MOD: initial commit
This commit is contained in:
JohnE
commit
8510375d68
|
|
@ -0,0 +1,31 @@
|
|||
# Project specific files
|
||||
sftp-config.json
|
||||
.DS_Store
|
||||
**/var/
|
||||
**/cert_gen/acme.xyz_fl/
|
||||
|
||||
|
||||
# Byte-compiled / optimized / DLL files
|
||||
__pycache__/
|
||||
*.py[cod]
|
||||
*$py.class
|
||||
|
||||
# C extensions
|
||||
*.so
|
||||
|
||||
# Distribution / packaging
|
||||
.Python
|
||||
env/
|
||||
build/
|
||||
develop-eggs/
|
||||
dist/
|
||||
downloads/
|
||||
eggs/
|
||||
.eggs/
|
||||
lib/
|
||||
lib64/
|
||||
parts/
|
||||
sdist/
|
||||
*.egg-info/
|
||||
.installed.cfg
|
||||
*.egg
|
||||
|
|
@ -0,0 +1,77 @@
|
|||
|
||||
============================
|
||||
Certificate Generation
|
||||
Version 3.x
|
||||
============================
|
||||
|
||||
|
||||
-------------
|
||||
INTRO
|
||||
-------------
|
||||
|
||||
This package contains a set of programs to generate an entire certificate chain of trust
|
||||
and will configure StrongSwan server. .p12 files are generated for client distribution.
|
||||
|
||||
Features:
|
||||
* Certificate Authority (CA) creation
|
||||
* Server and Client certificate generation (based on CA)
|
||||
* CA and Client certificate packaged as .p12 file for easy import to Android (other clients too)
|
||||
* Ubuntu networking configuration scripts (tunneling enabled)
|
||||
|
||||
|
||||
|
||||
---------------------
|
||||
VERSIONS
|
||||
---------------------
|
||||
|
||||
Version 3.1 - MOB Hub PKI
|
||||
* PKI Bootstrap
|
||||
- generate an entire chain-of-trust
|
||||
* PKI Lifecycle
|
||||
- generate certificates during the CA's lifecycle
|
||||
Version 3.0 - CA Intermediate Support
|
||||
* requires openssl (does not require ipsec)
|
||||
* CA Intermediate support
|
||||
-root CA can be generated with 5-10yr expiration, put into cold-storage
|
||||
* small to large organizational support
|
||||
|
||||
|
||||
|
||||
---------------------
|
||||
TODO
|
||||
---------------------
|
||||
* SCEP support
|
||||
|
||||
|
||||
|
||||
---------------------
|
||||
TROUBLESHOOTING
|
||||
---------------------
|
||||
|
||||
1) Look at the error log for detailed information:
|
||||
$ tail -n 40 /var/log/syslog
|
||||
|
||||
2) Check the date/time of the device. A common problem is a certificate date/time valid range issue.
|
||||
Make sure your server date is within the CA, and Server certificate valid date.
|
||||
|
||||
|
||||
|
||||
----------------
|
||||
METHODOLOGY
|
||||
----------------
|
||||
|
||||
|
||||
|
||||
|
||||
------------
|
||||
HISTORY
|
||||
------------
|
||||
version 3.x
|
||||
* strongswan: new configuration that uses DN (distinguished name) to authenticate clients
|
||||
(previous configs used local IP address for authentication)
|
||||
* certificate generation moved to another repository
|
||||
- separated into two stages
|
||||
stage 1 : pki bootstrap
|
||||
stage 2 : pki lifecycle
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,82 @@
|
|||
[[[ BeagleBone Black BBB ]]]
|
||||
|
||||
|
||||
[[ Configs ]]
|
||||
|
||||
[ Networking ]
|
||||
USB0: debian@192.168.7.2
|
||||
ETH0: debian@10.10.10.110
|
||||
user: debian
|
||||
pass: temppwd
|
||||
|
||||
screen -L -S bbb /dev/tty.usbserial-AH05JI3A 115200
|
||||
|
||||
|
||||
[ Date / Time ]
|
||||
Fix the date/time of the BeagleBone Black otherwise the certificates won''t work.
|
||||
|
||||
$ date -s '2016-11-09 12:34:56'
|
||||
$ date +%Y%m%d -s "yyyymmdd"
|
||||
$ date +%Y%m%d -s "20100622"
|
||||
|
||||
$ date yymmddhhmmss
|
||||
|
||||
|
||||
[ eMMC ]
|
||||
# Flash the onboard eMMC
|
||||
$ xz -cd bbb.xz | ssh ubuntu@192.168.7.2 'dd of=/dev/mmcblk1 bs=1M'
|
||||
|
||||
# backup eMMC to laptop
|
||||
$ dd if=/dev/mmcblk0 bs=1m | ssh j3g@10.5.1.51 'dd of=~/bbb.img'
|
||||
# compress the .img file
|
||||
$ xz -z bbb.img
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
[[ Software ]]
|
||||
|
||||
[ Drivers ]
|
||||
USB Serial Driver
|
||||
download from my box.com/drivers
|
||||
@ http://www.ftdichip.com/Drivers/VCP.htm
|
||||
|
||||
|
||||
[ Kernel ]
|
||||
Linux Kernel 2.6+ includes IPsec
|
||||
|
||||
|
||||
|
||||
[[ Links ]]
|
||||
|
||||
[ BeageBone Black Wireless ]
|
||||
# general page
|
||||
@ https://beagleboard.org/black-wireless
|
||||
|
||||
# forum
|
||||
@ https://beagleboard.org/discuss#bone_forum_embed
|
||||
|
||||
|
||||
|
||||
[[ Specs ]]
|
||||
@ http://www.armhf.com/boards/beaglebone-black/
|
||||
@ http://elinux.org/BeagleBoardUbuntu
|
||||
|
||||
Ubuntu 14.04 LTS, 4.1.2-bone12.arm
|
||||
Ubuntu Image 2015-07-08
|
||||
|
||||
|
||||
[ Kernel ]
|
||||
# compile the kernel on BBB
|
||||
@ https://help.ubuntu.com/community/Kernel/Compile
|
||||
|
||||
|
||||
[ BBB Linux Source Code ]
|
||||
@ https://github.com/beagleboard/linux
|
||||
|
||||
[ BeagleBone Black Wireless ]
|
||||
1ghz TI AM335x ARM Cortex A8
|
||||
512MB DDR3
|
||||
4GB flash storage internal
|
||||
|
||||
|
|
@ -0,0 +1,78 @@
|
|||
[[[ BeagleBone Black TI OS Development ]]]
|
||||
|
||||
|
||||
[[ TI Arago 3.03 ]]
|
||||
|
||||
user: root
|
||||
|
||||
|
||||
[ Network Interfaces ]
|
||||
|
||||
eth0 Link encap:Ethernet HWaddr 50:65:83:E4:4F:37
|
||||
UP BROADCAST MULTICAST MTU:1500 Metric:1
|
||||
lo Link encap:Local Loopback
|
||||
UP LOOPBACK RUNNING MTU:65536 Metric:1
|
||||
inet addr:127.0.0.1 Mask:255.0.0.0
|
||||
|
||||
|
||||
screen -L -S bbb /dev/tty.usbserial-AH05JI3A 115200
|
||||
|
||||
|
||||
|
||||
[[ Toolchain - (Linaro GCC-based toolchain) ]]
|
||||
|
||||
|
||||
|
||||
[[ StrongSwan Compile ]]
|
||||
|
||||
|
||||
|
||||
|
||||
[[ SDK Install ]]
|
||||
|
||||
1) $ ti-processor-sdk-linux-am335x-evm-03.03.00.04-Linux-x86-Install.bin
|
||||
|
||||
2) $ sudo apt-get install u-boot-tools
|
||||
$ sudo ./setup.sh
|
||||
|
||||
|
||||
|
||||
|
||||
[ Issues ]
|
||||
|
||||
[ uboot-mkimage ]
|
||||
Package uboot-mkimage is not available, but is referred to by another package.
|
||||
This may mean that the package is missing, has been obsoleted, or
|
||||
is only available from another source
|
||||
However the following packages replace it:
|
||||
u-boot-tools:i386 u-boot-tools
|
||||
|
||||
|
||||
|
||||
[[ TI BeableBone Black Dev Board ]]
|
||||
@http://www.ti.com/tool/beaglebk
|
||||
processor: AM335X (1GHz AM3359 Sitara ARM Cortex-A8)
|
||||
|
||||
|
||||
|
||||
[[ Ubuntu LTS 16.04.x ]]
|
||||
release notes: @https://wiki.ubuntu.com/XenialXerus/ReleaseNotes
|
||||
|
||||
SDK requires 16.04.x to work properly
|
||||
|
||||
|
||||
|
||||
[[ PROCESSOR-SDK-LINUX-AM335X 03_03_00_04 ]]
|
||||
|
||||
CPU SDK (AM335X)
|
||||
@http://www.ti.com/tool/processor-sdk-am335x
|
||||
|
||||
XDEV Lab Supported SDK
|
||||
@http://software-dl.ti.com/processor-sdk-linux/esd/AM335X/03_03_00_04/index_FDS.html
|
||||
|
||||
|
||||
Create SD Card ... using SDK
|
||||
@http://processors.wiki.ti.com/index.php/Processor_SDK_Linux_create_SD_card_script
|
||||
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,90 @@
|
|||
[[[ BeagleBone Black Wifi ]]]
|
||||
|
||||
|
||||
[[ Config ]]
|
||||
|
||||
|
||||
[ Network Interfaces ]
|
||||
/etc/network/interfaces
|
||||
USB0: debian@192.168.7.2
|
||||
ETH0: debian@192.168.6.1
|
||||
|
||||
|
||||
[ Serial ]
|
||||
# /dev/tty.usbmodem-XXXX
|
||||
# /dev/tty.usbserial-XXXX
|
||||
# /dev/tty.usbserial-AH05JI3A
|
||||
|
||||
|
||||
# connect to serial device, log to a file ("screenlog.0"), name screen "bbb"
|
||||
# ls /dev/tty.usb*
|
||||
$ screen -L -R bbb /dev/tty.usbserial-AH05JI3A 115200
|
||||
|
||||
user: root
|
||||
|
||||
# screen commands
|
||||
detach: Ctrl+A Ctrl+d
|
||||
exit: Ctrl+A Ctrl+\
|
||||
|
||||
|
||||
|
||||
[ WiFi Access Point ]
|
||||
SSID: BeagleBone-4F37
|
||||
Pass: BeagleBone
|
||||
|
||||
"tether" interface
|
||||
IP: 192.168.0.1
|
||||
|
||||
|
||||
|
||||
[[ WiFi Configs ]]
|
||||
|
||||
|
||||
[ Config X ]
|
||||
$ connmanctl
|
||||
|
||||
connmanctl>
|
||||
connmanctl> scan wifi
|
||||
connmanctl> services
|
||||
.. wifi_506583e44f37_2e2e_managed_psk
|
||||
connmanctl> agent on
|
||||
connmanctl> connect wifi_506583e44f37_2e2e_managed_psk
|
||||
Passphrase? 12345Gledhill12345
|
||||
Connected wifi_506583e44f37_2e2e_managed_psk
|
||||
|
||||
|
||||
[ Config XX ]
|
||||
wpa_supplicant -B -i wlan0 -c < (SSID PASS)
|
||||
|
||||
|
||||
[ Config 1 ]
|
||||
$ vim /etc/network/interaces
|
||||
auto wlan0
|
||||
iface wlan0 inet dhcp
|
||||
wpa-ssid {ssid}
|
||||
wpa-psk {password}
|
||||
|
||||
$ sudo dhclient wlan0
|
||||
|
||||
|
||||
[ Config 2 ]
|
||||
$ sudo ifconfig wlan0 up
|
||||
$ sudo iwlist wlan0 scan
|
||||
$ sudo iwconfig wlan0 essid CrystalWifi key s:newsky12
|
||||
$ sudo dhclient wlan0
|
||||
|
||||
[ Turn off]
|
||||
$ sudo ifconfig wlan0 down
|
||||
|
||||
|
||||
[ Config Option 3 ]
|
||||
$ connmanctl
|
||||
#connmanctl> tether wifi disable
|
||||
#connmanctl> enable wifi
|
||||
#connmanctl> scan wifi
|
||||
#connmanctl> services
|
||||
#connmanctl> agent on
|
||||
#connmanctl> connect wifi_*_managed_psk
|
||||
#connmanctl> quit
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
[[[ Certificate Dev Notes ]]]
|
||||
|
||||
|
||||
|
||||
[[ Steps ]]
|
||||
* install CA certificate
|
||||
* install CA I certificate
|
||||
|
||||
* install .p12 file for client authentication
|
||||
-push .p12 to /data/media/0/Download
|
||||
* install CA I certificate as truste
|
||||
-push ca_i.crt.pem files to /data/media/0/Download
|
||||
|
||||
|
||||
|
||||
[[ Issues ]]
|
||||
|
||||
[ Client Authentication Failure ]
|
||||
|
||||
1. CANNOT AUTHENTICATE SERVER
|
||||
-install CA I certificate (from .pem file)
|
||||
|
||||
2. CANNOT VALIDATE SERVER CERT (timestamp issue)
|
||||
-"subject certificate invalid (valid from May 1 ...)"
