257 lines
9.9 KiB
Bash
Executable File
257 lines
9.9 KiB
Bash
Executable File
|
|
# Example KeyStore Update Script
|
|
#
|
|
# This script is Used to update all example JKS and WKS stores, using example
|
|
# certificates found in wolfSSL proper.
|
|
#
|
|
# Java KeyStores which this script creates includes the following. WKS
|
|
# versions will also be generated of each of these:
|
|
#
|
|
# client.jks RSA 2048-bit and ECC client certs:
|
|
# client-cert.pem, client-ecc-cert.pem
|
|
# client-rsa-1024.jks RSA 1024-bit only client cert:
|
|
# 1024/client-cert.pem, 1024/client-key.pem
|
|
# client-rsa.jks RSA 2048-bit only client cert:
|
|
# client-cert.pem, client-key.pem
|
|
# client-ecc.jks ECC only client cert:
|
|
# client-ecc-cert.pem, ecc-client-key.pem
|
|
# server.jks RSA 2048-bit and ECC server certs:
|
|
# server-cert.pem, server-ecc.pem
|
|
# server-rsa-1024.jks RSA 1024-bit only server cert:
|
|
# 1024/server-cert.pem, 1024/server-key.pem
|
|
# server-rsa.jks RSA 2048-bit only server cert:
|
|
# server-cert.pem, server-key.pem
|
|
# server-ecc.jks ECC only server cert:
|
|
# server-ecc.pem, ecc-key.pem
|
|
# cacerts.jks All CA certs (RSA, ECC, 1024, 2048, etc)
|
|
# ca-client.jks CA certs used to verify client certs:
|
|
# client-cert.pem, client-ecc-cert.pem
|
|
# ca-server.jks CA certs used to verify server certs:
|
|
# ca-cert.pem, ca-ecc-cert.pem
|
|
# ca-server-rsa-2048.jks CA cert used to verify 2048-bit RSA server cert:
|
|
# ca-cert.pem
|
|
# ca-server-ecc-256.jks CA cert used to veirfy ECC P-256 server cert:
|
|
# ca-ecc-cert.pem
|
|
#
|
|
# NOTE: Keystores generated by this script are generated in JKS format,
|
|
# instead of the newer/better PKCS#12 format. The newer format would
|
|
# be preferred, but older versions of keytool do not support PKCS#12
|
|
# format. This would cause test failures in those older environments.
|
|
|
|
printf "Removing and updating example JKS and WKS KeyStore files\n"
|
|
if [ -z "$1" ]; then
|
|
printf "\tNo directory to certs provided\n"
|
|
printf "\tExample use ./update-jks-wks.sh ~/wolfssl/certs\n"
|
|
exit 1;
|
|
fi
|
|
CERT_LOCATION=$1
|
|
|
|
# Export library paths for Linux and Mac to find shared JNI library
|
|
export LD_LIBRARY_PATH=../../lib:$LD_LIBRARY_PATH
|
|
export DYLD_LIBRARY_PATH=../../lib:$DYLD_LIBRARY_PATH
|
|
|
|
# ARGS: <keystore-name> <keystore-type> <cert file> <alias> <password>
|
|
add_cert() {
|
|
keytool -import -keystore "$1" -file "$CERT_LOCATION/$3" -alias "$4" -noprompt -trustcacerts -deststoretype "$2" -storepass "$5" &> /dev/null
|
|
if [ $? -ne 0 ]; then
|
|
printf "fail"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# ARGS: <keystore-name> <keystore-type> <cert file> <key file> <alias> <password>
|
|
add_cert_key() {
|
|
openssl pkcs12 -export -in "$CERT_LOCATION/$3" -inkey "$CERT_LOCATION/$4" -out tmp.p12 -passin pass:"$6" -passout pass:"$6" -name "$5" &> /dev/null
|
|
keytool -importkeystore -deststorepass "$6" -destkeystore "$1" -deststoretype "$2" -srckeystore tmp.p12 -srcstoretype PKCS12 -srcstorepass "$6" -alias "$5" &> /dev/null
|
|
if [ $? -ne 0 ]; then
|
|
printf "fail"
|
|
exit 1
|
|
fi
|
|
rm tmp.p12
|
|
}
|
|
|
|
# ARGS: <keystore-name> <password>
|
|
jks_to_wks() {
|
|
keytool -importkeystore -srckeystore ${1}.jks -destkeystore ${1}.wks -srcstoretype JKS -deststoretype WKS -srcstorepass "$2" -deststorepass "$2" -provider com.wolfssl.provider.jce.WolfCryptProvider --providerpath ../../lib/wolfcrypt-jni.jar &> /dev/null
|
|
if [ $? -ne 0 ]; then
|
|
printf "fail"
|
|
exit 1
|
|
fi
|
|
|
|
}
|
|
|
|
#################### CLIENT KEYSTORES ####################
|
|
|
|
# Client cert: both RSA 2048-bit and ECC
|
|
printf "\tCreating client.jks ..."
