e241b33f26
Some checks failed
codecov / upload (push) Failing after 13m59s
CodeQL / Analyze (push) Failing after 1s
govulncheck / govulncheck (.) (push) Failing after 1s
govulncheck / govulncheck (./cmd/protoc-gen-go-grpc) (push) Failing after 1s
govulncheck / govulncheck (./gcp/observability) (push) Failing after 1s
govulncheck / govulncheck (./security/advancedtls) (push) Failing after 1s
govulncheck / govulncheck (./stats/opencensus) (push) Failing after 1s
Testing / vet-proto (push) Failing after 1s
Testing / tests (arm, latest) (push) Waiting to run
Testing / extras (latest) (push) Failing after 1s
Testing / static checks (latest-1) (push) Failing after 1s
Testing / tests (-race, latest) (push) Failing after 1s
Testing / tests (i386, latest) (push) Failing after 1s
Testing / tests (latest) (push) Failing after 1s
Testing / tests (latest-1) (push) Failing after 1s
Lock Threads / lock (push) Failing after 1s
Stale bot / stale (push) Failing after 1s
117 lines
4.2 KiB
Bash
Executable File
117 lines
4.2 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# The script contains a sequence of commands described in README.md
|
|
# Generate client/server self signed CAs and certs.
|
|
openssl req -x509 -newkey rsa:4096 \
|
|
-keyout provider_server_trust_key.pem \
|
|
-out provider_server_trust_cert.pem \
|
|
-days 3650 \
|
|
-config provider_ca.cnf \
|
|
-nodes
|
|
|
|
openssl req -x509 -newkey rsa:4096 \
|
|
-keyout provider_client_trust_key.pem \
|
|
-out provider_client_trust_cert.pem \
|
|
-days 3650 \
|
|
-config provider_ca.cnf \
|
|
-nodes
|
|
|
|
openssl req -newkey rsa:4096 \
|
|
-keyout provider_server_cert.key \
|
|
-out provider_new_cert.csr \
|
|
-nodes \
|
|
-subj "/C=US/ST=CA/L=DUMMYCITY/O=Internet Widgits Pty Ltd/CN=foo.bar.com" \
|
|
-sha256
|
|
|
|
openssl x509 -req \
|
|
-in provider_new_cert.csr \
|
|
-out provider_server_cert.pem \
|
|
-CA provider_client_trust_cert.pem \
|
|
-CAkey provider_client_trust_key.pem \
|
|
-CAcreateserial \
|
|
-days 3650 \
|
|
-sha256 \
|
|
-extfile provider_extensions.conf
|
|
|
|
openssl req -newkey rsa:4096 \
|
|
-keyout provider_client_cert.key \
|
|
-out provider_new_cert.csr \
|
|
-nodes \
|
|
-subj "/C=US/ST=CA/O=Internet Widgits Pty Ltd/CN=foo.bar.hoo.com" \
|
|
-sha256
|
|
|
|
openssl x509 -req \
|
|
-in provider_new_cert.csr \
|
|
-out provider_client_cert.pem \
|
|
-CA provider_server_trust_cert.pem \
|
|
-CAkey provider_server_trust_key.pem \
|
|
-CAcreateserial \
|
|
-days 3650 \
|
|
-sha256 \
|
|
-extfile provider_extensions.conf
|
|
|
|
# Generate files need for CRL issuing.
|
|
|
|
echo "1000" > provider_crlnumber.txt
|
|
|
|
touch provider_index.txt
|
|
|
|
# Generate two CRLs.
|
|
|
|
openssl ca -gencrl \
|
|
-keyfile provider_client_trust_key.pem \
|
|
-cert provider_client_trust_cert.pem \
|
|
-out provider_crl_empty.pem \
|
|
-config provider_crl.cnf
|
|
|
|
openssl ca -revoke provider_server_cert.pem \
|
|
-keyfile provider_client_trust_key.pem \
|
|
-cert provider_client_trust_cert.pem \
|
|
-config provider_crl.cnf
|
|
|
|
openssl ca -gencrl \
|
|
-keyfile provider_client_trust_key.pem \
|
|
-cert provider_client_trust_cert.pem \
|
|
-out provider_crl_server_revoked.pem \
|
|
-config provider_crl.cnf
|
|
|
|
# Generate malicious CRLs.
|
|
|
|
openssl genrsa \
|
|
-out provider_malicious_client_trust_key.pem 4096
|
|
|
|
SubjectKeyIdentifier=$(openssl x509 -in provider_client_trust_cert.pem \
|
|
-noout \
|
|
-text \
|
|
| awk '/Subject Key Identifier/ {getline; print $1;}')
|
|
|
|
|
|
sed "s/subjectKeyIdentifier = hash/subjectKeyIdentifier = $SubjectKeyIdentifier/g" \
|
|
provider_extensions.conf > provider_extensions.conf.tmp &&
|
|
mv provider_extensions.conf.tmp provider_extensions.conf
|
|
|
|
openssl req -new \
|
|
-key provider_malicious_client_trust_key.pem \
|
|
-out cert_malicious_request.csr \
|
|
-subj "/C=US/ST=CA/L=SVL/O=Internet Widgits Pty Ltd"
|
|
|
|
openssl x509 -req \
|
|
-in cert_malicious_request.csr \
|
|
-signkey provider_malicious_client_trust_key.pem \
|
|
-out provider_malicious_client_trust_cert.pem \
|
|
-days 3650 \
|
|
-extfile provider_extensions.conf \
|
|
-extensions extensions
|
|
|
|
openssl ca -gencrl \
|
|
-keyfile provider_malicious_client_trust_key.pem \
|
|
-cert provider_malicious_client_trust_cert.pem \
|
|
-out provider_malicious_crl_empty.pem \
|
|
-config provider_crl.cnf
|
|
|
|
sed "s/subjectKeyIdentifier = .*/subjectKeyIdentifier = hash/g" \
|
|
provider_extensions.conf > provider_extensions.conf.tmp &&
|
|
mv provider_extensions.conf.tmp provider_extensions.conf
|
|
|
|
rm -f *.csr provider_{index.txt*,crlnumber.txt*,ca_client.cnf,ca_server.cnf} *.srl
|