-
Notifications
You must be signed in to change notification settings - Fork 7.4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'feature/add_generate_cert_script' into 'master'
add generate cert script See merge request espressif/esp-idf!24075
- Loading branch information
Showing
4 changed files
with
263 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
117 changes: 117 additions & 0 deletions
117
examples/wifi/wifi_enterprise/generate_certs/example-ca-openssl.cnf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,117 @@ | ||
| # OpenSSL configuration file | ||
|
|
||
| HOME = . | ||
| RANDFILE = $ENV::HOME/.rnd | ||
| oid_section = new_oids | ||
|
|
||
| [ new_oids ] | ||
|
|
||
| [ ca ] | ||
| default_ca = CA_default | ||
|
|
||
| [ CA_default ] | ||
|
|
||
| dir = ./ca | ||
| certs = $dir/certs | ||
| crl_dir = $dir/crl | ||
| database = $dir/index.txt | ||
| unique_subject = no | ||
| new_certs_dir = $dir/newcerts | ||
| certificate = $dir/cacert.pem | ||
| serial = $dir/serial | ||
| crlnumber = $dir/crlnumber | ||
| crl = $dir/crl.pem | ||
| private_key = $dir/private/cakey.pem | ||
| RANDFILE = $dir/private/.rand | ||
|
|
||
| x509_extensions = usr_cert | ||
|
|
||
| name_opt = ca_default | ||
| cert_opt = ca_default | ||
|
|
||
| copy_extensions = copy | ||
|
|
||
| default_days = 3650 | ||
| default_crl_days= 30 | ||
| default_md = default | ||
| preserve = no | ||
|
|
||
| policy = policy_match | ||
|
|
||
| [ policy_match ] | ||
| countryName = match | ||
| stateOrProvinceName = optional | ||
| organizationName = match | ||
| organizationalUnitName = optional | ||
| commonName = supplied | ||
| #emailAddress = optional | ||
|
|
||
| [ policy_anything ] | ||
| countryName = optional | ||
| stateOrProvinceName = optional | ||
| localityName = optional | ||
| organizationName = optional | ||
| organizationalUnitName = optional | ||
| commonName = supplied | ||
| #emailAddress = optional | ||
|
|
||
| [ req ] | ||
| distinguished_name = req_distinguished_name | ||
| attributes = req_attributes | ||
| x509_extensions = v3_ca | ||
|
|
||
| string_mask = utf8only | ||
|
|
||
| [ req_distinguished_name ] | ||
| countryName = Country Name (2 letter code) | ||
| countryName_default = CN | ||
| countryName_min = 2 | ||
| countryName_max = 2 | ||
|
|
||
| localityName = Locality Name (eg, city) | ||
| localityName_default = Shanghai | ||
|
|
||
| 0.organizationName = Organization Name (eg, company) | ||
| 0.organizationName_default = espressif | ||
|
|
||
| commonName = Common Name (e.g. server FQDN or YOUR name) | ||
| #@CN@ | ||
| commonName_max = 64 | ||
|
|
||
| [ req_attributes ] | ||
|
|
||
| [ v3_ca ] | ||
|
|
||
| subjectKeyIdentifier=hash | ||
| authorityKeyIdentifier=keyid:always,issuer | ||
| basicConstraints = critical, CA:true | ||
| #keyUsage = critical, cRLSign, keyCertSign | ||
|
|
||
| [ crl_ext ] | ||
|
|
||
| # issuerAltName=issuer:copy | ||
| authorityKeyIdentifier=keyid:always | ||
|
|
||
| [ usr_cert ] | ||
| basicConstraints=CA:FALSE | ||
| nsComment = "OpenSSL Generated Certificate" | ||
| subjectKeyIdentifier=hash | ||
| authorityKeyIdentifier=keyid:issuer | ||
|
|
||
| [ v3_req ] | ||
| basicConstraints = CA:FALSE | ||
| keyUsage = nonRepudiation, digitalSignature, keyEncipherment | ||
|
|
||
| [ ext_client ] | ||
| extendedKeyUsage = 1.3.6.1.5.5.7.3.2 | ||
| basicConstraints=CA:FALSE | ||
| subjectKeyIdentifier = hash | ||
| nsComment = "OpenSSL Generated Certificate" | ||
| authorityKeyIdentifier = keyid:always, issuer | ||
|
|
||
| [ ext_server ] | ||
| extendedKeyUsage = 1.3.6.1.5.5.7.3.1 | ||
| basicConstraints=CA:FALSE | ||
| subjectKeyIdentifier = hash | ||
| nsComment = "OpenSSL Generated Certificate" | ||
| authorityKeyIdentifier = keyid:always, issuer |
126 changes: 126 additions & 0 deletions
126
examples/wifi/wifi_enterprise/generate_certs/generate_certs.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,126 @@ | ||
| #!/bin/bash | ||
|
|
||
| help_text=" | ||