|
|
rm client.jks &> /dev/null
|
|
add_cert_key "client.jks" "JKS" "/client-cert.pem" "/client-key.pem" "client" "wolfsslpassword"
|
|
add_cert_key "client.jks" "JKS" "/client-ecc-cert.pem" "/ecc-client-key.pem" "client-ecc" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
printf "\tCreating client.p12 ..."
|
|
rm client.p12 &> /dev/null
|
|
add_cert_key "client.p12" "PKCS12" "/client-cert.pem" "/client-key.pem" "client" "wolfsslpassword"
|
|
add_cert_key "client.p12" "PKCS12" "/client-ecc-cert.pem" "/ecc-client-key.pem" "client-ecc" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
# Client cert: RSA, 1024-bit only
|
|
printf "\tCreating client-rsa-1024.jks ..."
|
|
rm client-rsa-1024.jks &> /dev/null
|
|
add_cert_key "client-rsa-1024.jks" "JKS" "/1024/client-cert.pem" "/1024/client-key.pem" "client-rsa-1024" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
# Client cert: RSA 2048-bit only
|
|
printf "\tCreating client-rsa.jks ..."
|
|
rm client-rsa.jks &> /dev/null
|
|
add_cert_key "client-rsa.jks" "JKS" "/client-cert.pem" "/client-key.pem" "client-rsa" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
# Client cert: ECC only
|
|
printf "\tCreating client-ecc.jks ..."
|
|
rm client-ecc.jks &> /dev/null
|
|
add_cert_key "client-ecc.jks" "JKS" "/client-ecc-cert.pem" "/ecc-client-key.pem" "client-ecc" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
#################### SERVER KEYSTORES ####################
|
|
|
|
# Server cert: both RSA 2048-bit and ECC
|
|
printf "\tCreating server.jks ..."
|
|
rm server.jks &> /dev/null
|
|
add_cert_key "server.jks" "JKS" "/server-cert.pem" "/server-key.pem" "server" "wolfsslpassword"
|
|
add_cert_key "server.jks" "JKS" "/server-ecc.pem" "/ecc-key.pem" "server-ecc" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
# Server cert: RSA, 1024-bit only
|
|
printf "\tCreating server-rsa-1024.jks ..."
|
|
rm server-rsa-1024.jks &> /dev/null
|
|
add_cert_key "server-rsa-1024.jks" "JKS" "/1024/server-cert.pem" "/1024/server-key.pem" "server-1024" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
# Server cert: RSA, 2048-bit only
|
|
printf "\tCreating server-rsa.jks ..."
|
|
rm server-rsa.jks &> /dev/null
|
|
add_cert_key "server-rsa.jks" "JKS" "/server-cert.pem" "/server-key.pem" "server-rsa" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
# Server cert: ECC only
|
|
printf "\tCreating server-ecc.jks ..."
|
|
rm server-ecc.jks &> /dev/null
|
|
add_cert_key "server-ecc.jks" "JKS" "/server-ecc.pem" "/ecc-key.pem" "server-ecc" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
#################### CA CERT KEYSTORES ###################
|
|
|
|
# Contains all CA certs (RSA and ECC), verifies both client and server certs
|
|
printf "\tCreating cacerts.jks ..."
|
|
rm cacerts.jks &> /dev/null
|
|
add_cert_key "cacerts.jks" "JKS" "/ca-cert.pem" "/ca-key.pem" "cacert" "wolfsslpassword"
|
|
add_cert_key "cacerts.jks" "JKS" "/client-cert.pem" "/client-key.pem" "client-rsa" "wolfsslpassword"
|
|
add_cert_key "cacerts.jks" "JKS" "/client-ecc-cert.pem" "/ecc-client-key.pem" "client-ecc" "wolfsslpassword"
|
|
add_cert_key "cacerts.jks" "JKS" "/ca-cert.pem" "/ca-key.pem" "ca-rsa" "wolfsslpassword"
|
|
add_cert_key "cacerts.jks" "JKS" "/ca-ecc-cert.pem" "/ca-ecc-key.pem" "ca-ecc" "wolfsslpassword"
|
|
add_cert_key "cacerts.jks" "JKS" "/1024/ca-cert.pem" "/1024/ca-key.pem" "ca-1024" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
# Contains CA certs used to verify client certs:
|
|
# client-cert.pem verifies itself (self signed)
|
|
# client-ecc-cert.pem verifies itself (self signed)
|
|
printf "\tCreating ca-client.jks ..."
