/test/fixtures/keys/Makefile

https://gitlab.com/jbergstroem/node.js · Makefile · 380 lines · 248 code · 79 blank · 53 comment · 0 complexity · f086efeb284d718719857cdd832f60f1 MD5 · raw file 

    

  1. all: agent1-cert.pem agent2-cert.pem agent3-cert.pem agent4-cert.pem agent5-cert.pem ca2-crl.pem ec-cert.pem dh512.pem dh1024.pem dh2048.pem dsa1025.pem dsa_private_1025.pem dsa_public_1025.pem rsa_private_1024.pem rsa_private_2048.pem rsa_private_4096.pem rsa_public_1024.pem rsa_public_2048.pem rsa_public_4096.pem
    2. 

  2. 

  3. 

  4. #
    5. 

  5. # Create Certificate Authority: ca1
    6. 

  6. # ('password' is used for the CA password.)
    7. 

  7. #
    8. 

  8. ca1-cert.pem: ca1.cnf
    9. 

  9. 	openssl req -new -x509 -days 9999 -config ca1.cnf -keyout ca1-key.pem -out ca1-cert.pem
    10. 

  10. 

  11. #
    12. 

  12. # Create Certificate Authority: ca2
    13. 

  13. # ('password' is used for the CA password.)
    14. 

  14. #
    15. 

  15. ca2-cert.pem: ca2.cnf
    16. 

  16. 	openssl req -new -x509 -days 9999 -config ca2.cnf -keyout ca2-key.pem -out ca2-cert.pem
    17. 

  17. 	echo '01' > ca2-serial
    18. 

  18. 	touch ca2-database.txt
    19. 

  19. 

  20. #
    21. 

  21. # Create Subordinate Certificate Authority: ca3
    22. 

  22. # ('password' is used for the CA password.)
    23. 

  23. #
    24. 

  24. ca3-key.pem:
    25. 

  25. 	openssl genrsa -out ca3-key.pem 1024
    26. 

  26. 

  27. ca3-csr.pem: ca3.cnf ca3-key.pem
    28. 

  28. 	openssl req -new \
    29. 

  29. 		-extensions v3_ca \
    30. 

  30. 		-config ca3.cnf \
    31. 

  31. 		-key ca3-key.pem \
    32. 

  32. 		-out ca3-csr.pem
    33. 

  33. 

  34. ca3-cert.pem: ca3-csr.pem ca3-key.pem ca3.cnf ca1-cert.pem ca1-key.pem
    35. 

  35. 	openssl x509 -req \
    36. 

  36. 		-extfile ca3.cnf \
    37. 

  37. 		-extensions v3_ca \
    38. 

  38. 		-days 9999 \
    39. 

  39. 		-passin "pass:password" \
    40. 

  40. 		-in ca3-csr.pem \
    41. 

  41. 		-CA ca1-cert.pem \
    42. 

  42. 		-CAkey ca1-key.pem \
    43. 

  43. 		-CAcreateserial \
    44. 

  44. 		-out ca3-cert.pem
    45. 

  45. 

  46. #
    47. 

  47. # Create Fake CNNIC Root Certificate Authority: fake-cnnic-root
    48. 

  48. #
    49. 

  49. 

  50. fake-cnnic-root-key.pem:
    51. 

  51. 	openssl genrsa -out fake-cnnic-root-key.pem 2048
    52. 

  52. 

  53. fake-cnnic-root-cert.pem: fake-cnnic-root.cnf fake-cnnic-root-key.pem
    54. 

  54. 	openssl req -x509 -new \
    55. 

  55. 	        -key fake-cnnic-root-key.pem \
    56. 

  56. 	        -days 1024 \
    57. 

  57. 	        -out fake-cnnic-root-cert.pem \
    58. 

  58. 	        -config fake-cnnic-root.cnf
    59. 

  59. 

  60. #
    61. 

  61. # Create Fake StartCom Root Certificate Authority: fake-startcom-root
    62. 

  62. #
    63. 

  63. fake-startcom-root-key.pem:
    64. 

  64. 	openssl genrsa -out fake-startcom-root-key.pem 2048
    65. 

  65. 

  66. fake-startcom-root-cert.pem: fake-startcom-root.cnf \
    67. 