| Usage: generate_certs.sh <cert_type>\n | ||
| <cert_type> only support p384, 2048, 3072, 4096\n | ||
| example:\n | ||
| sh generate_certs.sh p384\n | ||
| sh generate_certs.sh 2048\n | ||
| sh generate_certs.sh 3072\n | ||
| sh generate_certs.sh 4096\n | ||
| " | ||
|
|
||
| DIGEST="-sha256" | ||
| DIGEST_CA="-md sha256" | ||
| CERT_TYPE="2048" | ||
| CERT="2048-ca" | ||
|
|
||
| show_help() { | ||
| echo -e $help_text | ||
| } | ||
|
|
||
| init_param() { | ||
| if [ $(basename "$(pwd)") != "generate_certs" ]; then | ||
| echo "path is incorrect, please go into generate_certs directory" | ||
| exit | ||
| fi | ||
|
|
||
| CERT_TYPE=$1 | ||
| CERT=${CERT_TYPE}-ca | ||
|
|
||
| if [ -d "$CERT" ]; then | ||
| rm -rf "$CERT" | ||
| fi | ||
|
|
||
| if [ $1 = "p384" ] || [ $1 = "3072" ]; then | ||
| DIGEST="-sha384" | ||
| DIGEST_CA="-md sha384" | ||
| elif [ $1 = "2048" ] || [ $1 = "4096" ]; then | ||
| DIGEST="-sha256" | ||
| DIGEST_CA="-md sha256" | ||
| else | ||
| echo "parameter error" | ||
| exit | ||
| fi | ||
| } | ||
|
|
||
| create_ca() { | ||
| echo | ||
| echo "---[ Root CA ]----------------------------------------------------------" | ||
|
|
||
| if [ -d $CERT ]; then | ||
| rm $CERT | ||
| fi | ||
|
|
||
| mkdir -p $CERT | ||
| cat example-ca-openssl.cnf | | ||
| sed "s/#@CN@/commonName_default = Root CA/" | | ||
| sed s%\./ca$%./$CERT% \ | ||
| > ${CERT}-openssl.cnf.tmp | ||
| mkdir -p $CERT/certs $CERT/crl $CERT/newcerts $CERT/private | ||
| case "$CERT_TYPE" in | ||
| "p384") openssl ecparam -out $CERT/ca.key -name secp384r1 -genkey;; | ||
| "2048") openssl genrsa -out $CERT/ca.key 2048;; | ||
| "3072") openssl genrsa -out $CERT/ca.key 3072;; | ||
| "4096") openssl genrsa -out $CERT/ca.key 4096;; | ||
| esac | ||
| openssl req -config ${CERT}-openssl.cnf.tmp -batch -new -x509 -key $CERT/ca.key -out $CERT/ca.pem $DIGEST | ||
| touch $CERT/index.txt | ||
| rm ${CERT}-openssl.cnf.tmp | ||
| } | ||
|
|
||
| create_certs() { | ||
| echo | ||
| echo "---[ Server ]-----------------------------------------------------------" | ||
| echo | ||
|
|
||
| cat example-ca-openssl.cnf | | ||
| sed "s/#@CN@/commonName_default = $CERT_TYPE.$1/" | | ||
| sed s%\./ca$%./$CERT% \ | ||
| > ${CERT}-openssl.cnf.tmp | ||
| echo "---[ Generate $1 Key]----------------------------------------------" | ||
| case "$CERT_TYPE" in | ||
| "p384") openssl ecparam -out $CERT/$1.key -name secp384r1 -genkey;; | ||
| "2048") openssl genrsa -out $CERT/$1.key 2048;; | ||
| "3072") openssl genrsa -out $CERT/$1.key 3072;; | ||
| "4096") openssl genrsa -out $CERT/$1.key 4096;; | ||
| esac | ||
| echo "---[ Generate $1 Req]----------------------------------------------" | ||
| openssl req -config ${CERT}-openssl.cnf.tmp -batch -new -key $CERT/$1.key -out $CERT/$1.req $DIGEST | ||
| openssl ca -config ${CERT_TYPE}-ca-openssl.cnf.tmp -batch -keyfile $CERT/ca.key -cert $CERT/ca.pem -create_serial -in $CERT/$1.req -out $CERT/$1.pem -extensions ext_$1 ${DIGEST_CA} | ||
| cp $CERT/$1.pem $CERT/$1.crt | ||
| rm ${CERT_TYPE}-ca-openssl.cnf.tmp | ||
| } | ||
|
|
||
| verify() { | ||
| echo | ||
| echo "---[ Verify ]-----------------------------------------------------------" | ||
| echo | ||
|
|
||
| openssl verify -CAfile $CERT/ca.pem $CERT/server.pem | ||
| openssl verify -CAfile $CERT/ca.pem $CERT/server.crt | ||
| openssl verify -CAfile $CERT/ca.pem $CERT/client.pem | ||
| openssl verify -CAfile $CERT/ca.pem $CERT/client.crt | ||
| } | ||
|
|
||
| clean() { | ||
| rm $CERT/*.req | ||
| rm $CERT/index* | ||
| rm $CERT/serial* | ||
| rm -rf $CERT/certs | ||
| rm -rf $CERT/newcerts | ||
| rm -rf $CERT/private | ||
| rm -rf $CERT/crl | ||
| } | ||
|
|
||
| if [ "$1" = "--help" ] || [ "$1" = "-h" ] || [ -z "$1" ]; then | ||
| show_help | ||
| exit 0 | ||
| else | ||
| init_param $1 | ||
| create_ca | ||
| create_certs "server" | ||
| create_certs "client" | ||
| verify | ||
| clean | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters