1#!/bin/sh 2 3# Utility to recreate S/MIME certificates 4 5OPENSSL=../../apps/openssl 6OPENSSL_CONF=./ca.cnf 7export OPENSSL_CONF 8 9# Root CA: create certificate directly 10CN="Test S/MIME RSA Root" $OPENSSL req -config ca.cnf -x509 -nodes \ 11 -keyout smroot.pem -out smroot.pem -newkey rsa:2048 -days 3650 12 13# EE RSA certificates: create request first 14CN="Test S/MIME EE RSA #1" $OPENSSL req -config ca.cnf -nodes \ 15 -keyout smrsa1.pem -out req.pem -newkey rsa:2048 16# Sign request: end entity extensions 17$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \ 18 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa1.pem 19 20CN="Test S/MIME EE RSA #2" $OPENSSL req -config ca.cnf -nodes \ 21 -keyout smrsa2.pem -out req.pem -newkey rsa:2048 22$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \ 23 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa2.pem 24 25CN="Test S/MIME EE RSA #3" $OPENSSL req -config ca.cnf -nodes \ 26 -keyout smrsa3.pem -out req.pem -newkey rsa:2048 27$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \ 28 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa3.pem 29 30# Create DSA parameters 31 32$OPENSSL dsaparam -out dsap.pem 2048 33 34CN="Test S/MIME EE DSA #1" $OPENSSL req -config ca.cnf -nodes \ 35 -keyout smdsa1.pem -out req.pem -newkey dsa:dsap.pem 36$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \ 37 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa1.pem 38CN="Test S/MIME EE DSA #2" $OPENSSL req -config ca.cnf -nodes \ 39 -keyout smdsa2.pem -out req.pem -newkey dsa:dsap.pem 40$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \ 41 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa2.pem 42CN="Test S/MIME EE DSA #3" $OPENSSL req -config ca.cnf -nodes \ 43 -keyout smdsa3.pem -out req.pem -newkey dsa:dsap.pem 44$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \ 45 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa3.pem 46 47# Create EC parameters 48 49$OPENSSL ecparam -out ecp.pem -name P-256 50$OPENSSL ecparam -out ecp2.pem -name K-283 51 52CN="Test S/MIME EE EC #1" $OPENSSL req -config ca.cnf -nodes \ 53 -keyout smec1.pem -out req.pem -newkey ec:ecp.pem 54$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \ 55 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec1.pem 56CN="Test S/MIME EE EC #2" $OPENSSL req -config ca.cnf -nodes \ 57 -keyout smec2.pem -out req.pem -newkey ec:ecp2.pem 58$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \ 59 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec2.pem 60# Create X9.42 DH parameters. 61$OPENSSL genpkey -genparam -algorithm DH -pkeyopt dh_paramgen_type:2 \ 62 -out dhp.pem 63# Generate X9.42 DH key. 64$OPENSSL genpkey -paramfile dhp.pem -out smdh.pem 65$OPENSSL pkey -pubout -in smdh.pem -out dhpub.pem 66# Generate dummy request. 67CN="Test S/MIME EE DH #1" $OPENSSL req -config ca.cnf -nodes \ 68 -keyout smtmp.pem -out req.pem -newkey rsa:2048 69# Sign request but force public key to DH 70$OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \ 71 -force_pubkey dhpub.pem \ 72 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdh.pem 73# Remove temp files. 74rm -f req.pem ecp.pem ecp2.pem dsap.pem dhp.pem dhpub.pem smtmp.pem smroot.srl 75