|
||||
-fix time on Android device
|
||||
|
||||
3. CONSTRAINT CHECK FAILED
|
||||
"constraint check failed: identity '192.168.123.129' required"
|
||||
-need to add SAN using v3 extensions
|
||||
|
||||
|
|
@ -0,0 +1,149 @@
|
|||
[[[ Certificates ]]]
|
||||
|
||||
|
||||
[[ VPN Two-Factor Authentication (2FA) ]]
|
||||
# example for 2FA
|
||||
http://ocserv.gitlab.io/www/recipes-ocserv-2fa.html
|
||||
|
||||
|
||||
|
||||
[[ OpenSSL ]]
|
||||
# openssl ca (command that uses a text database to create CRLs and certificates with serials)
|
||||
@ https://www.openssl.org/docs/manmaster/man1/ca.html
|
||||
|
||||
# opensll x509
|
||||
@ https://www.openssl.org/docs/manmaster/man1/x509.html
|
||||
|
||||
|
||||
|
||||
[[ Android ]]
|
||||
# Android 7.x changes cert installation behavior changes
|
||||
@ https://stackoverflow.com/questions/39215229/how-to-get-charles-proxy-work-with-android-7-nougat
|
||||
|
||||
"What complicates matters is that the Settings -> Security -> Install from storage
|
||||
does not provide an explicit way for the user to specify whether they are installing
|
||||
a client authentication credential (private key + cert chain) or a server authentication
|
||||
trust anchor (just a CA cert -- no private key needed).
|
||||
As a result, the Settings -> Security -> Install from storage flow guesses whether it''s
|
||||
dealing with client/user authentication credential or server authentication trust anchor
|
||||
by assuming that, if a private key is specified, it must be a client/user authentication credential."
|
||||
|
||||
|
||||
[[ StrongSwan Maintenance Cert ]]
|
||||
|
||||
|
||||
|
||||
[[ StrongSwan CA Intermediates ]]
|
||||
|
||||
|
||||
|
||||
[[ Certificate Attributes ]]
|
||||
@ https://superuser.com/questions/738612/openssl-ca-keyusage-extension#738644
|
||||
# example of configuration options
|
||||
@ https://github.com/JW0914/Wikis/blob/master/Scripts%2BConfigs/OpenSSL/openssl.cnf
|
||||
|
||||
pathLenConstraintof == 0
|
||||
"I.e. a pathLenConstraintof 0 does still allow the CA to issue certificates,
|
||||
but these certificates must be end-entity-certificates (the CA flag in BasicConstraints
|
||||
is false - these are the "normal" certificates that are issued to people or organizations)"
|
||||
|
||||
|
||||
pathLenConstraintof > 0
|
||||
"If the pathLenConstraintof a given CA certificate is > 0, then it expresses the number
|
||||
of possible intermediate CA certificates in a path built from an end-entity certificate
|
||||
up to the CA certificate. Let''s say CA X has a pathLenConstraint of 2, the end-entity
|
||||
certificate is issued to EE. Then the following scenarios are valid (I denoting an
|
||||
intermediate CA certificate)"
|
||||
|
||||
VALID
|
||||
X - EE
|
||||
X - I1 - EE
|
||||
X - I1 - I2 - EE
|
||||
|
||||
INVALID
|
||||
X - I1 - I2 - I3 - EE
|
||||
|
||||
|
||||
|
||||
|
||||
[[ VPN Clients ]]
|
||||
|
||||
[ misc notes ]
|
||||
TUN/TAP
|
||||
"Mac OS X users with OS X 10.6 or older, or using OpenConnect 6.00 or older,
|
||||
will also need to install the Mac OS X tun/tap driver. Newer versions of OpenConnect
|
||||
will use the utun device on OS X which does not require additional kernel modules to
|
||||
be installed."
|
||||
|
||||
|
||||
[ openconnect ]
|
||||
# Support --key-password for GnuTLS PKCS#11 PIN.
|
||||
|
||||
# site
|
||||
@ http://www.infradead.org/openconnect/
|
||||
|
||||
# comments that this works
|
||||
@ https://gist.github.com/moklett/3170636
|
||||
|
||||
# compiling
|
||||
@ http://www.infradead.org/openconnect/building.html
|
||||
|
||||
|
||||
[ tunnelbrick ]
|
||||
@ https://github.com/Tunnelblick/Tunnelblick
|
||||
@ https://www.tunnelblick.net/cInstall.html
|
||||
|
||||
|
||||
|
||||
|
||||
[[ IKEv2 vs OpenVPN ]]
|
||||
@ https://security.stackexchange.com/questions/105967/ikev2-vs-openvpn
|
||||
@ https://security.stackexchange.com/questions/63330/are-there-any-reasons-for-using-ssl-over-ipsec
|
||||
|
||||
|
||||
|
||||
|
||||
[[ CA Intermediate ]]
|
||||
|
||||
[ Links ]
|
||||
# nice tutorial site
|
||||
@ https://roll.urown.net/ca/ca_intermed_setup.html
|
||||
#
|
||||
@ https://jamielinux.com/docs/openssl-certificate-authority/create-the-intermediate-pair.html
|
||||
#
|
||||
@ https://smartnets.wordpress.com/2017/04/27/create-certificate-chain-and-sign-certificates-using-openssl/
|
||||
# simple, direct, examples
|
||||
@ https://wiki.cementhorizon.com/display/CH/Example+CA%2C+Intermediate%2C+and+Server+Certificate
|
||||
# Wiki
|
||||
@ https://en.wikipedia.org/wiki/Certificate_signing_request
|
||||
|
||||
|
||||
[ Example Code ]
|
||||
# Generate CSR & CA_I keys
|
||||
$ openssl req -new -newkey rsa:2048 -nodes -out ca_i.csr -keyout ca_i_key_222.key -subj "/C=US/ST=Railroad/L=Train/O=ACME INC./OU=ACME Flyaway/CN=www.acme.xyz"
|
||||
|
||||
|
||||
# Create CA
|
||||
openssl genrsa -out ca.key 4096
|
||||
openssl req -new -x509 -nodes -sha1 -days 1825 -key ca.key -out ca.crt
|
||||
|
||||
# Create Intermediate
|
||||
openssl genrsa -out intermediate.key 4096
|
||||
openssl req -new -sha1 -key intermediate.key -out intermediate.csr
|
||||
|
||||
# CA signs Intermediate
|
||||
openssl x509 -req -days 1825 -in intermediate.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out intermediate.crt
|
||||
|
||||
# Create Server
|
||||
openssl genrsa -out test.example.com.key 4096
|
||||
openssl req -new -key test.example.com.key -out test.example.com.csr
|
||||
|
||||
# Intermediate signs Server
|
||||
openssl x509 -req -days 1825 -in test.example.com.csr -CA intermediate.crt -CAkey intermediate.key -set_serial 01 -out test.example.com.crt
|
||||
|
||||
|
||||
[ Certificate Signing Request ]
|
||||
# "US", "RailRoad", "City", "ACME", "ACME FLyaway", "flyaway.acme.xyz", "admin@acme.xyz"
|
||||
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
[[[ CA Intermediate StrongSwan Config Notes ]]]
|
||||
|
||||
|
||||
[ Info ]
|
||||
* IKEv2/IPsec
|
||||
|
||||
[ Links ]
|
||||
# Configure
|
||||
@ https://www.digitalocean.com/community/tutorials/how-to-set-up-an-ikev2-vpn-server-with-strongswan-on-ubuntu-16-04
|
||||
|
||||
# strongswan ikev2 setup with lets-encrypt certs
|
||||
@ https://github.com/jawj/IKEv2-setup
|
||||
|
||||
# vpn tech info
|
||||
@ https://www.bestvpn.com/vpn-encryption-the-complete-guide/
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
[[[ Certificate Code Command & Control ]]]
|
||||
|
||||
|
||||
# show the sections of the package file
|
||||
$ openssl pkcs12 -in ~/cert.p12 -nodes -passin pass:"password"
|
||||
|
||||
# show all textual information
|
||||
$ openssl pkcs12 -in ~/cert.p12 -nodes -passin pass:"password" | \
|
||||
openssl x509 -noout -text
|
||||
openssl x509 -noout -subject
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
[[[ Certificate Overlord ]]]
|
||||
|
||||
* GUI with modern design (responsive)
|
||||
-modern form input features: auto complete, highlighting
|
||||
* simple wizard
|
||||
* simple mode for "generate client certificate"
|
||||
* advanced mode for "create template"
|
||||
* uses modern crypto (wolfssl, openssl, can be in FIPS mode)
|
||||
* batch generation from templates
|
||||
* key generation using good random bits
|
||||
* export to .p12 files using password-scheme
|
||||
|
||||
** SCEP support using 3rd party (headless mode)
|
||||
-use the GUI to turn the service on/off
|
||||
-pre-packaged
|
||||
-can use the same CA-I as the GUI, but headless ("keystore")
|
||||
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,99 @@
|
|||
[[[ Certificate Strings Notes ]]]
|
||||
|
||||
|
||||
[ Certificat Chain Example Strings ]
|
||||
# look here to find text of a certificate chain for Apple certs
|
||||
@see ss-vpn/source/ss/dev/screenshots/cert_examples
|
||||
|
||||
* "Apple Root CA" : root certificate authority
|
||||
--> "Developer ID Certificate Authority" : Intermediate Certificate Authority
|
||||
--> "Developer ID Installer: Prolific Tech Inc (2MP849R8J5)"
|
||||
|
||||
|
||||
* "Apple Root CA" : root certificate authority
|
||||
Subject Name:
|
||||
"Common Name" : "Apple Root CA"
|
||||
"Organization Unit" : "Apple Certificate Authority"
|
||||
"Organization" : "Apple Inc."
|
||||
"Country" : "US"
|
||||
Issuer Name:
|
||||
"Common Name" : "Apple Root CA"
|
||||
"Organization Unit" : "Apple Certificate Authority"
|
||||
"Organization" : "Apple Inc."
|
||||
"Country" : "US"
|
||||
"Serial Number" : 2
|
||||
"Version" : 3
|
||||
"Sign Alg" : "SHA-1"
|
||||
Extension Key Usage:
|
||||
Critical : "Yes"
|
||||
Usage : "Key Cert Sign, CRL Sign"
|
||||
Extension Basic Constraint:
|
||||
Critical : "Yes"
|
||||
Certificate Authority : "Yes"
|
||||
|
||||
|
||||
--> "Developer ID Certificate Authority" : Intermediate Certificate Authority
|
||||
Subject Name:
|
||||
"Common Name" : "Developer ID Certificate Authority"
|
||||
"Country" : "US"
|
||||
"Organization" : "Apple Inc."
|
||||
"Organization Unit" : "Apple Certificate Authority"
|
||||
Issuer Name:
|
||||
"Country" : "US"
|
||||
"Organization" : "Apple Inc."
|
||||
"Organization Unit" : "Apple Certificate Authority"
|
||||
"Common Name" : "Apple Root CA"
|
||||
"Serial Number" : 2
|
||||
"Version" : 3
|
||||
"Sign Alg" : "SHA-1"
|
||||
Extension Key Usage:
|
||||
Critical : "Yes"
|
||||
Usage : "Digital Signature, Key Cert Sign, CRL Sign"
|
||||
Extension Basic Constraint:
|
||||
Critical : "Yes"
|
||||
Certificate Authority : "Yes"
|
||||
|
||||
|
||||
--> "Developer ID Installer: Prolific Tech Inc (2MP849R8J5)"
|
||||
Subject Name:
|
||||
"Country": "US"
|
||||
"Organization" : "Apple Inc."
|
||||
"Organization Unit" : "Apple Certificate Authority"
|
||||
"Common Name" : "Developer ID Certificate Authority"
|
||||
Issuer Name:
|
||||
"Country": "US"
|
||||
"Organization" : "Apple Inc."
|
||||
"Organization Unit" : "Apple Certificate Authority"
|
||||
"Common Name" : "Apple Root CA"
|
||||
"Serial Number" : 2
|
||||
"Version" : 3
|
||||
"Sign Alg" : "SHA-1"
|
||||
Extension Key Usage:
|
||||
Critical : "Yes"
|
||||
Usage : "Digital Signature"
|
||||
Extension Basic Constraint:
|
||||
Critical : "Yes"
|
||||
Certificate Authority : "No"
|
||||
|
||||
|
||||
|
||||
|
||||
[ Certificate Serial # ]
|
||||
"
|
||||
In a certificate, the serial number is chosen by the CA which issued the certificate.
|
||||
It is just written in the certificate. The CA can choose the serial number in any way
|
||||
as it sees fit, not necessarily randomly (and it has to fit in 20 bytes). A CA is
|
||||
supposed to choose unique serial numbers, that is, unique for the CA. You cannot count
|
||||
on a serial number being unique worldwide; in the dream world of X.509, it is the pair
|
||||
issuerDN+serial which is unique worldwide (each CA having its own unique distinguished
|
||||
name, and taking care not to reuse serial numbers).
|
||||
|
||||
The thumbprint is a hash value computed over the complete certificate, which includes
|
||||
all its fields, including the signature. That one is unique worldwide, for a given
|
||||
certificate, up to the inherent collision resistance of the used hash function.
|
||||
Microsoft software tends to use SHA-1, for which some theoretical weaknesses are known,
|
||||
but no actual collision has been produced (yet). A collision attack on SHA-1 has now
|
||||
been demonstrated by researchers from CWI and Google.