  67. 	fake-startcom-root-key.pem
    68. 

  68. 	openssl req -new -x509 -days 9999 -config \
    69. 

  69. 	fake-startcom-root.cnf -key fake-startcom-root-key.pem -out \
    70. 

  70. 	fake-startcom-root-cert.pem
    71. 

  71. 	echo '01' > fake-startcom-root-serial
    72. 

  72. 	touch fake-startcom-root-database.txt
    73. 

  73. 

  74. #
    75. 

  75. # agent1 is signed by ca1.
    76. 

  76. #
    77. 

  77. 

  78. agent1-key.pem:
    79. 

  79. 	openssl genrsa -out agent1-key.pem 1024
    80. 

  80. 

  81. agent1-csr.pem: agent1.cnf agent1-key.pem
    82. 

  82. 	openssl req -new -config agent1.cnf -key agent1-key.pem -out agent1-csr.pem
    83. 

  83. 

  84. agent1-cert.pem: agent1-csr.pem ca1-cert.pem ca1-key.pem
    85. 

  85. 	openssl x509 -req \
    86. 

  86. 		-extfile agent1.cnf \
    87. 

  87. 		-extensions v3_ca \
    88. 

  88. 		-days 9999 \
    89. 

  89. 		-passin "pass:password" \
    90. 

  90. 		-in agent1-csr.pem \
    91. 

  91. 		-CA ca1-cert.pem \
    92. 

  92. 		-CAkey ca1-key.pem \
    93. 

  93. 		-CAcreateserial \
    94. 

  94. 		-out agent1-cert.pem
    95. 

  95. 

  96. agent1-pfx.pem: agent1-cert.pem agent1-key.pem ca1-cert.pem
    97. 

  97. 	openssl pkcs12 -export \
    98. 

  98. 		-descert \
    99. 

  99. 		-in agent1-cert.pem \
    100. 

  100. 		-inkey agent1-key.pem \
    101. 

  101. 		-certfile ca1-cert.pem \
    102. 

  102. 		-out agent1-pfx.pem \
    103. 

  103. 		-password pass:sample
    104. 

  104. 

  105. agent1-verify: agent1-cert.pem ca1-cert.pem
    106. 

  106. 	openssl verify -CAfile ca1-cert.pem agent1-cert.pem
    107. 

  107. 

  108. 

  109. #
    110. 

  110. # agent2 has a self signed cert
    111. 

  111. #
    112. 

  112. # Generate new private key
    113. 

  113. agent2-key.pem:
    114. 

  114. 	openssl genrsa -out agent2-key.pem 1024
    115. 

  115. 

  116. # Create a Certificate Signing Request for the key
    117. 

  117. agent2-csr.pem: agent2-key.pem agent2.cnf
    118. 

  118. 	openssl req -new -config agent2.cnf -key agent2-key.pem -out agent2-csr.pem
    119. 

  119. 

  120. # Create a Certificate for the agent.
    121. 

  121. agent2-cert.pem: agent2-csr.pem agent2-key.pem
    122. 

  122. 	openssl x509 -req \
    123. 

  123. 		-days 9999 \
    124. 

  124. 		-in agent2-csr.pem \
    125. 

  125. 		-signkey agent2-key.pem \
    126. 

  126. 		-out agent2-cert.pem
    127. 

  127. 

  128. agent2-verify: agent2-cert.pem
    129. 

  129. 	openssl verify -CAfile agent2-cert.pem agent2-cert.pem
    130. 

  130. 

  131. #
    132. 

  132. # agent3 is signed by ca2.
    133. 

  133. #
    134. 

  134. 

  135. agent3-key.pem:
    136. 

  136. 	openssl genrsa -out agent3-key.pem 1024
    137. 

  137. 

  138. agent3-csr.pem: agent3.cnf agent3-key.pem
    139. 

  139. 	openssl req -new -config agent3.cnf -key agent3-key.pem -out agent3-csr.pem
    140. 

  140. 

  141. agent3-cert.pem: agent3-csr.pem ca2-cert.pem ca2-key.pem
    142. 

  142. 	openssl x509 -req \
    143. 

  143. 		-days 9999 \
    144. 

  144. 		-passin "pass:password" \
    145. 

