3 # Copyright (c) 2011 The Chromium Authors. All rights reserved.
4 # Use of this source code is governed by a BSD-style license that can be
5 # found in the LICENSE file.
7 # This script generates a set of test (end-entity, intermediate, root)
8 # certificates with (weak, strong), (RSA, DSA, ECDSA) key pairs.
10 key_types="768-rsa 1024-rsa 2048-rsa prime256v1-ecdsa"
17 generate_key_command () {
20 echo "dsaparam -genkey"
23 echo "ecparam -genkey"
36 # Create the serial number files.
37 try /bin/sh -c "echo 01 > out/2048-rsa-root-serial"
38 for key_type in $key_types
40 try /bin/sh -c "echo 01 > out/$key_type-intermediate-serial"
43 # Generate one root CA certificate.
44 try openssl genrsa -out out/2048-rsa-root.key 2048
46 CA_COMMON_NAME="2048 RSA Test Root CA" \
54 -key out/2048-rsa-root.key \
56 -out out/2048-rsa-root.csr \
59 CA_COMMON_NAME="2048 RSA Test Root CA" \
64 -in out/2048-rsa-root.csr \
67 -signkey out/2048-rsa-root.key \
68 -out out/2048-rsa-root.pem \
71 # Generate private keys of all types and strengths for intermediate CAs and
73 for key_type in $key_types
75 key_size=$(echo "$key_type" | sed -E 's/-.+//')
76 algo=$(echo "$key_type" | sed -E 's/.+-//')
80 key_size="-name $key_size"
83 try openssl $(generate_key_command $algo) \
84 -out out/$key_type-intermediate.key $key_size
87 for key_type in $key_types
89 key_size=$(echo "$key_type" | sed -E 's/-.+//')
90 algo=$(echo "$key_type" | sed -E 's/.+-//')
94 key_size="-name $key_size"
97 for signer_key_type in $key_types
99 try openssl $(generate_key_command $algo) \
100 -out out/$key_type-ee-by-$signer_key_type-intermediate.key $key_size
104 # The root signs the intermediates.
105 for key_type in $key_types
107 key_size=$(echo "$key_type" | sed -E 's/-.+//')
108 algo=$(echo "$key_type" | sed -E 's/.+-//')
110 CA_COMMON_NAME="$key_size $algo Test intermediate CA" \
115 CERT_TYPE=intermediate \
118 -key out/$key_type-intermediate.key \
119 -out out/$key_type-intermediate.csr \
122 # Make sure the signer's DB file exists.
123 touch out/2048-rsa-root-index.txt
125 CA_COMMON_NAME="2048 RSA Test Root CA" \
133 -extensions ca_cert \
134 -in out/$key_type-intermediate.csr \
135 -out out/$key_type-intermediate.pem \
139 # The intermediates sign the end-entities.
140 for key_type in $key_types
142 for signer_key_type in $key_types
144 key_size=$(echo "$key_type" | sed -E 's/-.+//')
145 algo=$(echo "$key_type" | sed -E 's/.+-//')
146 signer_key_size=$(echo "$signer_key_type" | sed -E 's/-.+//')
147 signer_algo=$(echo "$signer_key_type" | sed -E 's/.+-//')
148 touch out/$signer_key_type-intermediate-index.txt
153 -key out/$key_type-ee-by-$signer_key_type-intermediate.key \
154 -out out/$key_type-ee-by-$signer_key_type-intermediate.csr \
157 CA_COMMON_NAME="$signer_key_size $algo Test intermediate CA" \
160 KEY_SIZE=$signer_key_size \
162 CERT_TYPE=intermediate \
165 -in out/$key_type-ee-by-$signer_key_type-intermediate.csr \
166 -out out/$key_type-ee-by-$signer_key_type-intermediate.pem \
171 # Copy final outputs.
172 try cp out/*root*pem out/*intermediate*pem ../certificates