|
||||
"
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,95 @@
|
|||
openssl pkcs12 -in ca/ca_i_s.p12 -nodes -passin pass:"password"
|
||||
|
||||
MAC verified OK
|
||||
Bag Attributes
|
||||
localKeyID: 3F 42 B6 D2 5A EB 0E 82 20 D3 30 9E 3A C9 5F 8A 81 8A 4E BC
|
||||
friendlyName: CA Intermediate Mobile Provision
|
||||
subject=/C=OO/O=ACME/OU=ACME Intermediate/CN=01001.i.acme.xyz
|
||||
issuer=/C=OO/O=ACME/CN=root.acme.xyz
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFaTCCA1GgAwIBAgICA+kwDQYJKoZIhvcNAQELBQAwNDELMAkGA1UEBhMCT08x
|
||||
DTALBgNVBAoMBEFDTUUxFjAUBgNVBAMMDXJvb3QuYWNtZS54eXowHhcNMTgwNzI0
|
||||
MDQwMjU4WhcNMjAwODEyMDQwMjU4WjBTMQswCQYDVQQGEwJPTzENMAsGA1UECgwE
|
||||
QUNNRTEaMBgGA1UECwwRQUNNRSBJbnRlcm1lZGlhdGUxGTAXBgNVBAMMEDAxMDAx
|
||||
LmkuYWNtZS54eXowggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCbLFcp
|
||||
bOHbGq/tLmVpW1yH7Erpdixw4v+hGoDAZbWpX/lGDOOusgFWjFpp8cASanjL8s2o
|
||||
C8fhnjPSuEqyrMcHqCbJkVu95E62yQ1XdQI3FRJQhhHdaHZeUO///+01+kVGf33b
|
||||
nlMsZhgXmYi4Nb8MC2q88Ydl1gT4w8EUOjE3k0yH86bBO+tzR+33F7d2dLFuF9WJ
|
||||
KZj6Z0EzkOmer6v7k/Ad/lzbypbAY1NFUUn4F+cXI3gvTVHa5oRD7iLS3sXn7cpa
|
||||
E07OWRfoc732x7OVnq0FyUZA2BEC5DFsG1f3P2z04aaDFSRknm0GXYnD5eC6i/M6
|
||||
CLw5+tSTz9ixEC1SKoOZVPaKZUXmTfCtcg+tZ33or+WBIe2bmhkm6vtct9FF4YAx
|
||||
xsSLwxmZOAZ6npwUaasC9a9HXXrOcQV/xWc/QcMhEN/ID88fe+3tYZBtSfMxF5qk
|
||||
3AoTXdQj3YDC3p5qncpeJ91FMs3Szkk6kZ9KJsdoHYdMh3BKBT3ioOrmYMz745Ol
|
||||
SjUhJ/hikPhhNyaxJx242BOxusQPKpSTdt0j7yDG1Mlb+coyJxL1ll55uShWPZ53
|
||||
wUj5tQ5HWAfmTCTwy32AVdFoZwfTppFgeCXcYohonpFHhWbmwRywW8XBCcmnn4o7
|
||||
q5Nd4ZHyTSUrGcMOC2dyHFtHG7OAp9ZaIsMdAQIDAQABo2YwZDASBgNVHRMBAf8E
|
||||
CDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQU+2q/724bafWIAML7
|
||||
TJSAZRViI2UwHwYDVR0jBBgwFoAUpT5k6W9jeOoQvPawsOgE/uqx5PEwDQYJKoZI
|
||||
hvcNAQELBQADggIBAG0N9okW0D9AqRa/mWvGWNxdqfXXw2YJ45Mi15o0P2Z8i6Zc
|
||||
T3y2Kqeeggkxk3nfDpKcfv60Ke8/0+ou2z3C0CsC7+bUSMHKPhRalOvFyZ6I/+hf
|
||||
h9nO89wpjAs6xJRe25pyKHPLXf8JVwLEaO+GJqhrxjEsSXL84vcmwWUg8chhOGdU
|
||||
mBognFtBNfxT6FZmmsZCMkvVtPs7UaPbh3cHCObiAV6uJa06pwCpX+ecNkoaa0+8
|
||||
Zfitp6l0ZHSaFjefZfYmRKjl3xtemdHkK+nzHc257/G0bsc/T63GvW37rPVNKvlP
|
||||
+ce6TBJVxz6cA97iI4GlSqgxcETQzmLn3oTCIUKbKx/V4/84Ffz3boz6Tb2Ry46D
|
||||
R8QcdJUxZVvwgMWJCOt1p8+p9sLIjVXKCpGriSvKTxopETd9GDFKwUUvWaoTv5r/
|
||||
1bdWXQGOHcEA6t0dWQI96pwF9lJJEoOxFwGTFtZxepg2JxFb2knNXQi5Cu/7y6H/
|
||||
foR+Zse4u2laJLRpMLcbnVf5gm90J/YOYOSzOQo0D78duwpKALnhaoHDhSQuMiJr
|
||||
ZGn01mR6Jb64QrBeei0BDrFrfg5da8zJXbXh8afZf4VI8TmaGysrr9zncK31sC+O
|
||||
BXB9aRHAuBHyhjLBiWzOaRg/slrfj+Wo6CaqSx1Zj69Lg9EABmXVHJW5K8Q4
|
||||
-----END CERTIFICATE-----
|
||||
Bag Attributes
|
||||
localKeyID: 3F 42 B6 D2 5A EB 0E 82 20 D3 30 9E 3A C9 5F 8A 81 8A 4E BC
|
||||
friendlyName: CA Intermediate Mobile Provision
|
||||
Key Attributes: <No Attributes>
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQCbLFcpbOHbGq/t
|
||||
LmVpW1yH7Erpdixw4v+hGoDAZbWpX/lGDOOusgFWjFpp8cASanjL8s2oC8fhnjPS
|
||||
uEqyrMcHqCbJkVu95E62yQ1XdQI3FRJQhhHdaHZeUO///+01+kVGf33bnlMsZhgX
|
||||
mYi4Nb8MC2q88Ydl1gT4w8EUOjE3k0yH86bBO+tzR+33F7d2dLFuF9WJKZj6Z0Ez
|
||||
kOmer6v7k/Ad/lzbypbAY1NFUUn4F+cXI3gvTVHa5oRD7iLS3sXn7cpaE07OWRfo
|
||||
c732x7OVnq0FyUZA2BEC5DFsG1f3P2z04aaDFSRknm0GXYnD5eC6i/M6CLw5+tST
|
||||
z9ixEC1SKoOZVPaKZUXmTfCtcg+tZ33or+WBIe2bmhkm6vtct9FF4YAxxsSLwxmZ
|
||||
OAZ6npwUaasC9a9HXXrOcQV/xWc/QcMhEN/ID88fe+3tYZBtSfMxF5qk3AoTXdQj
|
||||
3YDC3p5qncpeJ91FMs3Szkk6kZ9KJsdoHYdMh3BKBT3ioOrmYMz745OlSjUhJ/hi
|
||||
kPhhNyaxJx242BOxusQPKpSTdt0j7yDG1Mlb+coyJxL1ll55uShWPZ53wUj5tQ5H
|
||||
WAfmTCTwy32AVdFoZwfTppFgeCXcYohonpFHhWbmwRywW8XBCcmnn4o7q5Nd4ZHy
|
||||
TSUrGcMOC2dyHFtHG7OAp9ZaIsMdAQIDAQABAoICAQCO8Qqd03o+zteu4mVy50FW
|
||||
yJm9dCm+F62p53MhSNBOZWWIXQlD/R/0bThAjf0EOeZq4ZEHM0r+kDBm9XOCIlz5
|
||||
tbF9TxS22WCVSqGqpdPTj+qeGNLOJZOckGx1Y3lNlu1H4tu6ep9dr/KTktB5+LCz
|
||||
1LSPtuKmMb/EtPbgvjZmXp9KQW2kZaEgQet5CfTr/tUPeI8xWgtc588NRHmgv2zr
|
||||
RD0WNCGwKnAya4zitt4v1zz+eKMW1+AGiQDgXrbfj225l7gmv9CBj1rRvAULFq1c
|
||||
r53tTZsU0rTg9/p6/rlKvreM4Wz1JX2v3qzKB1KIDfO1hIQbOr7BnklCnF2dxiwo
|
||||
LCMTHBxn7HdTcIDg3WdRaaxBCGZJfQauBMr17IIoj1djxaaLKk2wEueqW2YBDN0y
|
||||
F2QlQNgGO4f/LghYsJZA4k3UqC0eQ7cBC5XmeOEljLT0D/8hzTAUOGKXYfpD+tOE
|
||||
EpS+uT/pMUO5qJ7PqZHc44OIfY3VbvV6Tb26scAXMkUNFgZxylGF2xojQSzSVFKe
|
||||
LipYCOFiqq8VOqZmSMuuRBUiunPhH1UT27bg2ugUFkFnVqOteTmzV7Zrk/Avv6ep
|
||||
Sg0n0Ol7p96EcLvW+G3RloiTtqI13roKNm+45b8JiEzo5Rtcaw6Rli1e0P9Cv2aq
|
||||
rA7itoLg7Syn94i9an+ADQKCAQEAztTZTCcyM2PsQhiGl035WmJCanjjFRBVav6q
|
||||
sP37BbMsdPLRZHs10Oa6zuc6qDD/5ovRyGJ0Nys7Yb8SdtyrtK1kkvZmT0j+fvUF
|
||||
psr+HgEPBFDQ+7Fh3ZfH8t/jhRD+89Ap0J989tGQo1ckaDT/C3KxOv7GoqQ+WHUM
|
||||
PsH+t4Q+0bbueMzxJMBiQWrfoB7mzUJAfz8fNhXFUXUdxYQrfWjoPkfMoVjCPr0S
|
||||
w0amp/DkKMDjsxu6pGPkD7NsrHrM/CBE8e1BaRgj/uOcvU/WWF81Y7Mbp7tAkDLK
|
||||
THCyTBCTJ+Lnc1u/TMWPlZapoSQWAOMYA+fBDv6d+seMhpiUtwKCAQEAwA+5TutW
|
||||
/KN8Va+mU0yOuhGZ07LJ7MFGOFxF0ud3ehFMAyvsX9t4/r9OmZA6/B7iPCcZCUA5
|
||||
4oSRi7NGs7oinf88lT5Yhon3rNysC9VN74ex06JcTHPx6mM+s6CHd1bmzUi6ThRL
|
||||
xsaKcu3yWpS5wEp9m9s8ut4uTkThoZ1fjdsawxojRc06aWeyPRKT6HfrHiu5VLT1
|
||||
HeomtoJ7oOlmW4sR6Wq+cGEsmY6+Z4AgdDhvdNxW83G5ELNUZrsR3WhzjHCH5E2r
|
||||
TzDj40Ore1g/ZPyCTg5jKEgTRTIs+Ixx8vw/b466WVbmBFKCzqICNmrYU/R2Oqxj
|
||||
8YkbQnz4XY1UBwKCAQBP3H2+2s+Wajm6V6/4UiI61P/iDqVX58OjmYuc5aR8Ue+T
|
||||
hIJ3ct+Xts9gvoW2lZzpjwlEf0dyWd4G4vklLhWaoOzZlgxxBrVFniQ9f9nZCf2b
|
||||
Y/0dgiNQpZ+N1wcJxUM8Lx9GL57Xypk3iJlFJ1lnOTTXm7Jk8FgmXaOJw+wvPf/n
|
||||
h+PSfweJckM+ER8hu2zQyokO2PebMZLL3hXNwzfrp4stKRoJHrV59hV9kxUceXYP
|
||||
ilMhQE6z1OIlcdk/S/dETs1wQHTmOG0FqStHKcGQw8pgobLG9BV82C+mjkk595hq
|
||||
aUGHGGDoKsxDLTZ4Qu/ADe+i6mRv/r5PK6fF/LpHAoIBAEAS/td9W//c6tYLS4nu
|
||||
uI8K4C7oLsV1lV+oKQM7hXiL3LgSJ0GzjqIuYKKKo6MJCqDWyltzudwALi5VGPlM
|
||||
18+uHyALNK1tyds5o4wvFVkcBA9+0xwOcl6nzXtPyuHddBJ4eO8jhkRCaF3/VCM0
|
||||
CuRD9bPRaGlPRlOGV1/7iK1is4LzbWEUHrCbj7MgR4f+ucnO/H1uAXiBbXjl/yin
|
||||
tSZFNyyQGAiV4rM4E/2jmTAsw8JQ4BFHl14i9b1wG32qIyJvSGa6IrTAssZXBRaZ
|
||||
Ukz2kOJJmnsN0J/9JVOmRz2xOdiV3UWA4CwA+vLEycgtzQ31OJxKdu1VuGpuFs3f
|
||||
IHECggEAHCvk1bye83DETRWhOo5str5QiAN1STcSNhseqji1ElVHIk7PSo8GToFd
|
||||
65cuh5DCbS1sZlUvloao3fYVqZ5v9Z7qn8/59NSkpoG7OCDqL4ezYxk6/Dp+n/V2
|
||||
q3g3nJ/budNT8BMFU2vLVzWPvZgaSajoZG/qVBvgUeswRFAcGxZyg0mT6TDrrHrv
|
||||
TuyHLH7jhPodjFTYYxNrGRZ6yIwhxJgmmQDFROXSixTzhtT9JTbtM+XPRrLLTOIN
|
||||
NKUcT1HpNZczKxm4hpASaGs1EIPmk0nlNCONZByOZxwFT/4SPsoaHMesoBkFGf4L
|
||||
3WcUYO26Cdy4E0fQNkDINROy0rS5RA==
|
||||
-----END PRIVATE KEY-----
|
||||
|
|
@ -0,0 +1,163 @@
|
|||
openssl pkcs12 -in ca/ca_i_s.p12 -nodes -passin pass:"password"
|
||||
|
||||
MAC verified OK
|
||||
Bag Attributes
|
||||
localKeyID: 6E 5B F0 AF 1A 9A 92 CC D9 A5 51 8E 84 3C F5 7A BE 03 99 72
|
||||
friendlyName: Client 1 VPN Certificate
|
||||
subject=/C=OO/O=ACME/OU=ACME Maintenance/CN=client_m
|
||||
issuer=/C=OO/O=ACME/OU=ACME Intermediate/CN=01002.i.acme.xyz
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFEjCCAvoCAgPpMA0GCSqGSIb3DQEBCwUAMFMxCzAJBgNVBAYTAk9PMQ0wCwYD
|
||||
VQQKDARBQ01FMRowGAYDVQQLDBFBQ01FIEludGVybWVkaWF0ZTEZMBcGA1UEAwwQ
|
||||
MDEwMDIuaS5hY21lLnh5ejAeFw0xODA3MjQwNDAzMDFaFw0xOTA3MjQwNDAzMDFa
|
||||
MEoxCzAJBgNVBAYTAk9PMQ0wCwYDVQQKDARBQ01FMRkwFwYDVQQLDBBBQ01FIE1h
|
||||
aW50ZW5hbmNlMREwDwYDVQQDDAhjbGllbnRfbTCCAiIwDQYJKoZIhvcNAQEBBQAD
|
||||
ggIPADCCAgoCggIBALk8RV65kDzZHVk542YrO0okz8KczdWs0aEIGnjZRyoCoBLa
|
||||
YqFTsR9Nj1Zn1rkEcC22EYZO/GCfeSEfywZGvTI1fyZ4fMPC4hKZ6f1CpdgHw+Zu
|
||||
3seAUtkXg2vtb4WMeCAvIN1KlpjxsIwU89RTAhFlJ9eC5s/tqjfb8Sg6ifrxGzCh
|
||||
FuPsiu/1zIFmgUXmK/sWIX3P7YZShaTSiAlKR4M86ZLIhoK4ezCd9hwTmw5zHlQj
|
||||
ktpQBsbpvmzPUpNfkeocUkF88LmlFCvGxXgKePQgWGXmVC2Rlo3kZUmq+r/6JTJv
|
||||
5QcUU9o4Us/G+FJp24+RDSuHP6wQt86REbD2i4XsKa9ldM5ZDPJqa/7eM3C4nvsg
|
||||
9pxfQHDVTmJPmmHscd1/kHXLCzQdt6sB9EhR9lxsPeOs0Bmk3sZ3J4qjq4kNyMxT
|
||||
wfP5wL3TSSHjVSYuGpBqieuRwYrCPZBUG3OpBrWq/a97kSSkzI/pt1w3ySXkQD1s
|
||||
7ZXHWNYrozdhoTB9TkBxQcoO5ALGz92fV75dAOh93oZMXxcQeJgsKY1aLEkgE/+C
|
||||
NbZSeiWpr6Xf6EgJsR839ucEsDi/yUyOcpGA5peCZzpAnZVF8Ga2rHeer7TlIFR6
|
||||
9vOLV1N5TPW9QJjRygKEtb/ykMHCnh0OFdb8OxNNSfLDTDixfgJBqw3FcFUzAgMB
|
||||
AAEwDQYJKoZIhvcNAQELBQADggIBAASuxNTPgjtRHCYJ2spXpf+sFs0uVkoCzi6R
|
||||
2VxI16a0j5zEC8xS9ras+G39o5Om/U8f/dl2K37nmY9kMVk4LwNPXbWgHdTvZd8p
|
||||
G1j7WjrjnbigbKEiQwyXVDz4u9UHZHmAahyez4cz0juTx9M91LIBU03YALKESF40
|
||||
kL/GAXbfVVtCqUuk4FJwYODRcSB3+7Hz4XxObdlwsQGjNdB3tT/oMG2PCWfdhE0I
|
||||
hazzzq+6UOMDrFvhgpYzrfYr+LR/nggYq0P86q8pwiwnccrflhbJq+Ec318WYeqi
|
||||
d3gx/JAmB5Kqtzabo6C3Us0kxlMkTNmNmQ46gqj+GmA4gSZhXbTk3Q1fjwmfTTGR
|
||||
m90+S/mmkO9HISGxJbcC8wf1dksvdt027BYXoJPNXsrxdmlB+an21r9oiCjoI6r5
|
||||
DD2K/iFGah7cRhSdUlPvi924myshKE0KMSg987sPlDFdy6yNGdqq+blL2FlhlMGz
|
||||
g0OVtWzZKWYgQnPsQ/9AGLoQ+kttQrIgkmTd0SdLhT6DSSvK8VwNb9SwpHsp8X2Y
|
||||
68vCjR8NK6FmtOVwRTaJ/EJSHjKv5VEzVR9uZCxtjKJd1qjfhE8mM6ADz9DVKH8k
|
||||
DFq9kjgmTg2YZlVRBFkexYv/jMqs0PrnY3y4RAyVv0kSPYaAJ10AErhCE/VtZJ5e
|
||||
vCWuFzRQ
|
||||
-----END CERTIFICATE-----
|
||||
Bag Attributes
|
||||
friendlyName: client_m@acme.xyz
|
||||
subject=/C=OO/O=ACME/OU=ACME Intermediate/CN=01002.i.acme.xyz
|
||||
issuer=/C=OO/O=ACME/CN=root.acme.xyz
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFaTCCA1GgAwIBAgICA+owDQYJKoZIhvcNAQELBQAwNDELMAkGA1UEBhMCT08x
|
||||
DTALBgNVBAoMBEFDTUUxFjAUBgNVBAMMDXJvb3QuYWNtZS54eXowHhcNMTgwNzI0
|
||||
MDQwMjU5WhcNMjAwODEyMDQwMjU5WjBTMQswCQYDVQQGEwJPTzENMAsGA1UECgwE
|
||||
QUNNRTEaMBgGA1UECwwRQUNNRSBJbnRlcm1lZGlhdGUxGTAXBgNVBAMMEDAxMDAy
|
||||
LmkuYWNtZS54eXowggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDOTPgC
|
||||
OdAt5tJRv8sV5Bv3GQOXCthu9pir4oFnCYf5SO0pqlghsu8JEkg5yASTm5dGJhCE
|
||||
3OnioERC5BRxYJAosDK2VGza+QtMeMxefa6pskEH5tQdKDoxPbyL7aWg5wYuDdQm
|
||||
VqJKIgb/89LM2ABkvJocHq/ytYsyyB+KH359R2qxsaxv0lhYmmdd/4KhKGIOkwlY
|
||||
pl8a6a9Uxz57Zye2U6vZ2pVloF0ClmJIVCYMZ4Hk/V/9Y1BqAQwjvPc8vpP7Oo+7
|
||||
LdY31D/FMXOGMJC0S6G117j5ICbhucTPfE1/QZCWLDlhc/Ixi1M6fgUhQ9Ncg93Q
|
||||
U5xxHMlR43FDzPIKVU2m41fu7bhEBgiqdGmMGl9t+swIR+eONGySfrSLDo0novl/
|
||||
8Qt5sha2zfu92BJ03L4qdWu3B22JsyArE4Ynre6mzgcOpSpx5aluydSvjKwd9AQR
|
||||
RLM6PZMkzaps8bwXuWv5j4PLigbAJo17QQeE8aRpo1HrjAXgXCIEhDHXI6trz+AX
|
||||
bAIIO6DpFYvpMboBhnvwEFQzy78/sYjxsF3wYjPcioPFQy03QvP70W9+HCnfctg+
|
||||
202lbZMsaQbkiCmeif/LpgzpUB5yTYqmQWMd9pfWXD4ERN6gSj1fFx1ValoLmHZ2
|
||||
+EN+56sKlnnmwNITjgSq3Aw1kfuchJ+Xk4NgVQIDAQABo2YwZDASBgNVHRMBAf8E
|
||||
CDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUDYnnqs8iDpzxT/9R
|
||||
m0er88HZGxMwHwYDVR0jBBgwFoAUpT5k6W9jeOoQvPawsOgE/uqx5PEwDQYJKoZI
|
||||
hvcNAQELBQADggIBAKuIrbositQWWM6kmcSO0Ihq6+q8rf+0if/fRZCLWVJxerzw
|
||||
U0FQ8uAmOwQs5GYN/hEqvjMwy0LZ9kI9tqP/hiBwpGuXoCuTdwZrybb3H5z8SQTK
|
||||
xvq5/h3QJJW2BryWn3taJhuJJePnLaYAeVAIp0ema3nmXNPMH4QzDSRNray3rGlG
|
||||
CdIoh7bl5ogxiuGk0oaCcvw/YN0q107+C+OpBlCSrGgJILkYhpu0NNEGlbKJuYOO
|
||||
QvzLBGfVJJpGXBDDYoF8YRXAwGHpGlJHOEOfVm2CjwsQeMfkT/cZnL2I0d58WKyi
|
||||
Yl1qLexyQySpqJf2Es+7hrRyMUoNTMDZ+cVAYJECINbhmCiLNOLcduzwnevDjkuf
|
||||
npd4jj4zwo781iVeyWcRYdhj9bkoyLwi5sHN3ATOEBWWuDDldvUo9fup/+abflwP
|
||||
h8L6km5GV5DR4GUfstAWVJ8GXasKbV5O0SG7c2kjmKGCv9+8OMoRgl+3qnDLZVan
|
||||
ZLgfjeD/6PkoFqLchzeOrKeM5wnUC4SBpAqQEdfhSMMGHr4ByxgfOUaddMXlrXmp
|
||||
JMOBT3Kxdoye49BrlUjzkd/wLVp0BeGIv9Qo39F4sd6sgGTCj+c70qPf/rWPxzbe
|
||||
6RL7PGxTvU7EQ7+ToCUHkrx5mUWjQXKQu7h0LPgfKDvrk3oDIh0QUDgnOOTX
|
||||
-----END CERTIFICATE-----
|
||||
Bag Attributes: <No Attributes>
|
||||
subject=/C=OO/O=ACME/CN=root.acme.xyz
|
||||
issuer=/C=OO/O=ACME/CN=root.acme.xyz
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFTjCCAzagAwIBAgIJAKcONZlUpZgaMA0GCSqGSIb3DQEBCwUAMDQxCzAJBgNV
|
||||
BAYTAk9PMQ0wCwYDVQQKDARBQ01FMRYwFAYDVQQDDA1yb290LmFjbWUueHl6MB4X
|
||||
DTE4MDcyNDA0MDI1OFoXDTI4MDcyMTA0MDI1OFowNDELMAkGA1UEBhMCT08xDTAL
|
||||
BgNVBAoMBEFDTUUxFjAUBgNVBAMMDXJvb3QuYWNtZS54eXowggIiMA0GCSqGSIb3
|
||||
DQEBAQUAA4ICDwAwggIKAoICAQDwdFus1b2FSJlhCxNu2UyExezoZbvjx1mjtCal
|
||||
NTD3+Yrr0uXA2uPFn8wNZ5CkKH4vEE1qLsJYQtBmeOj7K4qTU2VkFFL3JWzFXgUC
|
||||
pNJVzZ0PGwMIyhiW/N5mJkPydpdynqQl3HltylEtXoCtqGiW+2EbNCCEpwiuhOcM
|
||||
3Pyld2SYpJ/NnDsVkydb6AESbFSsLa5VSypCmaRt8HNIGX6owsuNkD9tiAklK3mL
|
||||
MtnawH87czuOXXe3eIYpcGuPtWrIRzz9qFpxymhMoTlbBcVqme0WqdN6KrLbqkRL
|
||||
CiSev+R6FI1yskN+vOjJ9h77md334p/5ZVDXmVLY1hQyaWNhVhwCgsZyvAT8Oaok
|
||||
Ozh+8KtEnVDHzt47kMdxuwPzSOvDFScCMasg5Nvs2Kl896HY8n4YMPukC8+KaCae
|
||||
cF+sC7z01TKIpgUOeTmBIU6aYQKCfWSQgf/7WjrO2faKGtSqUcSKPAX6KzpPfQ6e
|
||||
+sz+/OZjQZCMrjsxTfcd00IKBLZQmoFC5dPkg4MXVrjL8O2FeY3NfuYmEaRyINv/
|
||||
UqlcEzaDsXSPpfmDnaQVuh8CARbushDjomYOKl5J3JPW/SctqF7P/ENG2NXzgTSA
|
||||
dmjMhN1HOXaVWuCgPYFnDu8p/P7p4DVGZcEoH2jEZKcu65JeTJnKAlbYu92nkjsD
|
||||
8W6U2QIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAd
|
||||
BgNVHQ4EFgQUpT5k6W9jeOoQvPawsOgE/uqx5PEwHwYDVR0jBBgwFoAUpT5k6W9j
|
||||
eOoQvPawsOgE/uqx5PEwDQYJKoZIhvcNAQELBQADggIBACFLzG5R7HhIIgJszLtZ
|
||||
qr5zYZhnzWBDEVrGHpPVqUlRx3eleSgT4RAa/hpEklkJTKIAcoZpE0jvzdjegr+C
|
||||
Kb/AveXSTjTok4rie+Cgo3aFLEJ7qtnxxLXi4o/Pgsv1L12VfXl6qy53isrUhlPv
|
||||
1d/y+Bccl36TuEyuy9eAktdT+cPHR7Gn9RK2lnKLTxCR/mBlbDCg/u6s7SA90hky
|
||||
ZPUesfO6XaFIjaZMQlAwbz4/O44sYSj+Fuuh2wQgIZAp+5tgFXHmHZvH8b5exZlZ
|
||||
PEmyA6qgtQ2F620pUoUVTxSiEKjTHE+qNOr5ZdyY7NH4X9fVG7jBdxfaUP7gDrv6
|
||||
sGtL2bbMc1u3+qnNKA6MeS+UGxEKe46kTzNcFu8aXnhxt6McMs6/l72K52jxhvVn
|
||||
yI+KvTGeqN1H4qI3RjTL7uQWyHZhkw6TsRLRBfqhU6BxRLq+EH0vHECB7usFLhr+
|
||||
BEqRNnNgrqZMS4quhBCRifpxORThoPjNeWVs9pcsBTSR2JgP7blSMkdwxcqXXezB
|
||||
/PRJKtm2MPuhqvUKrwIzJ5IkwBvATwUkOmBDm6kejTZLmqZ4w47iswSvYxdtmZpM
|
||||
ZORP9wgpuXRu2un7q2xERjlJA7bmw8y+NSweCTWLGLTeQzBzcEOEneNixjklCDXy
|
||||
sITp+32xUz86IxAbwYuFb0gn
|
||||
-----END CERTIFICATE-----
|
||||
Bag Attributes
|
||||
localKeyID: 6E 5B F0 AF 1A 9A 92 CC D9 A5 51 8E 84 3C F5 7A BE 03 99 72
|
||||
friendlyName: Client 1 VPN Certificate
|
||||
Key Attributes: <No Attributes>
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQC5PEVeuZA82R1Z
|
||||
OeNmKztKJM/CnM3VrNGhCBp42UcqAqAS2mKhU7EfTY9WZ9a5BHAtthGGTvxgn3kh
|
||||
H8sGRr0yNX8meHzDwuISmen9QqXYB8Pmbt7HgFLZF4Nr7W+FjHggLyDdSpaY8bCM
|
||||
FPPUUwIRZSfXgubP7ao32/EoOon68RswoRbj7Irv9cyBZoFF5iv7FiF9z+2GUoWk
|
||||
0ogJSkeDPOmSyIaCuHswnfYcE5sOcx5UI5LaUAbG6b5sz1KTX5HqHFJBfPC5pRQr
|
||||
xsV4Cnj0IFhl5lQtkZaN5GVJqvq/+iUyb+UHFFPaOFLPxvhSaduPkQ0rhz+sELfO
|
||||
kRGw9ouF7CmvZXTOWQzyamv+3jNwuJ77IPacX0Bw1U5iT5ph7HHdf5B1yws0Hber
|
||||
AfRIUfZcbD3jrNAZpN7GdyeKo6uJDcjMU8Hz+cC900kh41UmLhqQaonrkcGKwj2Q
|
||||
VBtzqQa1qv2ve5EkpMyP6bdcN8kl5EA9bO2Vx1jWK6M3YaEwfU5AcUHKDuQCxs/d
|
||||
n1e+XQDofd6GTF8XEHiYLCmNWixJIBP/gjW2Unolqa+l3+hICbEfN/bnBLA4v8lM
|
||||
jnKRgOaXgmc6QJ2VRfBmtqx3nq+05SBUevbzi1dTeUz1vUCY0coChLW/8pDBwp4d
|
||||
DhXW/DsTTUnyw0w4sX4CQasNxXBVMwIDAQABAoICAQCN1Hw5H1Q1gvhZzV00aX2o
|
||||
M69wj6d7KCwKZK4AQj2fCQuP4+8JH4/LLBPIURGz8JYEKhgZAnlzcifJGRLW52sN
|
||||
+rA0wKSnL5zyKS9kX5ekZa21zsZ9ct/8oWhbRx3Q39FKs0sypV3SFZzcZV6dAEHh
|
||||
F9b9yJj6NDvVMW7hIpFrtxjejzl7oy5utYG0wsvQvYCHbFaQgpiX9K+nmBvZISrI
|
||||
bedaIHf9t0t72jcLIGflFHfwbJyQ1B2cSHUp00Si2tZarvy8b/HR83gSXMvuMfaS
|
||||
1gFZZJannYXtdyem1GfSfrHkgJCYbxQVTnL57JtOXwdiUeoHnjM+iD50x9cH7H6+
|
||||
6hh82yd/hlO+boDZ5847Dr18CYvXGRgFkZSndwUAqBy6jnSvITbsE4QeHajTx8Q2
|
||||
gRePIqMq0ZEe9RumXd3Eg1l9A3CbNDb65oMCtE2d4bhdCFxDrsYDylE8YzX0O5Ao
|
||||
Wa5ugOFNu0VP00JeCjhKxAjb2lxFHEFSHrqzwNHLeAYfxLAy96p5b9NzSqe4Ud23
|
||||
v1Yo7rXefl6OPoooEmdHwjIQOm/gSXuRljfp1EI0/7wsN4wzgQYHklnGflQuy9Mw
|
||||
TtZjHi5TJ28KfIHy/WttHFrEb9on2DoV00XhQjTh9yzBlbIXga3QeLpGuJPKd84t
|
||||
106RJn0V+AkeD59+s8sAoQKCAQEA5xdxddhthlTnQl0930LeYgbyP59tUxj3pGPs
|
||||
zhxS4DnLlRG5nk4CPB4ASdjcWaGNVXee2IgBZR3dO9NtWiW6fJO611wyj1XEw4zw
|
||||
f2ZQN34eFlrxrt7WhFlyIl5S4vPAXdBtFUcROy5kj/TXizHSzBubGrrnKUyUXlqj
|
||||
ELL28z0AIpKj7+Zs8rQCmjW59Z7L+Cif37CTAk9GdY9LrLJ47RHMI0VjiGHrYmWG
|
||||
pTyR1pVpXVV9wQ/+Y6N9X19r9Ea26jajAiK6A13tsqp+J03AhC6OHcuE3PqlEgex
|
||||
C2+roRjo83DMEYOm9L3jmj6HxtLJHQJnHVNd0Svo0D3EqYfZLQKCAQEAzTOCi2m3
|
||||
LJ0Kt2rOQbrJKmk1OoSLUjGkhsE7gxomaFO6RipDqhs4ubRZrP2unWEfdrHxWvP4
|
||||
t5n5A9mtiIRYjO6fgrxTtLoyEdkAMZagqjKVdxer8C6VON2n2sERvyy2MfC2VSYb
|
||||
Lz1YTaXHe3C13Ds+vb1jVcFqBd3cZPt3lhlfwohBfKYy6AVkd720MrQd9z4nNfpX
|
||||
I6ofQ0NFRC5w3289pzfa1TeJOOUw5n5cqo/nyk2bO8guUXKit67SiRWFNCSp1N5k
|
||||
i9dA2/KMuR7DbK3Gt8gn9dYW9aYDVP8LXwVqcks7UtTQAFPE4DUVEoy6O7m3vdDg
|
||||
Ua8FIoHDCq0j3wKCAQApzyr+6C5AnIHOlvIHv6BeWeVgL2bnHuBHBLEmRSeVW7+C
|
||||
c9eCVZi/6amhsrODH+BjMyYxBMJD2hhZp5HkOmk3+r5WEl8vYZQc0RX95rPiplWp
|
||||
M8EAI17qSQiGQUx7tR/7mSbzL41liKo3BVQt4dDCjsgMGP6TkUBSpdFUxxw4u7OX
|
||||
jbJNSAI0Eu9ZmRjQ4G8Esczi+p5OT6tuv4MwdoW8Vnj5dKdiWFzuy3GF2aSFDzkl
|
||||
4r7CvDMJMd4P8EKmylhznXj2fPPsggTsSz5RvBZ1k7qwl06tcEeHMI8Og6Con8od
|
||||
qS2yiYAeTXCtSlzkUuSB9BpVyuxxWKFhc5tuFJ7tAoIBAQCLrvi6dige0ngtCyOE
|
||||
UuYFXMDDKN6+ANUCdh9Qy0hB1F0EzlhpP0aKA17YB4gJ0cddQRwO0e0I7mM4X8Fl
|
||||
INI2fWlP0WsZp3XV+GXNW7/am7xq6U49nTgvEZPlsW+nN4R+0mEL7Xir25J0qNj2
|
||||
Cm+Bj0LSXk10XskRXUld5GAvaO5qud36QBh/IMyXRieYLEwJteFzOQqAWJoXa3+H
|
||||
PiXPsyXA4qCwa7GZbUqwXGwwHu2mJNX7B/Wfs+1YJEVk06VtLVf+c7T2DH02PBHX
|
||||
Ij3diR2wlSu+iRHv/iZegY74C/O+AcBMTlmZH2zxQrEpg2pypaWSLNHGSOGx76sZ
|
||||
ZWr5AoIBAD8ZRn0EruCKcmxRucR5Ybbp7uSxBGlA2LHq10MAz1moanVSk+hZAzkw
|
||||
7mhn/vtTzBfTn0InKgHE4XNF35nY0ndxZKnreS5t4vYdFXyhT0yuJiKo42LpPP8+
|
||||
GKG0H7d+mypKbgRWaWpVV6S3Rhcg7T6r8xoMM6h18Eae0oBmQ9vbAOkgV9wm+dxD
|
||||
LThzcMidgya4a6AmEXmep8SUkTipdvNq8WIC1UY3azxuhr1nuM7QTfRZh9gI9uzc
|
||||
08t2qiT/h1UN2zo/i4BvkAzZ/uRgaRa2MKVz/UOa2lb4z7J3Ok1+4GnyKgDsoG09
|
||||
3+lXPccGI6cmYqFTy8FSzjzQrzuBL5E=
|
||||
-----END PRIVATE KEY-----
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
[[[ Agile Tasking ]]]
|
||||
|
||||
|
||||
[[ WORKING ]]
|
||||
|
||||
* CA-I serial #s ??
|
||||
X.p12 file for CA-I (to import into M$ products)
|
||||
-.p12 file extractor for MH provisioning
|
||||
* create GUI for cert gen process (electron+crypto-interface)
|
||||
* create certificate installation guide
|
||||
-copy file to sd, select .p12 file, password="password"
|
||||
* can I install certificates from an android application??
|
||||
-can I used knox to install certificates??
|
||||
|
||||
|
||||
|
||||
[[ BACKLOG ]]
|
||||
|
||||
[ ver3 ]
|
||||
* create new "certificate bootstrap" with .cfg parameters for CA ".mil" strings
|
||||
* create new CA generation script that also reads .cfg
|
||||
* create new CA-I generation script that uses a CA
|
||||
-also packages .p12 for distrobution (use random high quality password)
|
||||
* create new client generation script that uses CA-I
|
||||
-just for testing purposes
|
||||
* create new server generation script that uses CA-I
|
||||
-just for testing purposes
|
||||
* update ver3/conf so that ipsec.conf is default
|
||||
-update ipsec_dev.conf to have developer
|
||||
|
||||
|
||||
[ bootstrap cert chain-of-trust ]
|
||||
* select bootstrap generation cpu (beaglebone, raspi)
|
||||
* change strings from "acme.xyz" to ".mil"
|
||||
* generate bootstrap
|
||||
-sneakernet two CA-I
|
||||
|
||||
|
||||
|
||||
[ ver4 ]
|
||||
|
||||
|
||||
|
||||
|
||||
[[ COMPLETED ]]
|
||||
|
||||
|
||||
|
||||
[[ ISSUES ]]
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
|
||||
cat -v screenlog.0 | tr -d '^@^M' >> fartface
|
||||
|
||||
|
||||
|
||||
sed 's/\x00\x0a//g' screenlog.0 > fartface
|
||||
|
||||
sed 's/^@^M//g' screenlog.0 > fartface
|
||||
|
||||
|
||||
@^@^M
|
||||
|
||||
|
||||
tr -d '\b\r^M\000' < screenlog.0 | cat -v >> whyusuck
|
||||
|
||||
cat -v screenlog.0 | tr -d '\b\r'
|
||||
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
[[[ Samsung Tablets ]]]
|
||||
|
||||
|
||||
[[ Android Recovery (bootloader) ]]
|
||||
|
||||
[ Wipe data / Factory reset ]
|
||||
1. Turn off the device.
|
||||
2. Press and hold the Volume Up key and the Home key, then press and hold the Power key.
|
||||
3. When the Samsung Galaxy Tab E logo screen displays, release only the Power key
|
||||
|
||||
|
|
@ -0,0 +1,303 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# ACME Certificate Bootstrap v1.3
|
||||
#
|
||||
# This script will generate all the files necessary to build a certificate chain of trust
|
||||
# using a CA, CA Intermediate, Server, and Client certificates. After the bootstrap the other
|
||||
# helper scripts will generate new client/server certificates
|
||||
#
|
||||
PARAM1=$1
|
||||
|
||||
usage() {
|
||||
echo
|
||||
echo "This script will generate all the files necessary to build a certificate chain of trust"
|
||||
echo "using a CA, CA Intermediate, Server, and Client certificates. After the bootstrap the other"
|
||||
echo "helper scripts will generate new certificates"
|
||||
echo
|
||||
echo "Usage: cert_bootstrap <.cnf file (minus the .cnf)>"
|
||||
echo
|
||||
echo "Example: cert_bootstrap org.acme.xyz"
|
||||
exit 1
|
||||
}
|
||||
|
||||
echo_block() {
|
||||
echo
|
||||
echo
|
||||
echo "***** ***** ***** *****"
|
||||
echo $1
|
||||
echo "***** ***** ***** *****"
|
||||
}
|
||||
|
||||
#
|
||||
# CA generation requires .cnf files
|
||||
# create CA directory
|
||||
# create bash variables to CA
|
||||
# restore script back to original path
|
||||
#
|
||||
app_init() {
|
||||
if [[ -n $PARAM1 ]]; then
|
||||
# need to know the location of the configuration file (expected to be in same dir path as this script)
|
||||
CA_CNF="$CD/ca.cnf"
|
||||
|
||||
# handle the case of having the ".cnf" extension or not
|
||||
if [[ ${PARAM1: -4} == .cnf ]]; then
|
||||
ORG_URL=${PARAM1%.*}
|
||||
S_CNF=${PARAM1}
|
||||
echo "ASDF: ${ORG_URL}, ${S_CNF}"
|
||||
else
|
||||
ORG_URL=$PARAM1
|
||||
S_CNF="${PARAM1}.cnf"
|
||||
echo "ZXCV: ${ORG_URL}, ${S_CNF}"
|
||||
fi
|
||||
|
||||
FQ_S_CNF="${CD}/${S_CNF}"
|
||||
if [[ ! -f $FQ_S_CNF ]] || [[ ! -f $CA_CNF ]]; then
|
||||
usage
|
||||
fi
|
||||
else
|
||||
usage
|
||||
fi
|
||||
|
||||
# Organize
|
||||
#
|
||||
# create a unique path for the server certificate
|
||||
UNIQ_DIR=`date +%Y-%m-%d.%H_%M_%S`
|
||||
UNIQ_DIR="cert-chain_${UNIQ_DIR}"
|
||||
mkdir -p "${UNIQ_DIR}"
|
||||
cd "${UNIQ_DIR}"
|
||||
# FQ_DIR="${CD}/${UNIQ_DIR}"
|
||||
}
|
||||
|
||||
#
|
||||
# IN: UNIQ_ID_CA, SERIAL
|
||||
#
|
||||
one-time-ca() {
|
||||
# params
|
||||
SERIAL="101"
|
||||
UNIQ_ID_CA="${SERIAL}.${ORG_URL}"
|
||||
CA_DIR="ca_${UNIQ_ID_CA}"
|
||||
mkdir $CA_DIR
|
||||
cd $CA_DIR
|
||||
generate_ca $UNIQ_ID_CA $SERIAL
|
||||
FQ_CA_DIR=`pwd`
|
||||
FQ_CA_CERT="${FQ_CA_DIR}/ca_${UNIQ_ID_CA}.crt.pem"
|
||||
FQ_CA_KEYS="${FQ_CA_DIR}/ca_${UNIQ_ID_CA}.keys.pem"
|
||||
cd ..