  145. 		-in agent3-csr.pem \
    146. 

  146. 		-CA ca2-cert.pem \
    147. 

  147. 		-CAkey ca2-key.pem \
    148. 

  148. 		-CAcreateserial \
    149. 

  149. 		-out agent3-cert.pem
    150. 

  150. 

  151. agent3-verify: agent3-cert.pem ca2-cert.pem
    152. 

  152. 	openssl verify -CAfile ca2-cert.pem agent3-cert.pem
    153. 

  153. 

  154. 

  155. #
    156. 

  156. # agent4 is signed by ca2 (client cert)
    157. 

  157. #
    158. 

  158. 

  159. agent4-key.pem:
    160. 

  160. 	openssl genrsa -out agent4-key.pem 1024
    161. 

  161. 

  162. agent4-csr.pem: agent4.cnf agent4-key.pem
    163. 

  163. 	openssl req -new -config agent4.cnf -key agent4-key.pem -out agent4-csr.pem
    164. 

  164. 

  165. agent4-cert.pem: agent4-csr.pem ca2-cert.pem ca2-key.pem
    166. 

  166. 	openssl x509 -req \
    167. 

  167. 		-days 9999 \
    168. 

  168. 		-passin "pass:password" \
    169. 

  169. 		-in agent4-csr.pem \
    170. 

  170. 		-CA ca2-cert.pem \
    171. 

  171. 		-CAkey ca2-key.pem \
    172. 

  172. 		-CAcreateserial \
    173. 

  173. 		-extfile agent4.cnf \
    174. 

  174. 		-extensions ext_key_usage \
    175. 

  175. 		-out agent4-cert.pem
    176. 

  176. 

  177. agent4-verify: agent4-cert.pem ca2-cert.pem
    178. 

  178. 	openssl verify -CAfile ca2-cert.pem agent4-cert.pem
    179. 

  179. 

  180. #
    181. 

  181. # Make CRL with agent4 being rejected
    182. 

  182. #
    183. 

  183. ca2-crl.pem: ca2-key.pem ca2-cert.pem ca2.cnf
    184. 

  184. 	openssl ca -revoke agent4-cert.pem \
    185. 

  185. 		-keyfile ca2-key.pem \
    186. 

  186. 		-cert ca2-cert.pem \
    187. 

  187. 		-config ca2.cnf \
    188. 

  188. 		-passin 'pass:password'
    189. 

  189. 	openssl ca \
    190. 

  190. 		-keyfile ca2-key.pem \
    191. 

  191. 		-cert ca2-cert.pem \
    192. 

  192. 		-config ca2.cnf \
    193. 

  193. 		-gencrl \
    194. 

  194. 		-out ca2-crl.pem \
    195. 

  195. 		-passin 'pass:password'
    196. 

  196. 

  197. #
    198. 

  198. # agent5 is signed by ca2 (client cert)
    199. 

  199. #
    200. 

  200. 

  201. agent5-key.pem:
    202. 

  202. 	openssl genrsa -out agent5-key.pem 1024
    203. 

  203. 

  204. agent5-csr.pem: agent5.cnf agent5-key.pem
    205. 

  205. 	openssl req -new -config agent5.cnf -key agent5-key.pem -out agent5-csr.pem
    206. 

  206. 

  207. agent5-cert.pem: agent5-csr.pem ca2-cert.pem ca2-key.pem
    208. 

  208. 	openssl x509 -req \
    209. 

  209. 		-days 9999 \
    210. 

  210. 		-passin "pass:password" \
    211. 

  211. 		-in agent5-csr.pem \
    212. 

  212. 		-CA ca2-cert.pem \
    213. 

  213. 		-CAkey ca2-key.pem \
    214. 

  214. 		-CAcreateserial \
    215. 

  215. 		-extfile agent5.cnf \
    216. 

  216. 		-extensions ext_key_usage \
    217. 

  217. 		-out agent5-cert.pem
    218. 

  218. 

  219. agent5-verify: agent5-cert.pem ca2-cert.pem
    220. 

  220. 	openssl verify -CAfile ca2-cert.pem agent5-cert.pem
    221. 

  221. 

  222. #
    223. 

  223. # agent6 is signed by ca3
    224. 

  224. #
    225. 

