e241b33f26
Some checks failed
codecov / upload (push) Failing after 13m59s
CodeQL / Analyze (push) Failing after 1s
govulncheck / govulncheck (.) (push) Failing after 1s
govulncheck / govulncheck (./cmd/protoc-gen-go-grpc) (push) Failing after 1s
govulncheck / govulncheck (./gcp/observability) (push) Failing after 1s
govulncheck / govulncheck (./security/advancedtls) (push) Failing after 1s
govulncheck / govulncheck (./stats/opencensus) (push) Failing after 1s
Testing / vet-proto (push) Failing after 1s
Testing / tests (arm, latest) (push) Waiting to run
Testing / extras (latest) (push) Failing after 1s
Testing / static checks (latest-1) (push) Failing after 1s
Testing / tests (-race, latest) (push) Failing after 1s
Testing / tests (i386, latest) (push) Failing after 1s
Testing / tests (latest) (push) Failing after 1s
Testing / tests (latest-1) (push) Failing after 1s
Lock Threads / lock (push) Failing after 1s
Stale bot / stale (push) Failing after 1s
49 lines
1.7 KiB
Markdown
49 lines
1.7 KiB
Markdown
About This Directory
|
|
-------------
|
|
This testdata directory contains the certificates used in the tests of package advancedtls.
|
|
|
|
How to Generate Test Certificates Using OpenSSL
|
|
-------------
|
|
|
|
Supposing we are going to create a `subject_cert.pem` that is trusted by `ca_cert.pem`, here are the
|
|
commands we run:
|
|
|
|
1. Generate the private key, `ca_key.pem`, and the cert `ca_cert.pem`, for the CA:
|
|
|
|
```
|
|
$ openssl req -x509 -newkey rsa:4096 -keyout ca_key.pem -out ca_cert.pem -nodes -days $DURATION_DAYS
|
|
```
|
|
|
|
2. Generate a private key `subject_key.pem` for the subject:
|
|
|
|
```
|
|
$ openssl genrsa -out subject_key.pem 4096
|
|
```
|
|
|
|
3. Generate a CSR `csr.pem` using `subject_key.pem`:
|
|
|
|
```
|
|
$ openssl req -new -key subject_key.pem -out csr.pem
|
|
```
|
|
For some cases, we might want to add some extra SAN fields in `subject_cert.pem`.
|
|
In those cases, we can create a configuration file(for example, localhost-openssl.cnf), and do the following:
|
|
```
|
|
$ openssl req -new -key subject_key.pem -out csr.pem -config $CONFIG_FILE_NAME
|
|
```
|
|
|
|
4. Use `ca_key.pem` and `ca_cert.pem` to sign `csr.pem`, and get a certificate, `subject_cert.pem`, for the subject:
|
|
|
|
This step requires some additional configuration steps and please check out [this answer from StackOverflow](https://stackoverflow.com/a/21340898) for more.
|
|
|
|
```
|
|
$ openssl ca -config openssl-ca.cnf -policy signing_policy -extensions signing_req -out subject_cert.pem -in csr.pem -keyfile ca_key.pem -cert ca_cert.pem
|
|
```
|
|
Please see an example configuration template at `openssl-ca.cnf`.
|
|
5. Verify the `subject_cert.pem` is trusted by `ca_cert.pem`:
|
|
|
|
|
|
```
|
|
$ openssl verify -verbose -CAfile ca_cert.pem subject_cert.pem
|
|
|
|
```
|