OVMS3/OVMS.V3/components/wolfssl/certs/test-pathlen/assemble-chains.sh

200 lines
10 KiB
Bash
Raw Normal View History

#!/bin/bash
#
# assemble-chains.sh
# Create certs and assemble all the certificate CA path test cert chains.
check_result(){
if [ $1 -ne 0 ]; then
echo "$2 Failed, Abort"
exit 1
else
echo "$2 Succeeded!"
fi
}
create_an_intermediate(){
# $1 - chain ID
# $2 - ICA Number (Example entity signed by ICA1 signed by ICA2 and so on)
# $2 - pathLength to use
# $3 - Signer of this Intermediate
# $4 - The signers Key
# example: create_an_intermediate "chainA" "ICA1" "0" "../ca-cert.pem" "../ca-key.pem"
chainID="$1"
icaNum="$2"
pathLen="$3"
signer="$4"
signerKey="$5"
echo "pathLen = $3, $pathLen"
echo ""
#pipe the following arguments to openssl req...
if [ "$pathLen" = "no_pathlen" ]; then
echo "Updating $chainID-$icaNum-$pathLen.pem"
echo -e "US\\nWashington\\nSeattle\\nwolfSSL Inc.\\nEngineering\\n$chainID-$icaNum-$pathLen\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key "$chainID-$icaNum-key.pem" -config ../renewcerts/wolfssl.cnf -nodes -sha256 > temp-req.pem
check_result $? "Step 1"
openssl x509 -req -in temp-req.pem -extfile ../renewcerts/wolfssl.cnf -extensions wolfssl_opts_ICA -days 1000 -CA $signer -CAkey $signerKey -set_serial 100 -sha256 > "$chainID-$icaNum-$pathLen.pem"
check_result $? "Step 2"
rm temp-req.pem
openssl x509 -in "$chainID-$icaNum-$pathLen.pem" -text > ca_tmp.pem
check_result $? "Step 3"
mv ca_tmp.pem "$chainID-$icaNum-$pathLen.pem"
else
echo "Updating $chainID-$icaNum-pathlen$pathLen.pem"
echo -e "US\\nWashington\\nSeattle\\nwolfSSL Inc.\\nEngineering\\n$chainID-$icaNum-pathlen$pathLen\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key "$chainID-$icaNum-key.pem" -config ../renewcerts/wolfssl.cnf -nodes -sha256 > temp-req.pem
check_result $? "Step 1"
openssl x509 -req -in temp-req.pem -extfile ../renewcerts/wolfssl.cnf -extensions "pathlen_$pathLen" -days 1000 -CA $signer -CAkey $signerKey -set_serial 100 -sha256 > "$chainID-$icaNum-pathlen$pathLen.pem"
check_result $? "Step 2"
rm temp-req.pem
openssl x509 -in "$chainID-$icaNum-pathlen$pathLen.pem" -text > ca_tmp.pem
check_result $? "Step 3"
mv ca_tmp.pem "$chainID-$icaNum-pathlen$pathLen.pem"
fi
echo "End of Section"
echo "-------------------------------------------------------------------------"
}
###########################################################
########## update chainA-entity.pem ################
###########################################################
create_an_entity(){
# $1 - chain ID
# $2 - ICA Number (Example entity signed by ICA1 signed by ICA2 and so on)
# $2 - pathLength to use
# $3 - Signer of this Intermediate
# $4 - The signers Key
# example: create_an_intermediate "chainA" "ICA1" "0" "../ca-cert.pem" "../ca-key.pem"
chainID="$1"
signer="$2"
signerKey="$3"
echo "Updating $chainID-entity.pem"
echo ""
#pipe the following arguments to openssl req...
