90 lines
3.0 KiB
Bash
90 lines
3.0 KiB
Bash
|
# * Redistributions in binary form must reproduce the above copyright
|
||
|
|
# notice, this list of conditions and the following disclaimer in the
|
||
|
|
# documentation and/or other materials provided with the distribution.
|
||
|
|
#
|
||
|
|
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||
|
|
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||
|
|
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||
|
|
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
||
|
|
# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||
|
|
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
|
||
|
|
# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||
|
|
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
|
||
|
|
# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
|
||
|
|
# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||
|
|
# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||
|
|
#
|
||
|
|
|
||
|
|
#
|
||
|
|
# Generate the certificates and keys for testing.
|
||
|
|
#
|
||
|
|
|
||
|
|
PROJECT_NAME="Nodemcu Project"
|
||
|
|
|
||
|
|
# Generate the openssl configuration files.
|
||
|
|
cat > ca_cert.conf << EOF
|
||
|
|
[ req ]
|
||
|
|
distinguished_name = req_distinguished_name
|
||
|
|
prompt = no
|
||
|
|
|
||
|
|
[ req_distinguished_name ]
|
||
|
|
O = $PROJECT_NAME Dodgy Certificate Authority
|
||
|
|
EOF
|
||
|
|
|
||
|
|
cat > certs.conf << EOF
|
||
|
|
[ req ]
|
||
|
|
distinguished_name = req_distinguished_name
|
||
|
|
prompt = no
|
||
|
|
|
||
|
|
[ req_distinguished_name ]
|
||
|
|
O = $PROJECT_NAME
|
||
|
|
CN = Nodemcu Client cert
|
||
|
|
EOF
|
||
|
|
|
||
|
|
cat > device_cert.conf << EOF
|
||
|
|
[ req ]
|
||
|
|
distinguished_name = req_distinguished_name
|
||
|
|
prompt = no
|
||
|
|
|
||
|
|
[ req_distinguished_name ]
|
||
|
|
O = $PROJECT_NAME Device Certificate
|
||
|
|
EOF
|
||
|
|
|
||
|
|
# private key generation
|
||
|
|
openssl genrsa -out TLS.ca_key.pem 2048
|
||
|
|
openssl genrsa -out TLS.key_2048.pem 2048
|
||
|
|
|
||
|
|
# convert private keys into DER format
|
||
|
|
openssl rsa -in TLS.key_2048.pem -out TLS.key_2048 -outform DER
|
||
|
|
|
||
|
|
# cert requests
|
||
|
|
openssl req -out TLS.ca_x509.req -sha256 -key TLS.ca_key.pem -new \
|
||
|
|
-config ./ca_cert.conf
|
||
|
|
openssl req -out TLS.x509_2048.req -sha256 -key TLS.key_2048.pem -new \
|
||
|
|
-config ./certs.conf
|
||
|
|
|
||
|
|
# generate the actual certs.
|
||
|
|
openssl x509 -req -in TLS.ca_x509.req -sha256 -out TLS.ca_x509.pem \
|
||
|
|
-sha1 -days 5000 -signkey TLS.ca_key.pem
|
||
|
|
openssl x509 -req -in TLS.x509_2048.req -sha256 -out TLS.x509_2048.pem \
|
||
|
|
-sha1 -CAcreateserial -days 5000 \
|
||
|
|
-CA TLS.ca_x509.pem -CAkey TLS.ca_key.pem
|
||
|
|
|
||
|
|
# some cleanup
|
||
|
|
rm TLS*.req
|
||
|
|
rm *.conf
|
||
|
|
|
||
|
|
openssl x509 -in TLS.ca_x509.pem -outform DER -out TLS.ca_x509.cer
|
||
|
|
openssl x509 -in TLS.x509_2048.pem -outform DER -out TLS.x509_2048.cer
|
||
|
|
|
||
|
|
#
|
||
|
|
# Generate the certificates and keys for encrypt.
|
||
|
|
#
|
||
|
|
|
||
|
|
# set default cert for use in the client
|
||
|
|
xxd -i TLS.x509_2048.cer | sed -e \
|
||
|
|
"s/TLS_x509_2048_cer/default_certificate/" > cert.h
|
||
|
|
# set default key for use in the server
|
||
|
|
xxd -i TLS.key_2048 | sed -e \
|
||
|
|
"s/TLS_key_2048/default_private_key/" > private_key.h
|