mirror of
https://github.com/square/certigo.git
synced 2024-04-21 12:32:40 +00:00
86 lines
3.2 KiB
Makefile
86 lines
3.2 KiB
Makefile
TARGETS = \
|
|
example-root example-leaf example-sha1 example-md5 example-root-bad-ku \
|
|
example-bad-serial example-small-key example-expired example-elliptic-sha1 \
|
|
example-custom-oid example-name-constraints
|
|
|
|
all: \
|
|
$(addsuffix .crt,$(TARGETS)) \
|
|
$(addsuffix .p12,$(TARGETS)) \
|
|
$(addsuffix .p7b,$(TARGETS)) \
|
|
$(addsuffix .jceks,$(TARGETS))
|
|
|
|
clean:
|
|
rm -f example-*
|
|
|
|
.PHONY: all clean
|
|
|
|
# Generic commands
|
|
%.key:
|
|
openssl genrsa -out $@ 2048
|
|
|
|
%.csr: %.key
|
|
openssl req -new -key $< -out $@ -subj /C=US/ST=CA/O=certigo/OU=example/CN=$(@:.csr=)
|
|
|
|
%.p12: %.crt %.key
|
|
openssl pkcs12 -export -out $@ -in $< -inkey $(@:.p12=.key) -name $(@:.p12=) -password pass:password
|
|
|
|
%.p7b: %.crt
|
|
openssl crl2pkcs7 -nocrl -certfile $< -out $@
|
|
|
|
%.jceks: %.p12
|
|
keytool -importkeystore \
|
|
-destkeystore $@ -deststoretype JCEKS -destkeypass password -deststorepass password -destalias $* \
|
|
-srckeystore $< -srcstoretype PKCS12 -srcstorepass password -srcalias $* -storetype JCEKS
|
|
|
|
# Good root cert
|
|
example-root.crt: example-root.csr
|
|
openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions root
|
|
|
|
# Good leaf cert
|
|
example-leaf.crt: example-leaf.csr
|
|
openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions leaf
|
|
|
|
# Bad cert with SHA-1 instead of SHA-2
|
|
example-sha1.crt: example-sha1.csr
|
|
openssl x509 -req -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions leaf
|
|
|
|
# Bad cert with MD-5 instead of SHA-2
|
|
example-md5.crt: example-md5.csr
|
|
openssl x509 -req -md5 -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions leaf
|
|
|
|
# Bad root cert with missing "cert sign" key usage
|
|
example-root-bad-ku.crt: example-root-bad-ku.csr
|
|
openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions root_bad
|
|
|
|
# Bad cert with invalid serial
|
|
example-bad-serial.crt: example-bad-serial.csr
|
|
openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -set_serial 0 -days 2500 -extfile openssl.ext -extensions leaf
|
|
|
|
# Example with small RSA key
|
|
example-small-key.key:
|
|
openssl genrsa -out $@ 1024
|
|
|
|
example-small-key.crt: example-small-key.csr
|
|
openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -days 2500
|
|
|
|
# Short expiry certificate (OpenSSL requires min. of 1 day, so let's do that)
|
|
example-expired.crt: example-expired.csr
|
|
openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -days 1
|
|
|
|
# Example ECC key
|
|
example-elliptic-sha1.key:
|
|
openssl ecparam -genkey -name secp521r1 -out $@
|
|
|
|
example-elliptic-sha1.crt: example-elliptic-sha1.csr
|
|
openssl x509 -req -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions leaf
|
|
|
|
# Custom OID
|
|
example-custom-oid.csr: example-custom-oid.key
|
|
openssl req -new -config example-custom-oid.conf -key $< -out $@
|
|
|
|
example-custom-oid.crt: example-custom-oid.csr
|
|
openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions leaf
|
|
|
|
example-name-constraints.crt: example-name-constraints.csr
|
|
openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions root_with_constraints
|