echo -e "US\\nWashington\\nSeattle\\nwolfSSL Inc.\\nEngineering\\n$chainID-entity\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key "$chainID-entity-key.pem" -config ../renewcerts/wolfssl.cnf -nodes -sha256 > temp-req.pem
check_result $? "Step 1"
openssl x509 -req -in temp-req.pem -extfile ../renewcerts/wolfssl.cnf -extensions test_pathlen -days 1000 -CA "$signer" -CAkey "$signerKey" -set_serial 101 -sha256 > "$chainID"-entity.pem
check_result $? "Step 2"
rm temp-req.pem
openssl x509 -in "$chainID"-entity.pem -text > cert_tmp.pem
check_result $? "Step 3"
mv cert_tmp.pem "$chainID"-entity.pem
echo "End of Section"
echo "-------------------------------------------------------------------------"
}
###########################################################
########## Create the certs ################
###########################################################
create_an_intermediate "chainA" "ICA1" "0" "../ca-cert.pem" "../ca-key.pem"
create_an_entity "chainA" "chainA-ICA1-pathlen0.pem" "chainA-ICA1-key.pem"
create_an_intermediate "chainB" "ICA2" "1" "../ca-cert.pem" "../ca-key.pem"
create_an_intermediate "chainB" "ICA1" "0" "chainB-ICA2-pathlen1.pem" "chainB-ICA2-key.pem"
create_an_entity "chainB" "chainB-ICA1-pathlen0.pem" "chainB-ICA1-key.pem"
create_an_intermediate "chainC" "ICA1" "1" "../ca-cert.pem" "../ca-key.pem"
create_an_entity "chainC" "chainC-ICA1-pathlen1.pem" "chainC-ICA1-key.pem"
create_an_intermediate "chainD" "ICA1" "127" "../ca-cert.pem" "../ca-key.pem"
create_an_entity "chainD" "chainD-ICA1-pathlen127.pem" "chainD-ICA1-key.pem"
create_an_intermediate "chainE" "ICA1" "128" "../ca-cert.pem" "../ca-key.pem"
create_an_entity "chainE" "chainE-ICA1-pathlen128.pem" "chainE-ICA1-key.pem"
create_an_intermediate "chainF" "ICA2" "0" "../ca-cert.pem" "../ca-key.pem"
create_an_intermediate "chainF" "ICA1" "1" "chainF-ICA2-pathlen0.pem" "chainF-ICA2-key.pem"
create_an_entity "chainF" "chainF-ICA1-pathlen1.pem" "chainF-ICA1-key.pem"
create_an_intermediate "chainG" "ICA7" "100" "../ca-cert.pem" "../ca-key.pem"
create_an_intermediate "chainG" "ICA6" "10" "chainG-ICA7-pathlen100.pem" "chainG-ICA7-key.pem"
create_an_intermediate "chainG" "ICA5" "20" "chainG-ICA6-pathlen10.pem" "chainG-ICA6-key.pem"
create_an_intermediate "chainG" "ICA4" "5" "chainG-ICA5-pathlen20.pem" "chainG-ICA5-key.pem"
create_an_intermediate "chainG" "ICA3" "99" "chainG-ICA4-pathlen5.pem" "chainG-ICA4-key.pem"
create_an_intermediate "chainG" "ICA2" "1" "chainG-ICA3-pathlen99.pem" "chainG-ICA3-key.pem"
create_an_intermediate "chainG" "ICA1" "0" "chainG-ICA2-pathlen1.pem" "chainG-ICA2-key.pem"
create_an_entity "chainG" "chainG-ICA1-pathlen0.pem" "chainG-ICA1-key.pem"
# Fail: PathLen of 2, signing PathLen of 2, signing Pathlen of 2, signing PathLen 0
# max_path_len = 2, max_path_len -= 1 (1), max_path_len -= 1 (0), max-path_len 0, non-entity cert.
create_an_intermediate "chainH" "ICA4" "2" "../ca-cert.pem" "../ca-key.pem"
create_an_intermediate "chainH" "ICA3" "2" "chainH-ICA4-pathlen2.pem" "chainH-ICA4-key.pem"
create_an_intermediate "chainH" "ICA2" "2" "chainH-ICA3-pathlen2.pem" "chainH-ICA3-key.pem"
create_an_intermediate "chainH" "ICA1" "0" "chainH-ICA2-pathlen2.pem" "chainH-ICA2-key.pem"
create_an_entity "chainH" "chainH-ICA1-pathlen0.pem" "chainH-ICA1-key.pem"
# Success, PathLen of 2 followed by 2 Intermediates with no pathLen set
create_an_intermediate "chainI" "ICA3" "2" "../ca-cert.pem" "../ca-key.pem"
create_an_intermediate "chainI" "ICA2" "no_pathlen" "chainI-ICA3-pathlen2.pem" "chainI-ICA3-key.pem"