|
||||
}
|
||||
|
||||
# ***** ***** ***** *****
|
||||
#
|
||||
# CERTIFICATE AUTHORITY
|
||||
#
|
||||
# ***** ***** ***** *****
|
||||
# This function will generate a CA Intermediate
|
||||
# IN: UNIQ_ID_CA, SERIAL
|
||||
#
|
||||
generate_ca() {
|
||||
# params
|
||||
UNIQ_ID_CA=$1
|
||||
SERIAL=$2
|
||||
# encrypt the key
|
||||
#openssl genrsa -aes256 -out ca.keys.pem 4096
|
||||
#openssl genrsa -aes256 -password "pass:password" -out ca.keys.pem 4096
|
||||
|
||||
# key un-protected
|
||||
openssl genrsa -out "ca_${UNIQ_ID_CA}.keys.pem" 4096
|
||||
#
|
||||
# Create Certificate (valid for 10 years, after the entire chain of trust expires)
|
||||
openssl req -config $CA_CNF -new -x509 -sha256 -days 3650 -extensions v3_ca \
|
||||
-subj "/C=OO/O=ACME/CN=root.${UNIQ_ID_CA}" -set_serial ${SERIAL} \
|
||||
-key ca_${UNIQ_ID_CA}.keys.pem -out ca_${UNIQ_ID_CA}.crt.pem
|
||||
|
||||
# verify certificate (output to text file for review)
|
||||
openssl x509 -noout -text -in ca_${UNIQ_ID_CA}.crt.pem > ca_${UNIQ_ID_CA}_cert.info.txt
|
||||
}
|
||||
|
||||
#
|
||||
# Create CA Intermediate
|
||||
#
|
||||
#
|
||||
# This function will generate a CA Intermediate
|
||||
# IN: UNIQ_ID_CA, SERIAL
|
||||
#
|
||||
generate_ca_i() {
|
||||
echo_block "Create CA Intermediate (${UNIQ_ID_CA})"
|
||||
# params
|
||||
UNIQ_ID_CA=$1
|
||||
SERIAL=$2
|
||||
|
||||
openssl genrsa -out "ca_i_${UNIQ_ID_CA}.keys.pem" 4096
|
||||
|
||||
# Create Cert Signing Request (CSR)
|
||||
openssl req -config $CA_CNF -new -sha256 \
|
||||
-subj "/C=OO/O=ACME/OU=ACME Intermediate/CN=${UNIQ_ID_CA}" \
|
||||
-key "ca_i_${UNIQ_ID_CA}.keys.pem" -out "ca_i_${UNIQ_ID_CA}.csr.pem"
|
||||
|
||||
# Create Certificate (valid for ~2 years, after the entire chain of trust expires)
|
||||
# CA signs Intermediate
|
||||
openssl x509 -req -days 750 -extfile $CA_CNF -extensions v3_ca_i \
|
||||
-CA $FQ_CA_CERT -CAkey $FQ_CA_KEYS -set_serial ${SERIAL} \
|
||||
-in "ca_i_${UNIQ_ID_CA}.csr.pem" -out "ca_i_${UNIQ_ID_CA}.crt.pem"
|
||||
|
||||
# Package the Certificate Authority Certificates for distro (windoze needs this)
|
||||
openssl pkcs12 -export -password "pass:password" -inkey "ca_i_${UNIQ_ID_CA}.keys.pem" \
|
||||
-name "CA Intermediate Mobile Provision" -certfile $FQ_CA_CERT \
|
||||
-in "ca_i_${UNIQ_ID_CA}.crt.pem" -out "ca_i_${UNIQ_ID_CA}.p12"
|
||||
|
||||
# verify certificate (output to text file for review)
|
||||
openssl x509 -noout -text -in "ca_i_${UNIQ_ID_CA}.crt.pem" > "ca_i_${UNIQ_ID_CA}_crt_info.txt"
|
||||
|
||||
# create certifiate chain
|
||||
cat $FQ_CA_CERT "ca_i_${UNIQ_ID_CA}.crt.pem" > "ca_cert-chain_${UNIQ_ID_CA}.crts.pem"
|
||||
}
|
||||
#
|
||||
# Generate a Server Certificate
|
||||
# IN: UNIQ_ID, UNIQ_ID_CA, SERIAL
|
||||
#
|
||||
generate_server() {
|
||||
echo_block "Generate Server Certificates (${UNIQ_ID})"
|
||||
# params
|
||||
UNIQ_ID=$1
|
||||
UNIQ_ID_CA=$2
|
||||
SERIAL=$3
|
||||
|
||||
openssl genrsa -out "server_${UNIQ_ID}.keys.pem" 4096
|
||||
|
||||
openssl req -new -config $FQ_S_CNF -key "server_${UNIQ_ID}.keys.pem" \
|
||||
-subj "/C=OO/O=ACME/OU=ACME Standard/CN=${UNIQ_ID}" \
|
||||
-out "server_${UNIQ_ID}.csr.pem"
|
||||
|
||||
# Intermediate signs Server
|
||||
openssl x509 -req -days 365 -extfile $FQ_S_CNF -extensions v3_server \
|
||||
-CA "ca_i_${UNIQ_ID_CA}.crt.pem" -CAkey "ca_i_${UNIQ_ID_CA}.keys.pem" -set_serial ${SERIAL} \
|
||||
-in "server_${UNIQ_ID}.csr.pem" -out "server_${UNIQ_ID}.crt.pem"
|
||||
|
||||
# Package the Certificates
|
||||
openssl pkcs12 -export -password "pass:password" -inkey "server_${UNIQ_ID}.keys.pem" \
|
||||
-name "Server ${UNIQ_ID} VPN Certificate" -certfile "ca_cert-chain_${UNIQ_ID_CA}.crts.pem" -caname "server_${UNIQ_ID}@acme.xyz" \
|
||||
-in "server_${UNIQ_ID}.crt.pem" -out "server_${UNIQ_ID}.p12"
|
||||
|
||||
# verify certificate (output to text file for review)
|
||||
openssl x509 -noout -text -in "server_${UNIQ_ID}.crt.pem" > "server_${UNIQ_ID}.crt.info.txt"
|
||||
}
|
||||
#
|
||||
# Generate a Client Certificate
|
||||
# IN: UNIQ_ID, UNIQ_ID_CA, SERIAL
|
||||
#
|
||||
generate_client() {
|
||||
echo_block "Generate Client Certificates (${UNIQ_ID})"
|
||||
# params
|
||||
UNIQ_ID=$1
|
||||
UNIQ_ID_CA=$2
|
||||
SERIAL=$3
|
||||
|
||||
openssl genrsa -out "client_${UNIQ_ID}.keys.pem" 4096
|
||||
|
||||
openssl req -new -key "client_${UNIQ_ID}.keys.pem" \
|
||||
-subj "/C=OO/O=ACME/OU=ACME Standard/CN=client_${UNIQ_ID}" \
|
||||
-out "client_${UNIQ_ID}.csr.pem"
|
||||
# Intermediate signs Client
|
||||
openssl x509 -req -days 365 \
|
||||
-CA "ca_i_${UNIQ_ID_CA}.crt.pem" -CAkey "ca_i_${UNIQ_ID_CA}.keys.pem" -set_serial ${SERIAL} \
|
||||
-in "client_${UNIQ_ID}.csr.pem" -out "client_${UNIQ_ID}.crt.pem"
|
||||
|
||||
# Package the Certificates
|
||||
openssl pkcs12 -export -password "pass:password" -inkey "client_${UNIQ_ID}.keys.pem" \
|
||||
-name "Client ${UNIQ_ID} VPN Certificate" -certfile "ca_cert-chain_${UNIQ_ID_CA}.crts.pem" -caname "client_${UNIQ_ID}@acme.xyz" \
|
||||
-in "client_${UNIQ_ID}.crt.pem" -out "client_${UNIQ_ID}.p12"
|
||||
|
||||
# verify certificate (output to text file for review)
|
||||
openssl x509 -noout -text -in "client_${UNIQ_ID}.crt.pem" > "client_${UNIQ_ID}.info.txt"
|
||||
}
|
||||
|
||||
#
|
||||
# Organize the files into logical folders based on serial #
|
||||
#
|
||||
organize() {
|
||||
# cert info
|
||||
mkdir docs
|
||||
mv *.txt docs/
|
||||
|
||||
# move all files to folders
|
||||
mkdir ca-i
|
||||
mv ca_i*.pem ca-i/
|
||||
|
||||
mkdir servers
|
||||
mv server_*.pem servers/
|
||||
|
||||
mkdir clients
|
||||
mv client*.pem clients/
|
||||
}
|
||||
|
||||
#
|
||||
# Generate a PKI chain
|
||||
# - the certificate chain is unique based on the serial #
|
||||
# - generate a new CA I
|
||||
# - generate two server certificates
|
||||
# - generate two client certificates
|
||||
#
|
||||
# INPUT: BASE SERIAL #, LOOP NUM
|
||||
#
|
||||
gen_pki_certs() {
|
||||
B_SERIAL=$1
|
||||
NUM_CERTS=$2
|
||||
|
||||
# Create CA Intermediate
|
||||
UNIQ_ID_CA="${B_SERIAL}.${ORG_URL}"
|
||||
generate_ca_i $UNIQ_ID_CA $B_SERIAL
|
||||
|
||||
# Server Certificates
|
||||
for NUM in $(seq 1 $2)
|
||||
do
|
||||
generate_server "$((B_SERIAL+NUM)).${ORG_URL}" $UNIQ_ID_CA $((B_SERIAL+NUM))
|
||||
done
|
||||
|
||||
# Client Certificates
|
||||
for NUM in $(seq 1 $2)
|
||||
do
|
||||
generate_client "$((B_SERIAL+NUM)).${ORG_URL}" $UNIQ_ID_CA $((B_SERIAL+NUM))
|
||||
done
|
||||
}
|
||||
|
||||
#
|
||||
# INPUT: SERIAL #, LOOP NUM
|
||||
#
|
||||
gen_pki() {
|
||||
SERIAL=$1
|
||||
|
||||
mkdir "ca_i_${SERIAL}.${ORG_URL}"
|
||||
cd "ca_i_${SERIAL}.${ORG_URL}"
|
||||
|
||||
gen_pki_certs $SERIAL $2
|
||||
organize
|
||||
|
||||
cd ..
|
||||
}
|
||||
|
||||
|
||||
main() {
|
||||
CD=`pwd`
|
||||
|
||||
app_init
|
||||
one-time-ca
|
||||
gen_pki 10001 2
|
||||
gen_pki 50001 5
|
||||
gen_pki 80001 10
|
||||
|
||||
cd "${CD}"
|
||||
}
|
||||
|
||||
|
||||
# ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** *****
|
||||
#
|
||||
# main execution begins here (because all the functions have to be defined)
|
||||
#
|
||||
# ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** ***** *****
|
||||
|
||||
main
|
||||
|
||||
# ***** ***** ***** *****
|
||||
#
|
||||
#
|
||||
#
|
||||
# ***** ***** ***** *****
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
#
|
||||
#
|
||||
# IMPORTANT INFO
|
||||
#
|
||||
#
|
||||
[ v3_server ]
|
||||
# Extensions for server certificates (`man x509v3_config`).
|
||||
basicConstraints = CA:FALSE
|
||||
nsCertType = server
|
||||
nsComment = "ACME Generated"
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
keyUsage = critical, digitalSignature, keyEncipherment
|
||||
extendedKeyUsage = serverAuth
|
||||
subjectAltName = IP:192.168.1.3
|
||||
#subjectAltName = @san_info
|
||||
|
||||
[ san_info ]
|
||||
IP = 192.168.1.3
|
||||
|
||||
|
||||
#
|
||||
#
|
||||
# FORCED TO INCLUDE THIS JUNK
|
||||
#
|
||||
#
|
||||
[ req ]
|
||||
# Options for the `req` tool (`man req`).
|
||||
default_bits = 4096
|
||||
distinguished_name = req_distinguished_name
|
||||
string_mask = utf8only
|
||||
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
# Extension to add when the -x509 option is used.
|
||||
#x509_extensions = v3_ca
|
||||
|
||||
[ req_distinguished_name ]
|
||||
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
|
||||
countryName = Country Name (2 letter code)
|
||||
stateOrProvinceName = State or Province Name
|
||||
localityName = Locality Name
|
||||
0.organizationName = Organization Name
|
||||
organizationalUnitName = Organizational Unit Name
|
||||
commonName = Common Name
|
||||
emailAddress = Email Address
|
||||
|
||||
# Optionally, specify some defaults.
|
||||
countryName_default = US
|
||||
stateOrProvinceName_default = State51
|
||||
localityName_default =
|
||||
0.organizationName_default = ACME R&D
|
||||
organizationalUnitName_default =
|
||||
emailAddress_default =
|
||||
|
||||
|
|
@ -0,0 +1,113 @@
|
|||
# Root CA configuration file.
|
||||
|
||||
[ ca ]
|
||||
# `man ca`
|
||||
default_ca = CA_default
|
||||
|
||||
[ CA_default ]
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
default_days = 375
|
||||
preserve = no
|
||||
policy = policy_strict
|
||||
|
||||
[ policy_strict ]
