2 # Copyright 2013-2016 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the OpenSSL license (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
10 # Utility to recreate S/MIME certificates
12 OPENSSL=../../apps/openssl
16 # Root CA: create certificate directly
17 CN="Test S/MIME RSA Root" $OPENSSL req -config ca.cnf -x509 -nodes \
18 -keyout smroot.pem -out smroot.pem -newkey rsa:2048 -days 3650
20 # EE RSA certificates: create request first
21 CN="Test S/MIME EE RSA #1" $OPENSSL req -config ca.cnf -nodes \
22 -keyout smrsa1.pem -out req.pem -newkey rsa:2048
23 # Sign request: end entity extensions
24 $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
25 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa1.pem
27 CN="Test S/MIME EE RSA #2" $OPENSSL req -config ca.cnf -nodes \
28 -keyout smrsa2.pem -out req.pem -newkey rsa:2048
29 $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
30 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa2.pem
32 CN="Test S/MIME EE RSA #3" $OPENSSL req -config ca.cnf -nodes \
33 -keyout smrsa3.pem -out req.pem -newkey rsa:2048
34 $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
35 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smrsa3.pem
37 # Create DSA parameters
39 $OPENSSL dsaparam -out dsap.pem 2048
41 CN="Test S/MIME EE DSA #1" $OPENSSL req -config ca.cnf -nodes \
42 -keyout smdsa1.pem -out req.pem -newkey dsa:dsap.pem
43 $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
44 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa1.pem
45 CN="Test S/MIME EE DSA #2" $OPENSSL req -config ca.cnf -nodes \
46 -keyout smdsa2.pem -out req.pem -newkey dsa:dsap.pem
47 $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
48 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa2.pem
49 CN="Test S/MIME EE DSA #3" $OPENSSL req -config ca.cnf -nodes \
50 -keyout smdsa3.pem -out req.pem -newkey dsa:dsap.pem
51 $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
52 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdsa3.pem
54 # Create EC parameters
56 $OPENSSL ecparam -out ecp.pem -name P-256
57 $OPENSSL ecparam -out ecp2.pem -name K-283
59 CN="Test S/MIME EE EC #1" $OPENSSL req -config ca.cnf -nodes \
60 -keyout smec1.pem -out req.pem -newkey ec:ecp.pem
61 $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
62 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec1.pem
63 CN="Test S/MIME EE EC #2" $OPENSSL req -config ca.cnf -nodes \
64 -keyout smec2.pem -out req.pem -newkey ec:ecp2.pem
65 $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
66 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec2.pem
67 CN="Test S/MIME EE EC #3" $OPENSSL req -config ca.cnf -nodes \
68 -keyout smec3.pem -out req.pem -newkey ec:ecp.pem
69 $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
70 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smec3.pem
71 # Create X9.42 DH parameters.
72 $OPENSSL genpkey -genparam -algorithm DH -pkeyopt dh_paramgen_type:2 \
74 # Generate X9.42 DH key.
75 $OPENSSL genpkey -paramfile dhp.pem -out smdh.pem
76 $OPENSSL pkey -pubout -in smdh.pem -out dhpub.pem
77 # Generate dummy request.
78 CN="Test S/MIME EE DH #1" $OPENSSL req -config ca.cnf -nodes \
79 -keyout smtmp.pem -out req.pem -newkey rsa:2048
80 # Sign request but force public key to DH
81 $OPENSSL x509 -req -in req.pem -CA smroot.pem -days 3600 \
82 -force_pubkey dhpub.pem \
83 -extfile ca.cnf -extensions usr_cert -CAcreateserial >>smdh.pem
85 rm -f req.pem ecp.pem ecp2.pem dsap.pem dhp.pem dhpub.pem smtmp.pem smroot.srl