create_an_intermediate "chainI" "ICA1" "no_pathlen" "chainI-ICA2-no_pathlen.pem" "chainI-ICA2-key.pem"
create_an_entity "chainI" "chainI-ICA1-no_pathlen.pem" "chainI-ICA1-key.pem"
# Fail: PathLen of 2 followed by 3 Intermediates with no pathLen set
create_an_intermediate "chainJ" "ICA4" "2" "../ca-cert.pem" "../ca-key.pem"
create_an_intermediate "chainJ" "ICA3" "no_pathlen" "chainJ-ICA4-pathlen2.pem" "chainJ-ICA4-key.pem"
create_an_intermediate "chainJ" "ICA2" "no_pathlen" "chainJ-ICA3-no_pathlen.pem" "chainJ-ICA3-key.pem"
create_an_intermediate "chainJ" "ICA1" "no_pathlen" "chainJ-ICA2-no_pathlen.pem" "chainJ-ICA2-key.pem"
create_an_entity "chainJ" "chainJ-ICA1-no_pathlen.pem" "chainJ-ICA1-key.pem"
###########################################################
########## Assemble Chains ################
###########################################################
# Success: PathLen of 0
## chainA-ICA1-pathlen0.pem: signed by ca-cert.pem
## chainA-entity.pem: signed by chainA-ICA1-pathlen0.pem
cat chainA-entity.pem chainA-ICA1-pathlen0.pem > chainA-assembled.pem
# Success: PathLen of 1
## chainB-ICA2-pathlen1.pem: signed by ca-cert.pem
## chainB-ICA1-pathlen0.pem: signed by chainB-ICA2-pathlen1.pem
## chainB-entity.pem: signed by chainB-ICA1-pathlen0.pem
cat chainB-entity.pem chainB-ICA1-pathlen0.pem chainB-ICA2-pathlen1.pem > chainB-assembled.pem
## chainC-entity.pem: signed by chainC-ICA1-pathlen1.pem
cat chainC-entity.pem chainC-ICA1-pathlen1.pem > chainC-assembled.pem
# Success: PathLen of 127
## chainD-ICA1-pathlen127.pem: signed by ca-cert.pem
## chainD-entity.pem: signed by chainD-entity.pem
cat chainD-entity.pem chainD-ICA1-pathlen127.pem > chainD-assembled.pem
# Failure: PathLen of 128
## chainE-ICA1-pathlen128.pem: signed by ca-cert.pem
## chainE-entity.pem: signed by chainE-ICA1-pathlen128.pem
cat chainE-entity.pem chainE-ICA1-pathlen128.pem > chainE-assembled.pem
# Failure: PathLen of 0, signing PathLen of 1
## chainF-ICA1-pathlen1.pem: signed by chainA-ICA1-pathlen0.pem
## chainF-entity.pem: signed by chainF-ICA1-pathlen1.pem
cat chainF-entity.pem chainF-ICA1-pathlen1.pem chainF-ICA2-pathlen0.pem > chainF-assembled.pem
# Success: PathLen of 127, signing PathLen of 10, signing PathLen of 20, signing
# PathLen of 5, signing PathLen of 99, signing PathLen of 1, signing
# PathLen of 0
cat chainG-entity.pem chainG-ICA1-pathlen0.pem > chainG-assembled.pem
cat chainG-ICA2-pathlen1.pem chainG-ICA3-pathlen99.pem >> chainG-assembled.pem
cat chainG-ICA4-pathlen5.pem chainG-ICA5-pathlen20.pem >> chainG-assembled.pem
cat chainG-ICA6-pathlen10.pem chainG-ICA7-pathlen100.pem >> chainG-assembled.pem
# Fail: PathLen of 2, signing PathLen of 2, signing Pathlen of 2, signing PathLen 0
# max_path_len = 2, max_path_len -= 1 (1), max_path_len -= 1 (0), max-path_len 0, non-entity cert.
cat chainH-entity.pem chainH-ICA1-pathlen0.pem > chainH-assembled.pem
cat chainH-ICA2-pathlen2.pem chainH-ICA3-pathlen2.pem >> chainH-assembled.pem
cat chainH-ICA4-pathlen2.pem >> chainH-assembled.pem
# Fail:
cat chainI-entity.pem chainI-ICA1-no_pathlen.pem > chainI-assembled.pem
cat chainI-ICA2-no_pathlen.pem chainI-ICA3-pathlen2.pem >> chainI-assembled.pem
# Fail: PathLen of 2, signing PathLen of 2, signing Pathlen of 2, signing PathLen 0
# max_path_len = 2, max_path_len -= 1 (1), max_path_len -= 1 (0), max-path_len 0, non-entity cert.
cat chainJ-entity.pem chainJ-ICA1-no_pathlen.pem > chainJ-assembled.pem
cat chainJ-ICA2-no_pathlen.pem chainJ-ICA3-no_pathlen.pem >> chainJ-assembled.pem
cat chainJ-ICA4-pathlen2.pem >> chainJ-assembled.pem