|
||||
# The root CA should only sign intermediate certificates that match.
|
||||
# See the POLICY FORMAT section of `man ca`.
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ policy_loose ]
|
||||
# Allow the intermediate CA to sign a more diverse range of certificates.
|
||||
# See the POLICY FORMAT section of the `ca` man page.
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ req ]
|
||||
# Options for the `req` tool (`man req`).
|
||||
default_bits = 4096
|
||||
distinguished_name = req_distinguished_name
|
||||
string_mask = utf8only
|
||||
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
# Extension to add when the -x509 option is used.
|
||||
x509_extensions = v3_ca
|
||||
|
||||
[ req_distinguished_name ]
|
||||
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
|
||||
countryName = Country Name (2 letter code)
|
||||
stateOrProvinceName = State or Province Name
|
||||
localityName = Locality Name
|
||||
0.organizationName = Organization Name
|
||||
organizationalUnitName = Organizational Unit Name
|
||||
commonName = Common Name
|
||||
emailAddress = Email Address
|
||||
|
||||
# Optionally, specify some defaults.
|
||||
countryName_default = US
|
||||
stateOrProvinceName_default = State51
|
||||
localityName_default =
|
||||
0.organizationName_default = ACME R&D
|
||||
organizationalUnitName_default =
|
||||
emailAddress_default =
|
||||
|
||||
[ v3_ca ]
|
||||
# Extensions for a typical CA (`man x509v3_config`).
|
||||
basicConstraints = critical, CA:true
|
||||
keyUsage = critical, cRLSign, digitalSignature, keyCertSign
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer
|
||||
|
||||
[ v3_ca_i ]
|
||||
# Extensions for a typical intermediate CA (`man x509v3_config`).
|
||||
basicConstraints = critical, CA:true, pathlen:0
|
||||
keyUsage = critical, cRLSign, digitalSignature, keyCertSign
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer
|
||||
|
||||
[ usr_cert ]
|
||||
# Extensions for client certificates (`man x509v3_config`).
|
||||
basicConstraints = CA:FALSE
|
||||
nsCertType = client, email
|
||||
nsComment = "ACME Generated"
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
|
||||
extendedKeyUsage = clientAuth, emailProtection
|
||||
|
||||
[ server_cert ]
|
||||
# Extensions for server certificates (`man x509v3_config`).
|
||||
basicConstraints = CA:FALSE
|
||||
nsCertType = server
|
||||
nsComment = "ACME Generated"
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
keyUsage = critical, digitalSignature, keyEncipherment
|
||||
extendedKeyUsage = serverAuth
|
||||
#subjectAltName = "192.168.123.129"
|
||||
|
||||
[ crl_ext ]
|
||||
# Extension for CRLs (`man x509v3_config`).
|
||||
authorityKeyIdentifier=keyid:always
|
||||
|
||||
[ ocsp ]
|
||||
# Extension for OCSP signing certificates (`man ocsp`).
|
||||
basicConstraints = CA:FALSE
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
keyUsage = critical, digitalSignature
|
||||
extendedKeyUsage = critical, OCSPSigning
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
#
|
||||
#
|
||||
# IMPORTANT INFO
|
||||
#
|
||||
#
|
||||
[ v3_server ]
|
||||
# Extensions for server certificates (`man x509v3_config`).
|
||||
basicConstraints = CA:FALSE
|
||||
nsCertType = server
|
||||
nsComment = "ACME Corp"
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
keyUsage = critical, digitalSignature, keyEncipherment
|
||||
extendedKeyUsage = serverAuth
|
||||
subjectAltName = @alt_names
|
||||
#subjectAltName = IP:192.168.123.129
|
||||
|
||||
[ alt_names ]
|
||||
DNS.1 = "skunkworks.acme.xyz"
|
||||
|
||||
#
|
||||
#
|
||||
# FORCED TO INCLUDE THIS JUNK
|
||||
#
|
||||
#
|
||||
[ req ]
|
||||
# Options for the `req` tool (`man req`).
|
||||
default_bits = 4096
|
||||
distinguished_name = req_distinguished_name
|
||||
string_mask = utf8only
|
||||
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
# Extension to add when the -x509 option is used.
|
||||
#x509_extensions = v3_ca
|
||||
|
||||
[ req_distinguished_name ]
|
||||
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
|
||||
countryName = Country Name (2 letter code)
|
||||
stateOrProvinceName = State or Province Name
|
||||
localityName = Locality Name
|
||||
0.organizationName = Organization Name
|
||||
organizationalUnitName = Organizational Unit Name
|
||||
commonName = Common Name
|
||||
emailAddress = Email Address
|
||||
|
||||
# Optionally, specify some defaults.
|
||||
countryName_default = US
|
||||
stateOrProvinceName_default = State51
|
||||
localityName_default =
|
||||
0.organizationName_default = ACME R&D
|
||||
organizationalUnitName_default =
|
||||
emailAddress_default =
|
||||
|
||||
|
|
@ -0,0 +1,80 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# Create CA Intermediate
|
||||
#
|
||||
#
|
||||
# This function will generate a CA Intermediate
|
||||
# IN: UNIQ_ID_CA, SERIAL
|
||||
#
|
||||
PARAM1=$1
|
||||
PARAM2=$2
|
||||
|
||||
usage() {
|
||||
echo
|
||||
echo "Generate a new CA Intermediate certificate"
|
||||
echo
|
||||
echo "This program will generate a new certificate authority (CA) intermediate"
|
||||
echo "It requires a CA certificate used to sign CA Intermediate"
|
||||
echo "Requires the file \"ca.pem\" that is used to sign the certificates"
|
||||
echo ""
|
||||
echo ""
|
||||
echo ""
|
||||
echo
|
||||
echo " usage: gen_ca-i.sh <Org URL> <Serial>"
|
||||
echo
|
||||
echo " example: gen_ca-i.sh skunkworks.acme.xyz \\"
|
||||
echo " 10052 \\"
|
||||
echo
|
||||
exit 1
|
||||
}
|
||||
|
||||
error_no_ca_file() {
|
||||
echo
|
||||
echo "ERROR: missing ca.pem"
|
||||
echo
|
||||
usage
|
||||
}
|
||||
|
||||
|
||||
generate_ca_i() {
|
||||
echo_block "Create CA Intermediate (${UNIQ_ID_CA})"
|
||||
# params
|
||||
UNIQ_ID_CA=$1
|
||||
SERIAL=$2
|
||||
|
||||
openssl genrsa -out "ca_i_${UNIQ_ID_CA}.keys.pem" 4096
|
||||
|
||||
# Create Cert Signing Request (CSR)
|
||||
openssl req -config $CA_CNF -new -sha256 \
|
||||
-subj "/C=OO/O=ACME/OU=ACME Intermediate/CN=${UNIQ_ID_CA}" \
|
||||
-key "ca_i_${UNIQ_ID_CA}.keys.pem" -out "ca_i_${UNIQ_ID_CA}.csr.pem"
|
||||
|
||||
# Create Certificate (valid for ~2 years, after the entire chain of trust expires)
|
||||
# CA signs Intermediate
|
||||
openssl x509 -req -days 750 -extfile $CA_CNF -extensions v3_ca_i \
|
||||
-CA $FQ_CA_CERT -CAkey $FQ_CA_KEYS -set_serial ${SERIAL} \
|
||||
-in "ca_i_${UNIQ_ID_CA}.csr.pem" -out "ca_i_${UNIQ_ID_CA}.crt.pem"
|
||||
|
||||
# Package the Certificate Authority Certificates for distro (windoze needs this)
|
||||
openssl pkcs12 -export -password "pass:password" -inkey "ca_i_${UNIQ_ID_CA}.keys.pem" \
|
||||
-name "CA Intermediate Mobile Provision" -certfile $FQ_CA_CERT \
|
||||
-in "ca_i_${UNIQ_ID_CA}.crt.pem" -out "ca_i_${UNIQ_ID_CA}.p12"
|
||||
|
||||
# verify certificate (output to text file for review)
|
||||
openssl x509 -noout -text -in "ca_i_${UNIQ_ID_CA}.crt.pem" > "ca_i_${UNIQ_ID_CA}_crt_info.txt"
|
||||
|
||||
# create certifiate chain
|
||||
cat $FQ_CA_CERT "ca_i_${UNIQ_ID_CA}.crt.pem" > "ca_cert-chain_${UNIQ_ID_CA}.crts.pem"
|
||||
}
|
||||
|
||||
main() {
|
||||
if [[ ! -f ca-i.pem ]]
|
||||
error_no_ca_file
|
||||
if [[ -n $PARAM1 ]] || [[ -n $PARAM2 ]]; then
|
||||
generate_ca_i $PARAM1 $PARAM2
|
||||
else
|
||||
usage
|
||||
fi
|
||||
}
|
||||
|
||||
main
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
#
|
||||
#
|
||||
# IMPORTANT INFO
|
||||
#
|
||||
#
|
||||
[ v3_server ]
|
||||
# Extensions for server certificates (`man x509v3_config`).
|
||||
basicConstraints = CA:FALSE
|
||||
nsCertType = server
|
||||
nsComment = "ACME Generated"
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
keyUsage = critical, digitalSignature, keyEncipherment
|
||||
extendedKeyUsage = serverAuth
|
||||
subjectAltName = IP:192.168.1.3
|
||||
#subjectAltName = @san_info
|
||||
|
||||
[ san_info ]
|
||||
IP = 192.168.1.3
|
||||
|
||||
|
||||
#
|
||||
#
|
||||
# FORCED TO INCLUDE THIS JUNK
|
||||
#
|
||||
#
|
||||
[ req ]
|
||||
# Options for the `req` tool (`man req`).
|
||||
default_bits = 4096
|
||||
distinguished_name = req_distinguished_name
|
||||
string_mask = utf8only
|
||||
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
# Extension to add when the -x509 option is used.
|
||||
#x509_extensions = v3_ca
|
||||
|
||||
[ req_distinguished_name ]
|
||||
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
|
||||
countryName = Country Name (2 letter code)
|
||||
stateOrProvinceName = State or Province Name
|
||||
localityName = Locality Name
|
||||
0.organizationName = Organization Name
|
||||
organizationalUnitName = Organizational Unit Name
|
||||
commonName = Common Name
|
||||
emailAddress = Email Address
|
||||
|
||||
# Optionally, specify some defaults.
|
||||
countryName_default = US
|
||||
stateOrProvinceName_default = State51
|
||||
localityName_default =
|
||||
0.organizationName_default = ACME R&D
|
||||
organizationalUnitName_default =
|
||||
emailAddress_default =
|
||||
|
||||
|
|
@ -0,0 +1,113 @@
|
|||
# Root CA configuration file.
|
||||
|
||||
[ ca ]
|
||||
# `man ca`
|
||||
default_ca = CA_default
|
||||
|
||||
[ CA_default ]
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
name_opt = ca_default
|
||||
cert_opt = ca_default
|
||||
default_days = 375
|
||||
preserve = no
|
||||
policy = policy_strict
|
||||
|
||||
[ policy_strict ]
|
||||
# The root CA should only sign intermediate certificates that match.
|
||||
# See the POLICY FORMAT section of `man ca`.
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ policy_loose ]
