Commit eb601ab4 authored by nimrod's avatar nimrod
Browse files

Sign to the short fqdn, add alternative names, correct tests.

parent d9621fa7

Makefile

+8 −8
Original line number Diff line number Diff line
@@ -14,17 +14,17 @@ test: clean 
	./ssl-ca gen www

	test "$$(openssl rsa -noout -check -in keys/www)" = "RSA key ok"

	openssl verify -CAfile CA.crt certs/www

	test "$$(openssl x509 -in certs/www -issuer -noout)" = "issuer= /CN=*.*.ssl-ca"

	test "$$(openssl x509 -in certs/www -subject -noout)" = "subject= /CN=*.*.www.ssl-ca"

	test "$$(openssl x509 -in certs/www -issuer -noout)" = "issuer= /CN=ssl-ca"

	test "$$(openssl x509 -in certs/www -subject -noout)" = "subject= /CN=www.ssl-ca"

	openssl genrsa -out keys/smtp

	./ssl-ca sign

	openssl verify -CAfile CA.crt certs/smtp

	test "$$(openssl x509 -in certs/smtp -issuer -noout)" = "issuer= /CN=*.*.ssl-ca"

	test "$$(openssl x509 -in certs/smtp -subject -noout)" = "subject= /CN=*.*.smtp.ssl-ca"

	test "$$(openssl x509 -in certs/smtp -issuer -noout)" = "issuer= /CN=ssl-ca"

	test "$$(openssl x509 -in certs/smtp -subject -noout)" = "subject= /CN=smtp.ssl-ca"

	./ssl-ca resign

	openssl verify -CAfile CA.crt certs/www

	openssl verify -CAfile CA.crt certs/smtp

	test "$$(openssl x509 -in certs/www -issuer -noout)" = "issuer= /CN=*.*.ssl-ca"

	test "$$(openssl x509 -in certs/www -subject -noout)" = "subject= /CN=*.*.www.ssl-ca"

	test "$$(openssl x509 -in certs/smtp -issuer -noout)" = "issuer= /CN=*.*.ssl-ca"

	test "$$(openssl x509 -in certs/smtp -subject -noout)" = "subject= /CN=*.*.smtp.ssl-ca"
 
	test "$$(openssl x509 -in certs/www -issuer -noout)" = "issuer= /CN=ssl-ca"

	test "$$(openssl x509 -in certs/www -subject -noout)" = "subject= /CN=www.ssl-ca"

	test "$$(openssl x509 -in certs/smtp -issuer -noout)" = "issuer= /CN=ssl-ca"

	test "$$(openssl x509 -in certs/smtp -subject -noout)" = "subject= /CN=smtp.ssl-ca"

ssl-ca

+6 −2
Original line number Diff line number Diff line 
#!/bin/sh -e



test $(which openssl) || ( echo "Can't find openssl."; exit 1)

export domain="$(basename $PWD)"

seed="$(hexdump -n10 -e '10/1 "%02o" "\n"' /dev/urandom)"

config=\

"[ ca ]
@@ -33,13 +32,15 @@ RANDFILE = /dev/urandom 
#O = Organization name

#OU = Organizational unit

#emailAddress = email address

CN = *.*.\${ENV::domain}

CN = \${ENV::domain}



[ v3_ca ]

basicConstraints = CA:true

subjectAltName = DNS:*.\${ENV::domain}, DNS:*.*.\${ENV::domain}



[ v3_req ]

basicConstraints = CA:false

subjectAltName = DNS:*.\${ENV::domain}

"



usage () {
@@ -47,6 +48,7 @@ usage () { 
}



init () {

    export domain="$(basename $PWD)"

    mkdir -p certs keys

    if [ -e openssl.cnf ]

    then
@@ -92,6 +94,7 @@ sign_key () { 
    openssl req \

        -key keys/$1 \

        -new \

        -reqexts v3_req \

        -config openssl.cnf \

        -out "$csr"

    openssl x509 \
@@ -101,6 +104,7 @@ sign_key () { 
        -CA CA.crt \

        -set_serial $seed \

        -extensions v3_req \

        -extfile openssl.cnf \

        -CAkey CA.key

    rm "$csr"

}