  225. 

  226. agent6-key.pem:
    227. 

  227. 	openssl genrsa -out agent6-key.pem 1024
    228. 

  228. 

  229. agent6-csr.pem: agent6.cnf agent6-key.pem
    230. 

  230. 	openssl req -new -config agent6.cnf -key agent6-key.pem -out agent6-csr.pem
    231. 

  231. 

  232. agent6-cert.pem: agent6-csr.pem ca3-cert.pem ca3-key.pem
    233. 

  233. 	openssl x509 -req \
    234. 

  234. 		-days 9999 \
    235. 

  235. 		-passin "pass:password" \
    236. 

  236. 		-in agent6-csr.pem \
    237. 

  237. 		-CA ca3-cert.pem \
    238. 

  238. 		-CAkey ca3-key.pem \
    239. 

  239. 		-CAcreateserial \
    240. 

  240. 		-extfile agent6.cnf \
    241. 

  241. 		-out agent6-cert.pem
    242. 

  242. 	cat ca3-cert.pem >> agent6-cert.pem
    243. 

  243. 

  244. agent6-verify: agent6-cert.pem ca3-cert.pem
    245. 

  245. 	openssl verify -CAfile ca3-cert.pem agent6-cert.pem
    246. 

  246. 

  247. #
    248. 

  248. # agent7 is signed by fake-cnnic-root.
    249. 

  249. #
    250. 

  250. 

  251. agent7-key.pem:
    252. 

  252. 	openssl genrsa -out agent7-key.pem 2048
    253. 

  253. 

  254. agent7-csr.pem: agent1.cnf agent7-key.pem
    255. 

  255. 	openssl req -new -config agent7.cnf -key agent7-key.pem -out agent7-csr.pem
    256. 

  256. 

  257. agent7-cert.pem: agent7-csr.pem fake-cnnic-root-cert.pem fake-cnnic-root-key.pem
    258. 

  258. 	openssl x509 -req \
    259. 

  259. 		-extfile agent7.cnf \
    260. 

  260. 		-days 9999 \
    261. 

  261. 		-passin "pass:password" \
    262. 

  262. 		-in agent7-csr.pem \
    263. 

  263. 		-CA fake-cnnic-root-cert.pem \
    264. 

  264. 		-CAkey fake-cnnic-root-key.pem \
    265. 

  265. 		-CAcreateserial \
    266. 

  266. 		-out agent7-cert.pem
    267. 

  267. 

  268. agent7-verify: agent7-cert.pem fake-cnnic-root-cert.pem
    269. 

  269. 	openssl verify -CAfile fake-cnnic-root-cert.pem agent7-cert.pem
    270. 

  270. 

  271. #
    272. 

  272. # agent8 is signed by fake-startcom-root with notBefore
    273. 

  273. # of Oct 20 23:59:59 2016 GMT
    274. 

  274. #
    275. 

  275. 

  276. agent8-key.pem:
    277. 

  277. 	openssl genrsa -out agent8-key.pem 2048
    278. 

  278. 

  279. agent8-csr.pem: agent8.cnf agent8-key.pem
    280. 

  280. 	openssl req -new -config agent8.cnf -key agent8-key.pem \
    281. 

  281. 	-out agent8-csr.pem
    282. 

  282. 

  283. agent8-cert.pem: agent8-csr.pem
    284. 

  284. 	openssl ca \
    285. 

  285. 		-config fake-startcom-root.cnf \
    286. 

  286. 		-keyfile fake-startcom-root-key.pem \
    287. 

  287. 		-cert fake-startcom-root-cert.pem \
    288. 

  288. 		-batch \
    289. 

  289. 		-days 9999 \
    290. 

  290. 		-passin "pass:password" \
    291. 

  291. 		-in agent8-csr.pem \
    292. 

  292. 		-startdate 20161020235959Z \
    293. 

  293. 		-notext -out agent8-cert.pem
    294. 

  294. 

  295. 

  296. agent8-verify: agent8-cert.pem fake-startcom-root-cert.pem
    297. 

  297. 	openssl verify -CAfile fake-startcom-root-cert.pem \
    298. 

  298. 	agent8-cert.pem
    299. 

  299. 

  300. 

  301. #
    302. 