|
||||
# Allow the intermediate CA to sign a more diverse range of certificates.
|
||||
# See the POLICY FORMAT section of the `ca` man page.
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
[ req ]
|
||||
# Options for the `req` tool (`man req`).
|
||||
default_bits = 4096
|
||||
distinguished_name = req_distinguished_name
|
||||
string_mask = utf8only
|
||||
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
# Extension to add when the -x509 option is used.
|
||||
x509_extensions = v3_ca
|
||||
|
||||
[ req_distinguished_name ]
|
||||
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
|
||||
countryName = Country Name (2 letter code)
|
||||
stateOrProvinceName = State or Province Name
|
||||
localityName = Locality Name
|
||||
0.organizationName = Organization Name
|
||||
organizationalUnitName = Organizational Unit Name
|
||||
commonName = Common Name
|
||||
emailAddress = Email Address
|
||||
|
||||
# Optionally, specify some defaults.
|
||||
countryName_default = US
|
||||
stateOrProvinceName_default = State51
|
||||
localityName_default =
|
||||
0.organizationName_default = ACME R&D
|
||||
organizationalUnitName_default =
|
||||
emailAddress_default =
|
||||
|
||||
[ v3_ca ]
|
||||
# Extensions for a typical CA (`man x509v3_config`).
|
||||
basicConstraints = critical, CA:true
|
||||
keyUsage = critical, cRLSign, digitalSignature, keyCertSign
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer
|
||||
|
||||
[ v3_ca_i ]
|
||||
# Extensions for a typical intermediate CA (`man x509v3_config`).
|
||||
basicConstraints = critical, CA:true, pathlen:0
|
||||
keyUsage = critical, cRLSign, digitalSignature, keyCertSign
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid:always,issuer
|
||||
|
||||
[ usr_cert ]
|
||||
# Extensions for client certificates (`man x509v3_config`).
|
||||
basicConstraints = CA:FALSE
|
||||
nsCertType = client, email
|
||||
nsComment = "ACME Generated"
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
|
||||
extendedKeyUsage = clientAuth, emailProtection
|
||||
|
||||
[ server_cert ]
|
||||
# Extensions for server certificates (`man x509v3_config`).
|
||||
basicConstraints = CA:FALSE
|
||||
nsCertType = server
|
||||
nsComment = "ACME Generated"
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
keyUsage = critical, digitalSignature, keyEncipherment
|
||||
extendedKeyUsage = serverAuth
|
||||
#subjectAltName = "192.168.123.129"
|
||||
|
||||
[ crl_ext ]
|
||||
# Extension for CRLs (`man x509v3_config`).
|
||||
authorityKeyIdentifier=keyid:always
|
||||
|
||||
[ ocsp ]
|
||||
# Extension for OCSP signing certificates (`man ocsp`).
|
||||
basicConstraints = CA:FALSE
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer
|
||||
keyUsage = critical, digitalSignature
|
||||
extendedKeyUsage = critical, OCSPSigning
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
#
|
||||
#
|
||||
# IMPORTANT INFO
|
||||
#
|
||||
#
|
||||
[ v3_server ]
|
||||
# Extensions for server certificates (`man x509v3_config`).
|
||||
basicConstraints = CA:FALSE
|
||||
nsCertType = server
|
||||
nsComment = "ACME Corp"
|
||||
subjectKeyIdentifier = hash
|
||||
authorityKeyIdentifier = keyid,issuer:always
|
||||
keyUsage = critical, digitalSignature, keyEncipherment
|
||||
extendedKeyUsage = serverAuth
|
||||
subjectAltName = @alt_names
|
||||
#subjectAltName = IP:192.168.123.129
|
||||
|
||||
[ alt_names ]
|
||||
DNS.1 = "skunkworks.acme.xyz"
|
||||
|
||||
#
|
||||
#
|
||||
# FORCED TO INCLUDE THIS JUNK
|
||||
#
|
||||
#
|
||||
[ req ]
|
||||
# Options for the `req` tool (`man req`).
|
||||
default_bits = 4096
|
||||
distinguished_name = req_distinguished_name
|
||||
string_mask = utf8only
|
||||
|
||||
# SHA-1 is deprecated, so use SHA-2 instead.
|
||||
default_md = sha256
|
||||
|
||||
# Extension to add when the -x509 option is used.
|
||||
#x509_extensions = v3_ca
|
||||
|
||||
[ req_distinguished_name ]
|
||||
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
|
||||
countryName = Country Name (2 letter code)
|
||||
stateOrProvinceName = State or Province Name
|
||||
localityName = Locality Name
|
||||
0.organizationName = Organization Name
|
||||
organizationalUnitName = Organizational Unit Name
|
||||
commonName = Common Name
|
||||
emailAddress = Email Address
|
||||
|
||||
# Optionally, specify some defaults.
|
||||
countryName_default = US
|
||||
stateOrProvinceName_default = State51
|
||||
localityName_default =
|
||||
0.organizationName_default = ACME R&D
|
||||
organizationalUnitName_default =
|
||||
emailAddress_default =
|
||||
|
||||
|
|
@ -0,0 +1,116 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# ACME Certificate Authority Generation v1.0
|
||||
#
|
||||
#
|
||||
PARAM1=$1
|
||||
|
||||
usage() {
|
||||
echo
|
||||
echo "This script will generate all the files necessary to build a certificate chain of trust"
|
||||
echo "using a CA, CA Intermediate, Server, and Client certificates. After the bootstrap the other"
|
||||
echo "helper scripts will generate new certificates"
|
||||
echo
|
||||
echo "Usage: cert_bootstrap <.cnf file (minus the .cnf)>"
|
||||
echo
|
||||
echo "Example: cert_bootstrap org.acme.xyz"
|
||||
exit 1
|
||||
}
|
||||
|
||||
echo_block() {
|
||||
echo
|
||||
echo
|
||||
echo "***** ***** ***** *****"
|
||||
echo $1
|
||||
echo "***** ***** ***** *****"
|
||||
}
|
||||
|
||||
#
|
||||
# CA generation requires .cnf files
|
||||
# create CA directory
|
||||
# create bash variables to CA
|
||||
# restore script back to original path
|
||||
#
|
||||
app_init() {
|
||||
if [[ -n $PARAM1 ]]; then
|
||||
# need to know the location of the configuration file (expected to be in same dir path as this script)
|
||||
CA_CNF="$CD/ca.cnf"
|
||||
|
||||
# handle the case of having the ".cnf" extension or not
|
||||
if [[ ${PARAM1: -4} == .cnf ]]; then
|
||||
ORG_URL=${PARAM1%.*}
|
||||
S_CNF=${PARAM1}
|
||||
echo "ASDF: ${ORG_URL}, ${S_CNF}"
|
||||
else
|
||||
ORG_URL=$PARAM1
|
||||
S_CNF="${PARAM1}.cnf"
|
||||
echo "ZXCV: ${ORG_URL}, ${S_CNF}"
|
||||
fi
|
||||
|
||||
FQ_S_CNF="${CD}/${S_CNF}"
|
||||
if [[ ! -f $FQ_S_CNF ]] || [[ ! -f $CA_CNF ]]; then
|
||||
usage
|
||||
fi
|
||||
else
|
||||
usage
|
||||
fi
|
||||
|
||||
# Organize
|
||||
#
|
||||
# create a unique path for the server certificate
|
||||
UNIQ_DIR=`date +%Y-%m-%d.%H_%M_%S`
|
||||
UNIQ_DIR="cert-chain_${UNIQ_DIR}"
|
||||
mkdir -p "${UNIQ_DIR}"
|
||||
cd "${UNIQ_DIR}"
|
||||
# FQ_DIR="${CD}/${UNIQ_DIR}"
|
||||
}
|
||||
|
||||
#
|
||||
# IN: UNIQ_ID_CA, SERIAL
|
||||
#
|
||||
one-time-ca() {
|
||||
# params
|
||||
SERIAL="101"
|
||||
UNIQ_ID_CA="${SERIAL}.${ORG_URL}"
|
||||
CA_DIR="ca_${UNIQ_ID_CA}"
|
||||
mkdir $CA_DIR
|
||||
cd $CA_DIR
|
||||
generate_ca $UNIQ_ID_CA $SERIAL
|
||||
FQ_CA_DIR=`pwd`
|
||||
FQ_CA_CERT="${FQ_CA_DIR}/ca_${UNIQ_ID_CA}.crt.pem"
|
||||
FQ_CA_KEYS="${FQ_CA_DIR}/ca_${UNIQ_ID_CA}.keys.pem"
|
||||
cd ..
|
||||
}
|
||||
|
||||
# ***** ***** ***** *****
|
||||
#
|
||||
# CERTIFICATE AUTHORITY
|
||||
#
|
||||
# ***** ***** ***** *****
|
||||
# This function will generate a CA Intermediate
|
||||
# IN: UNIQ_ID_CA, SERIAL
|
||||
#
|
||||
generate_ca() {
|
||||
# params
|
||||
UNIQ_ID_CA=$1
|
||||
SERIAL=$2
|
||||
# encrypt the key
|
||||
#openssl genrsa -aes256 -out ca.keys.pem 4096
|
||||
#openssl genrsa -aes256 -password "pass:password" -out ca.keys.pem 4096
|
||||
|
||||
# key un-protected
|
||||
openssl genrsa -out "ca_${UNIQ_ID_CA}.keys.pem" 4096
|
||||
#
|
||||
# Create Certificate (valid for 10 years, after the entire chain of trust expires)
|
||||
openssl req -config $CA_CNF -new -x509 -sha256 -days 3650 -extensions v3_ca \
|
||||
-subj "/C=OO/O=ACME/CN=root.${UNIQ_ID_CA}" -set_serial ${SERIAL} \
|
||||
-key ca_${UNIQ_ID_CA}.keys.pem -out ca_${UNIQ_ID_CA}.crt.pem
|
||||
|
||||
# verify certificate (output to text file for review)
|
||||
openssl x509 -noout -text -in ca_${UNIQ_ID_CA}.crt.pem > ca_${UNIQ_ID_CA}_cert.info.txt
|
||||
}
|
||||
|
||||
main() {
|
||||
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# Create CA Intermediate
|
||||
#
|
||||
#
|
||||
# This function will generate a CA Intermediate
|
||||
# IN: UNIQ_ID_CA, SERIAL
|
||||
#
|
||||
PARAM1=$1
|
||||
PARAM2=$2
|
||||
|
||||
usage() {
|
||||
echo
|
||||
echo "Generate a new certificate"
|
||||
echo
|
||||
echo "This program will generate a new certificate authority intermediate"
|
||||
echo "Requires the file ca-i.pem that is used to sign the certificates"
|
||||
echo "The script requires a CA Intermediate certificate used to sign the client"
|
||||
echo ""
|
||||
echo ""
|
||||
echo ""
|
||||
echo
|
||||
echo "Generate a new certificate"
|
||||
echo " usage: gen_server.sh <CA Intermediate> <Org URL> <Serial>"
|
||||
echo
|
||||
echo " example: gen_server.sh ca_i_skunkworks.acme.xyz_10001.crt.pem \\"
|
||||
echo " skunkworks.acme.xyz \\"
|
||||
echo " 10052 \\"
|
||||
echo
|
||||
exit 1
|
||||
}
|
||||
|
||||
#
|
||||
# Generate a Server Certificate
|
||||
# IN: ${SERIAL}, ${UNIQ_ID}
|
||||
#
|
||||
generate_server() {
|
||||
openssl genrsa -out "server_${UNIQ_ID}.keys.pem" 4096
|
||||
|
||||
openssl req -new -config $FQ_S_CNF -key "server_${UNIQ_ID}.keys.pem" \
|
||||
-subj "/C=OO/O=ACME/OU=ACME Standard/CN=${UNIQ_ID}" \
|
||||
-out "server_${UNIQ_ID}.csr.pem"
|
||||
|
||||
# Intermediate signs Server
|
||||
openssl x509 -req -days 365 -extfile $FQ_S_CNF -extensions v3_server \
|
||||
-CA "ca_i_${UNIQ_ID_CA}.crt.pem" -CAkey "ca_i_${UNIQ_ID_CA}.keys.pem" -set_serial ${SERIAL} \
|
||||
-in "server_${UNIQ_ID}.csr.pem" -out "server_${UNIQ_ID}.crt.pem"
|
||||
|
||||
# verify certificate (output to text file for review)
|
||||
openssl x509 -noout -text -in "server_${UNIQ_ID}.crt.pem" > "server_${UNIQ_ID}.crt.info.txt"
|
||||
}
|
||||
|
||||
# if all argument strings are empty, then continue execution
|
||||
if [[ -n $1 ]] && [[ -n $2 ]] && [[ -n $3 ]]; then
|
||||
UNIQ_ID_CA=$1
|
||||
ORG_URL=$2
|
||||
SERIAL=$3
|
||||
UNIQ_ID="${ORG_URL}_${SERIAL}"
|
||||
generate_server
|
||||
else
|
||||
usage
|
||||
fi
|
||||
|
|
@ -0,0 +1,58 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# Create CA Intermediate
|
||||
#
|
||||
#
|
||||
# This function will generate a CA Intermediate
|
||||
# IN: UNIQ_ID_CA, SERIAL
|
||||
#
|
||||
PARAM1=$1
|
||||
PARAM2=$2
|
||||
|
||||
usage() {
|
||||
echo
|
||||
echo "Generate a new certificate"
|
||||
echo
|
||||
echo "This program will generate a new certificate authority intermediate"
|
||||
echo "Requires the file ca-i.pem that is used to sign the certificates"
|
||||
echo "The script requires a CA Intermediate certificate used to sign the client"
|
||||
echo ""
|
||||
echo ""
|
||||
echo ""
|
||||
echo
|
||||
echo "Generate a new certificate"
|
||||
echo " usage: gen_server.sh <CA Intermediate> <Org URL> <Serial>"
|
||||
echo
|
||||
echo " example: gen_server.sh ca_i_skunkworks.acme.xyz_10001.crt.pem \\"
|
||||
echo " skunkworks.acme.xyz \\"
|
||||
echo " 10052 \\"
|
||||
echo
|
||||
exit 1
|
||||
}
|
||||
|
||||
|
||||
generate_client() {
|
||||
echo_block "Generate Client Certificates (${UNIQ_ID})"
|
||||
# params
|
||||
UNIQ_ID=$1
|
||||
UNIQ_ID_CA=$2
|
||||
SERIAL=$3
|
||||
|
||||
openssl genrsa -out "client_${UNIQ_ID}.keys.pem" 4096
|
||||
|
||||
openssl req -new -key "client_${UNIQ_ID}.keys.pem" \
|
||||
-subj "/C=OO/O=ACME/OU=ACME Standard/CN=client_${UNIQ_ID}" \
|
||||
-out "client_${UNIQ_ID}.csr.pem"
|
||||
# Intermediate signs Client
|
||||
openssl x509 -req -days 365 \
|
||||
-CA "ca_i_${UNIQ_ID_CA}.crt.pem" -CAkey "ca_i_${UNIQ_ID_CA}.keys.pem" -set_serial ${SERIAL} \
|
||||
-in "client_${UNIQ_ID}.csr.pem" -out "client_${UNIQ_ID}.crt.pem"
|
||||
|
||||
# Package the Certificates
|
||||
openssl pkcs12 -export -password "pass:password" -inkey "client_${UNIQ_ID}.keys.pem" \
|
||||
-name "Client ${UNIQ_ID} VPN Certificate" -certfile "ca_cert-chain_${UNIQ_ID_CA}.crts.pem" -caname "client_${UNIQ_ID}@acme.xyz" \
|
||||
-in "client_${UNIQ_ID}.crt.pem" -out "client_${UNIQ_ID}.p12"
|
||||
|
||||
# verify certificate (output to text file for review)
|
||||
openssl x509 -noout -text -in "client_${UNIQ_ID}.crt.pem" > "client_${UNIQ_ID}.info.txt"
|
||||
}
|
||||
Loading…
Reference in New Issue