $CADIR/crl.Signer.pem
325 cat $CADIR/crl.Signer.pem
$CADIR/crl.v2.pem
> $CADIR/crl.chain.pem
328 # Finally, a single certificate-directory
329 cd example.com
/server1.example.com
333 h
=`openssl x509 -hash -noout -in $f`
336 f
=..
/..
/CA
/Signer.pem
337 h
=`openssl x509 -hash -noout -in $f`
345 find example
* -type d
-print0 |
xargs -0 chmod 755
346 find example
* -type f
-print0 |
xargs -0 chmod 644
348 echo "CA, Certificate, CRL and OSCP Response generation complete"