  302. # agent9 is signed by fake-startcom-root with notBefore
    303. 

  303. # of Oct 21 00:00:01 2016 GMT
    304. 

  304. #
    305. 

  305. agent9-key.pem:
    306. 

  306. 	openssl genrsa -out agent9-key.pem 2048
    307. 

  307. 

  308. agent9-csr.pem: agent9.cnf agent9-key.pem
    309. 

  309. 	openssl req -new -config agent9.cnf -key agent9-key.pem \
    310. 

  310. 	-out agent9-csr.pem
    311. 

  311. 

  312. 

  313. agent9-cert.pem: agent9-csr.pem
    314. 

  314. 	openssl ca \
    315. 

  315. 		-config fake-startcom-root.cnf \
    316. 

  316. 		-keyfile fake-startcom-root-key.pem \
    317. 

  317. 		-cert fake-startcom-root-cert.pem \
    318. 

  318. 		-batch \
    319. 

  319. 		-days 9999 \
    320. 

  320. 		-passin "pass:password" \
    321. 

  321. 		-in agent9-csr.pem \
    322. 

  322. 		-startdate 20161021000001Z \
    323. 

  323. 		-notext -out agent9-cert.pem
    324. 

  324. 

  325. ec-key.pem:
    326. 

  326. 	openssl ecparam -genkey -out ec-key.pem -name prime256v1
    327. 

  327. 

  328. ec-csr.pem: ec-key.pem
    329. 

  329. 	openssl req -new -config ec.cnf -key ec-key.pem -out ec-csr.pem
    330. 

  330. 

  331. ec-cert.pem: ec-csr.pem ec-key.pem
    332. 

  332. 	openssl x509 -req \
    333. 

  333. 		-days 9999 \
    334. 

  334. 		-in ec-csr.pem \
    335. 

  335. 		-signkey ec-key.pem \
    336. 

  336. 		-out ec-cert.pem
    337. 

  337. 

  338. dh512.pem:
    339. 

  339. 	openssl dhparam -out dh512.pem 512
    340. 

  340. 

  341. dh1024.pem:
    342. 

  342. 	openssl dhparam -out dh1024.pem 1024
    343. 

  343. 

  344. dh2048.pem:
    345. 

  345. 	openssl dhparam -out dh2048.pem 2048
    346. 

  346. 

  347. dsa1025.pem:
    348. 

  348. 	openssl dsaparam -out dsa1025.pem 1025
    349. 

  349. 

  350. dsa_private_1025.pem:
    351. 

  351. 	openssl gendsa -out dsa_private_1025.pem dsa1025.pem
    352. 

  352. 

  353. dsa_public_1025.pem:
    354. 

  354. 	openssl dsa -in dsa_private_1025.pem -pubout -out dsa_public_1025.pem
    355. 

  355. 

  356. rsa_private_1024.pem:
    357. 

  357. 	openssl genrsa -out rsa_private_1024.pem 1024
    358. 

  358. 

  359. rsa_private_2048.pem:
    360. 

  360. 	openssl genrsa -out rsa_private_2048.pem 2048
    361. 

  361. 

  362. rsa_private_4096.pem:
    363. 

  363. 	openssl genrsa -out rsa_private_4096.pem 4096
    364. 

  364. 

  365. rsa_public_1024.pem: rsa_private_1024.pem
    366. 

  366. 	openssl rsa -in rsa_private_1024.pem -out rsa_public_1024.pem
    367. 

  367. 

  368. rsa_public_2048.pem: rsa_private_2048.pem
    369. 

  369. 	openssl rsa -in rsa_private_2048.pem -out rsa_public_2048.pem
    370. 

  370. 

  371. rsa_public_4096.pem: rsa_private_4096.pem
    372. 

  372. 	openssl rsa -in rsa_private_4096.pem -out rsa_public_4096.pem
    373. 

  373. 

  374. clean:
    375. 

  375. 	rm -f *.pem *.srl ca2-database.txt ca2-serial
    376. 

  376. 

  377. test: agent1-verify agent2-verify agent3-verify agent4-verify agent5-verify
    378. 

  378. 

  379. 

  380. .PHONY: all clean test agent1-verify agent2-verify agent3-verify agent4-verify agent5-verify
    381.