summaryrefslogtreecommitdiffstats
path: root/sca-cpp/trunk/modules/http/ssl-ca-conf
blob: e7b9f96ee2420edd830a72b53d5a1af5a9614c99 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
#!/bin/sh

#  Licensed to the Apache Software Foundation (ASF) under one
#  or more contributor license agreements.  See the NOTICE file
#  distributed with this work for additional information
#  regarding copyright ownership.  The ASF licenses this file
#  to you under the Apache License, Version 2.0 (the
#  "License"); you may not use this file except in compliance
#  with the License.  You may obtain a copy of the License at
#  
#    http://www.apache.org/licenses/LICENSE-2.0
#    
#  Unless required by applicable law or agreed to in writing,
#  software distributed under the License is distributed on an
#  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
#  KIND, either express or implied.  See the License for the
#  specific language governing permissions and limitations
#  under the License.

# Generate a test certification authority certificate
here=`readlink -f $0`; here=`dirname $here`
mkdir -p $1
root=`readlink -f $1`

host=$2

# Don't override existing certificate
if [ -f $root/cert/ca.crt ]; then
    return 0
fi

# Generate openssl configuration
mkdir -p $root/cert
umask 0007
cat >$root/cert/openssl-ca.conf <<EOF
[ req ]
default_bits = 1024
encrypt_key = no
prompt = no
distinguished_name = req_distinguished_name
x509_extensions = v3_ca

[ req_distinguished_name ]
C = US
ST = CA
L = San Francisco
O = $host
OU = authority
CN = $host
emailAddress = admin@$host

[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
basicConstraints = CA:true

[ca]
default_ca = ca_default

[ca_default]
certificate = $root/cert/ca.crt
private_key = $root/cert/ca.key
serial = $root/cert/ca-serial
database = $root/cert/ca-database
new_certs_dir = $root/cert
default_md = sha1
email_in_dn = no
default_days = 365
default_crl_days = 30
policy = policy_any
copy_extensions = none

[ policy_any ]
countryName = supplied
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

EOF

rm -rf $root/cert/*.crt $root/cert/*.pem $root/cert/hash
rm -f $root/cert/ca-database
echo 1000 > $root/cert/ca-serial
touch $root/cert/ca-database

# Generate the certification authority certificate
openssl req -new -x509 -config $root/cert/openssl-ca.conf -out $root/cert/ca.crt -keyout $root/cert/ca.key

# Add to the hash directory and rehash
mkdir -p $root/cert/hash
cp $root/cert/ca.crt $root/cert/hash
c_rehash $root/cert/hash