1#!/bin/sh 2# Copyright 2013-2023 The OpenSSL Project Authors. All Rights Reserved. 3# 4# Licensed under the Apache License 2.0 (the "License"). You may not use 5# this file except in compliance with the License. You can obtain a copy 6# in the file LICENSE in the source distribution or at 7# https://www.openssl.org/source/license.html 8 9# Utility to recreate S/MIME certificates in this directory. 10# Invoke when changes are need from within this directory. 11 12OPENSSL=../../apps/openssl 13CONF=ca.cnf 14export OPENSSL_CONF=./$CONF 15 16gen() { 17 $OPENSSL x509 -CA smroot.pem -new -days 36524 -force_pubkey $1 -subj "$2" \ 18 -extfile $CONF -extensions $3 19} 20 21# Root CA: create certificate directly 22CN="Test S/MIME RSA Root" $OPENSSL req -config ca.cnf -x509 -noenc \ 23 -keyout smroot.pem -out smroot.pem -key ../certs/ca-key.pem -days 36524 24 25# EE RSA certificates with respective extensions 26cp ../certs/ee-key.pem smrsa1.pem 27gen smrsa1.pem "/CN=Test SMIME EE RSA #1" usr_rsa_cert >>smrsa1.pem 28cp ../certs/ee-key-3072.pem smrsa2.pem 29gen smrsa2.pem "/CN=Test SMIME EE RSA #2" usr_rsa_cert >>smrsa2.pem 30cp ../certs/ee-key-4096.pem smrsa3.pem 31gen smrsa3.pem "/CN=Test SMIME EE RSA #3" usr_rsa_cert >>smrsa3.pem 32 33$OPENSSL x509 -in smrsa3.pem > smrsa3-cert.pem 34$OPENSSL pkey -in smrsa3.pem > smrsa3-key.pem 35 36# Create DSA certificates with respective extensions 37 38cp ../certs/server-dsa-key.pem smdsa1.pem 39gen smdsa1.pem "/CN=Test SMIME EE DSA #1" signer_cert >>smdsa1.pem 40cp ../certs/server-dsa-key.pem smdsa2.pem 41gen smdsa2.pem "/CN=Test SMIME EE DSA #1" signer_cert >>smdsa2.pem 42cp ../certs/server-dsa-key.pem smdsa3.pem 43gen smdsa3.pem "/CN=Test SMIME EE DSA #1" signer_cert >>smdsa3.pem 44 45# Create EC certificates with respective extensions 46 47cp ../certs/ee-ecdsa-key.pem smec1.pem 48gen smec1.pem "/CN=Test SMIME EE EC #1" signer_cert >>smec1.pem 49cp ../certs/server-ecdsa-key.pem smec2.pem 50gen smec2.pem "/CN=Test SMIME EE EC #2" signer_cert >>smec2.pem 51 52# Do not renew this cert as it is used for legacy data decrypt test 53#$OPENSSL ecparam -out ecp.pem -name P-256 54#CN="Test S/MIME EE EC #3" $OPENSSL req -config ca.cnf -noenc \ 55# -keyout smec3.pem -out req.pem -newkey ec:ecp.pem 56#$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 36524 \ 57# -extfile ca.cnf -extensions signer_cert -CAcreateserial >>smec3.pem 58#rm ecp.pem req.pem 59 60# Create X9.42 DH parameters and key. 61$OPENSSL genpkey -genparam -algorithm DHX -out dhp.pem 62$OPENSSL genpkey -paramfile dhp.pem -out smdh.pem 63rm dhp.pem 64# Create X9.42 DH certificate with respective extensions 65gen smdh.pem "/CN=Test SMIME EE DH" dh_cert >>smdh.pem 66 67# EE RSA code signing end entity certificate with respective extensions 68cp ../certs/ee-key.pem csrsa1.pem 69gen csrsa1.pem "/CN=Test CodeSign EE RSA" codesign_cert >>csrsa1.pem 70