|
|
rm ca-client.jks &> /dev/null
|
|
add_cert_key "ca-client.jks" "JKS" "/client-cert.pem" "/client-key.pem" "client-rsa" "wolfsslpassword"
|
|
add_cert_key "ca-client.jks" "JKS" "/client-ecc-cert.pem" "/ecc-client-key.pem" "client-ecc" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
# Contains CA certs used to verify server certs:
|
|
# ca-cert.pem verifies server-cert.pem
|
|
# ca-ecc-cert.pem verifies server-ecc.pem
|
|
printf "\tCreating ca-server.jks ..."
|
|
rm ca-server.jks &> /dev/null
|
|
add_cert_key "ca-server.jks" "JKS" "/ca-cert.pem" "/ca-key.pem" "ca-rsa" "wolfsslpassword"
|
|
add_cert_key "ca-server.jks" "JKS" "/ca-ecc-cert.pem" "/ca-ecc-key.pem" "ca-ecc" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
# Contains CA cert used to verify RSA 2048-bit server cert:
|
|
# ca-cert.pem verifies server-cert.pem
|
|
printf "\tCreating ca-server-rsa-2048.jks ..."
|
|
rm ca-server-rsa-2048.jks &> /dev/null
|
|
add_cert "ca-server-rsa-2048.jks" "JKS" "/ca-cert.pem" "ca-rsa" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
# Contains CA cert used to verify ECC P-256 server cert:
|
|
# ca-ecc-cert.pem verifies server-ecc.pem
|
|
printf "\tCreating ca-server-ecc-256.jks ..."
|
|
rm ca-server-ecc-256.jks &> /dev/null
|
|
add_cert "ca-server-ecc-256.jks" "JKS" "/ca-ecc-cert.pem" "ca-ecc" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
################### CONVERT JKS TO WKS ###################
|
|
|
|
printf "\nConverting keystores from JKS to WKS ...\n"
|
|
|
|
printf "\tCreating client.wks ..."
|
|
rm client.wks &> /dev/null
|
|
jks_to_wks "client" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
printf "\tCreating client-rsa-1024.wks ..."
|
|
rm client-rsa-1024.wks &> /dev/null
|
|
jks_to_wks "client-rsa-1024" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
printf "\tCreating client-rsa.wks ..."
|
|
rm client-rsa.wks &> /dev/null
|
|
jks_to_wks "client-rsa" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
printf "\tCreating client-ecc.wks ..."
|
|
rm client-ecc.wks &> /dev/null
|
|
jks_to_wks "client-ecc" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
printf "\tCreating server.wks ..."
|
|
rm server.wks &> /dev/null
|
|
jks_to_wks "server" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
printf "\tCreating server-rsa-1024.wks ..."
|
|
rm server-rsa-1024.wks &> /dev/null
|
|
jks_to_wks "server-rsa-1024" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
printf "\tCreating server-rsa.wks ..."
|
|
rm server-rsa.wks &> /dev/null
|
|
jks_to_wks "server-rsa" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
printf "\tCreating server-ecc.wks ..."
|
|
rm server-ecc.wks &> /dev/null
|
|
jks_to_wks "server-ecc" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
printf "\tCreating cacerts.wks ..."
|
|
rm cacerts.wks &> /dev/null
|
|
jks_to_wks "cacerts" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
printf "\tCreating ca-client.wks ..."
|
|
rm ca-client.wks &> /dev/null
|
|
jks_to_wks "ca-client" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
printf "\tCreating ca-server.wks ..."
|
|
rm ca-server.wks &> /dev/null
|
|
jks_to_wks "ca-server" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
printf "\tCreating ca-server-rsa-2048.wks ..."
|
|
rm ca-server-rsa-2048.wks &> /dev/null
|
|
jks_to_wks "ca-server-rsa-2048" "wolfsslpassword"
|
|
printf "done\n"
|
|
|
|
printf "\tCreating ca-server-ecc-256.wks ..."
|
|
rm ca-server-ecc-256.wks &> /dev/null
|
|
jks_to_wks "ca-server-ecc-256" "wolfsslpassword"
|
|
printf "done\n"
|
|
|