@@ -14,11 +14,11 @@ echo 2000 > ./certs/ecc/crlnumber
14
14
# generate ECC 256-bit CA
15
15
if [ -f ./certs/ca-ecc-key.pem ]; then
16
16
openssl req -config ./certs/ecc/wolfssl.cnf -extensions v3_ca -x509 -nodes -key ./certs/ca-ecc-key.pem -out ./certs/ca-ecc-cert.pem -sha256 \
17
- -days 7300 -batch -subj
" /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/[email protected] "
17
+ -days 7300 -batch -subj
" /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/[email protected] "
18
18
else
19
19
openssl ecparam -out ./certs/ca-ecc-key.par -name prime256v1
20
20
openssl req -config ./certs/ecc/wolfssl.cnf -extensions v3_ca -x509 -nodes -newkey ec:./certs/ca-ecc-key.par -keyout ./certs/ca-ecc-key.pem -out ./certs/ca-ecc-cert.pem -sha256 \
21
- -days 7300 -batch -subj
" /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/[email protected] "
21
+ -days 7300 -batch -subj
" /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/[email protected] "
22
22
fi
23
23
24
24
openssl x509 -in ./certs/ca-ecc-cert.pem -inform PEM -out ./certs/ca-ecc-cert.der -outform DER
@@ -43,18 +43,18 @@ openssl x509 -in ./certs/server-ecc.pem -outform der -out ./certs/server-ecc.der
43
43
openssl x509 -req -in ./certs/server-ecc-req.pem -days 3650 -extfile ./certs/ecc/wolfssl.cnf -extensions server_cert -signkey ./certs/ecc-key.pem -text -out ./certs/server-ecc-self.pem
44
44
openssl x509 -inform pem -in ./certs/server-ecc-self.pem -outform der -out ./certs/server-ecc-self.der
45
45
46
- rm ./certs/server-ecc-req.pem
46
+ rm ./certs/server-ecc-req.pem
47
47
48
48
49
49
50
50
# generate ECC 384-bit CA
51
51
if [ -f ./certs/ca-ecc384-key.pem ]; then
52
52
openssl req -config ./certs/ecc/wolfssl_384.cnf -extensions v3_ca -x509 -nodes -key ./certs/ca-ecc384-key.pem -out ./certs/ca-ecc384-cert.pem -sha384 \
53
- -days 7300 -batch -subj
" /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/[email protected] "
53
+ -days 7300 -batch -subj
" /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/[email protected] "
54
54
else
55
55
openssl ecparam -out ./certs/ca-ecc384-key.par -name secp384r1
56
56
openssl req -config ./certs/ecc/wolfssl_384.cnf -extensions v3_ca -x509 -nodes -newkey ec:./certs/ca-ecc384-key.par -keyout ./certs/ca-ecc384-key.pem -out ./certs/ca-ecc384-cert.pem -sha384 \
57
- -days 7300 -batch -subj
" /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/[email protected] "
57
+ -days 7300 -batch -subj
" /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/[email protected] "
58
58
fi
59
59
60
60
openssl x509 -in ./certs/ca-ecc384-cert.pem -inform PEM -out ./certs/ca-ecc384-cert.der -outform DER
@@ -70,48 +70,48 @@ openssl ca -batch -config ./certs/ecc/wolfssl_384.cnf -gencrl -crldays 1000 -out
70
70
# Generate ECC 384-bit server cert
71
71
if [ -f ./certs/server-ecc384-key.pem ]; then
72
72
openssl req -config ./certs/ecc/wolfssl_384.cnf -sha384 -x509 -nodes -key ./certs/server-ecc384-key.pem -out ./certs/server-ecc384-req.pem \
73
- -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC384Srv/CN=www.wolfssl.com/[email protected] /"
73
+ -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC384Srv/CN=www.wolfssl.com/[email protected] /"
74
74
else
75
75
openssl ecparam -out ./certs/server-ecc384-key.par -name secp384r1
76
76
openssl req -config ./certs/ecc/wolfssl_384.cnf -sha384 -x509 -nodes -newkey ec:./certs/server-ecc384-key.par -keyout ./certs/server-ecc384-key.pem -out ./certs/server-ecc384-req.pem \
77
- -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC384Srv/CN=www.wolfssl.com/[email protected] /"
77
+ -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC384Srv/CN=www.wolfssl.com/[email protected] /"
78
78
fi
79
79
openssl req -config ./certs/ecc/wolfssl_384.cnf -sha384 -new -key ./certs/server-ecc384-key.pem -out ./certs/server-ecc384-req.pem \
80
- -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC384Srv/CN=www.wolfssl.com/[email protected] /"
80
+ -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC384Srv/CN=www.wolfssl.com/[email protected] /"
81
81
openssl ec -in ./certs/server-ecc384-key.pem -inform PEM -out ./certs/server-ecc384-key.der -outform DER
82
82
83
83
# Sign server certificate
84
84
openssl ca -batch -config ./certs/ecc/wolfssl_384.cnf -extensions server_cert -days 10950 -notext -md sha384 -in ./certs/server-ecc384-req.pem -out ./certs/server-ecc384-cert.pem
85
85
openssl x509 -in ./certs/server-ecc384-cert.pem -outform der -out ./certs/server-ecc384-cert.der
