mirror of https://github.com/wolfSSL/wolfssh.git
51 lines
2.8 KiB
Bash
Executable File
51 lines
2.8 KiB
Bash
Executable File
touch index.txt
|
|
|
|
# The tracked renewcerts.cnf uses "fred" as the baseline user. When a
|
|
# different user is requested we work from a throwaway copy with the name
|
|
# substituted in, so the tracked config is never modified in place.
|
|
CONFIG="renewcerts.cnf"
|
|
|
|
if [ -z "$1" ]; then
|
|
USER_NAME="fred"
|
|
else
|
|
USER_NAME="$1"
|
|
# Escape characters that are special in a sed replacement (\, /, &) so a
|
|
# user name containing them substitutes literally instead of breaking sed.
|
|
USER_NAME_SED=$(printf '%s' "$USER_NAME" | sed -e 's/[\/&]/\\&/g')
|
|
cp fred-key.der "$USER_NAME-key.der"
|
|
cp fred-key.pem "$USER_NAME-key.pem"
|
|
CONFIG="renewcerts-$USER_NAME.cnf"
|
|
sed "s/fred/$USER_NAME_SED/g" renewcerts.cnf > "$CONFIG"
|
|
fi
|
|
|
|
# renew CA
|
|
openssl req -subj '/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/emailAddress=ca@example.com' -key ca-key-ecc.pem -text -out ca-cert-ecc.pem -config "$CONFIG" -new -nodes -x509 -extensions v3_ca -days 3650 -set_serial 6
|
|
openssl x509 -in ca-cert-ecc.pem -outform DER -out ca-cert-ecc.der
|
|
|
|
# renew user cert
|
|
openssl req -subj "/C=US/ST=WA/L=Seattle/O=wolfSSL Inc/OU=Development/CN=$USER_NAME/emailAddress=$USER_NAME@example.com" -key "$USER_NAME-key.pem" -out "$USER_NAME-cert.csr" -config "$CONFIG" -new -nodes
|
|
|
|
openssl x509 -req -in "$USER_NAME-cert.csr" -days 3650 -extfile "$CONFIG" -extensions "v3_$USER_NAME" -CA ca-cert-ecc.pem -CAkey ca-key-ecc.pem -text -out "$USER_NAME-cert.pem" -set_serial 7
|
|
openssl x509 -in "$USER_NAME-cert.pem" -outform DER -out "$USER_NAME-cert.der"
|
|
|
|
# renew server-cert
|
|
openssl req -subj '/C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC/CN=www.wolfssl.com/emailAddress=server@example.com' -key server-key.pem -out server-cert.csr -config "$CONFIG" -new -nodes
|
|
|
|
openssl x509 -req -in server-cert.csr -days 3650 -extfile "$CONFIG" -extensions v3_server -CA ca-cert-ecc.pem -CAkey ca-key-ecc.pem -text -out server-cert.pem -set_serial 8
|
|
openssl x509 -in server-cert.pem -outform DER -out server-cert.der
|
|
|
|
# renew server-cert-ed25519. Ed25519 has no x509v3-* SSH algorithm name, so
|
|
# this certificate exercises the rejection of an unmappable key type. Its key
|
|
# is not a host key, so it is dropped once the certificate is signed.
|
|
openssl genpkey -algorithm ed25519 -out server-cert-ed25519-key.pem
|
|
openssl req -subj '/C=US/ST=Washington/L=Seattle/O=Eliptic/OU=Ed25519/CN=www.wolfssl.com/emailAddress=server@example.com' -key server-cert-ed25519-key.pem -out server-cert-ed25519.csr -config "$CONFIG" -new -nodes
|
|
|
|
openssl x509 -req -in server-cert-ed25519.csr -days 3650 -extfile "$CONFIG" -extensions v3_server -CA ca-cert-ecc.pem -CAkey ca-key-ecc.pem -text -out server-cert-ed25519.pem -set_serial 9
|
|
openssl x509 -in server-cert-ed25519.pem -outform DER -out server-cert-ed25519.der
|
|
rm -f server-cert-ed25519-key.pem server-cert-ed25519.csr
|
|
|
|
rm index.*
|
|
if [ -n "$1" ]; then
|
|
rm -f "$CONFIG"
|
|
fi
|