86
86
87
- rm ./certs/server-ecc384-req.pem
87
+ rm ./certs/server-ecc384-req.pem
88
88
rm ./certs/server-ecc384-key.par
89
89
90
90
# Generate ECC 384-bit client cert
91
91
if [ -f ./certs/client-ecc384-key.pem ]; then
92
92
openssl req -config ./certs/ecc/wolfssl_384.cnf -sha384 -x509 -nodes -key ./certs/client-ecc384-key.pem -out ./certs/client-ecc384-req.pem \
93
- -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC384Cli/CN=www.wolfssl.com/[email protected] /"
93
+ -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC384Cli/CN=www.wolfssl.com/[email protected] /"
94
94
else
95
95
openssl ecparam -out ./certs/client-ecc384-key.par -name secp384r1
96
96
openssl req -config ./certs/ecc/wolfssl_384.cnf -sha384 -x509 -nodes -newkey ec:./certs/client-ecc384-key.par -keyout ./certs/client-ecc384-key.pem -out ./certs/client-ecc384-req.pem \
97
- -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC384Cli/CN=www.wolfssl.com/[email protected] /"
97
+ -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC384Cli/CN=www.wolfssl.com/[email protected] /"
98
98
fi
99
99
openssl req -config ./certs/ecc/wolfssl_384.cnf -sha384 -new -key ./certs/client-ecc384-key.pem -out ./certs/client-ecc384-req.pem \
100
- -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC384Clit/CN=www.wolfssl.com/[email protected] /"
100
+ -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC384Clit/CN=www.wolfssl.com/[email protected] /"
101
101
openssl ec -in ./certs/client-ecc384-key.pem -inform PEM -out ./certs/client-ecc384-key.der -outform DER
102
102
103
103
# Sign client certificate
104
104
openssl ca -batch -config ./certs/ecc/wolfssl_384.cnf -extensions usr_cert -days 10950 -notext -md sha384 -in ./certs/client-ecc384-req.pem -out ./certs/client-ecc384-cert.pem
105
105
openssl x509 -in ./certs/client-ecc384-cert.pem -outform der -out ./certs/client-ecc384-cert.der
106
106
107
- rm ./certs/client-ecc384-req.pem
107
+ rm ./certs/client-ecc384-req.pem
108
108
rm ./certs/client-ecc384-key.par
109
109
110
110
111
111
# Generate ECC Kerberos Keys
112
112
if [ -f ./certs/ecc/secp256k1-key.pem ]; then
113
- openssl ecparam -name secp256k1 -genkey -noout -out ./certs/ecc/secp256k1-key.pem
114
- openssl ec -in ./certs/ecc/secp256k1-key.pem -inform PEM -out ./certs/ecc/secp256k1-key.der -outform DER
113
+ openssl ecparam -name secp256k1 -genkey -noout -out ./certs/ecc/secp256k1-key.pem
114
+ openssl ec -in ./certs/ecc/secp256k1-key.pem -inform PEM -out ./certs/ecc/secp256k1-key.der -outform DER
115
115
fi
116
116
# Create self-signed ECC Kerberos certificates
117
117
openssl req -config ./certs/ecc/wolfssl.cnf -sha256 -new -key ./certs/ecc/secp256k1-key.pem -out ./certs/ecc/server-secp256k1-req.pem -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC256K1-SRV/CN=www.wolfssl.com/[email protected] /"
@@ -126,8 +126,8 @@ rm ./certs/ecc/client-secp256k1-req.pem
126
126
127
127
# Generate ECC Brainpool Keys
128
128
if [ -f ./certs/ecc/bp256r1-key.pem ]; then
129
- openssl ecparam -name brainpoolP256r1 -genkey -noout -out ./certs/ecc/bp256r1-key.pem
130
- openssl ec -in ./certs/ecc/bp256r1-key.pem -inform PEM -out ./certs/ecc/bp256r1-key.der -outform DER
129
+ openssl ecparam -name brainpoolP256r1 -genkey -noout -out ./certs/ecc/bp256r1-key.pem
130
+ openssl ec -in ./certs/ecc/bp256r1-key.pem -inform PEM -out ./certs/ecc/bp256r1-key.der -outform DER
131
131
fi
132
132
# Create self-signed ECC Brainpool certificates
133
133
openssl req -config ./certs/ecc/wolfssl.cnf -sha256 -new -key ./certs/ecc/bp256r1-key.pem -out ./certs/ecc/server-bp256r1-req.pem -subj
" /C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC256BPR1-SRV/CN=www.wolfssl.com/[email protected] /"
@@ -143,7 +143,7 @@ rm ./certs/ecc/client-bp256r1-req.pem
143
143
144
144
# update bad certificate with last byte in signature changed
145
145
cp ./certs/server-ecc.der ./certs/test/server-cert-ecc-badsig.der
146
- sed ' $s/.$/W/' ./certs/test/server-cert-ecc-badsig.der >> ./certs/test/server-cert-ecc-badsig-altered.der
146
+ sed ' $s/.$/W/' ./certs/test/server-cert-ecc-badsig.der >> ./certs/test/server-cert-ecc-badsig-altered.der
147
147
mv ./certs/test/server-cert-ecc-badsig-altered.der ./certs/test/server-cert-ecc-badsig.der
148
148
openssl x509 -inform der -in ./certs/test/server-cert-ecc-badsig.der -outform pem -out ./certs/test/server-cert-ecc-badsig.pem
149
149
0 commit comments