API tools faq
paste
Guest User

OpenWrt OpenSSL log

a guest
Nov 8th, 2013
177
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 13.66 KB | None | 0 0
raw download clone embed print report
  1. root@OpenWrt:~#
  2. root@OpenWrt:~# mkdir -p /tmp/ssl/test
  3. root@OpenWrt:~# cd /tmp/ssl/test
  4. root@OpenWrt:/tmp/ssl/test#
  5. root@OpenWrt:/tmp/ssl/test# export OPENSSL_CONF="../openssl.cnf"
  6. root@OpenWrt:/tmp/ssl/test# extfile="../extensions.cnf"
  7. root@OpenWrt:/tmp/ssl/test#
  8. root@OpenWrt:/tmp/ssl/test# openssldir="/etc/ssl"
  9. root@OpenWrt:/tmp/ssl/test# sed '/^\[ CA_default ]/,/^\[/s/^\(dir[ \t]*=[ \t]*\)[^ \t]\+/\1$ENV::DIR/' "${openssldir:?}/openssl.cnf" > "${OPENSSL_CONF:?}"
  10. root@OpenWrt:/tmp/ssl/test# cat > "${extfile:?}"
  11. # subjectAltName
  12. SAN = email:copy
  13.  
  14. # OIDs for IKE
  15. ipsecIKE        = 1.3.6.1.5.5.7.3.17    # RFC 4945
  16. #iKEIntermediate = 1.3.6.1.5.5.8.2.2    # draft-ietf-ipsec-pki-req (expired)
  17.  
  18. [ my_ca ]
  19. subjectKeyIdentifier = hash
  20. authorityKeyIdentifier = keyid:always,issuer
  21. basicConstraints = critical, CA:true
  22. keyUsage = cRLSign, keyCertSign
  23. subjectAltName = $ENV::SAN
  24.  
  25. [ my_server ]
  26. #basicConstraints=CA:FALSE
  27. subjectKeyIdentifier=hash
  28. authorityKeyIdentifier=keyid,issuer
  29. # keyUsage may be consistent: digitalSignature, keyEncipherment or keyAgreement
  30. keyUsage = digitalSignature, keyEncipherment
  31. # extendedKeyUsage for both TLS and IKE
  32. extendedKeyUsage = serverAuth, $ipsecIKE
  33. subjectAltName = $ENV::SAN
  34.  
  35. [ my_client ]
  36. #basicConstraints=CA:FALSE
  37. subjectKeyIdentifier=hash
  38. authorityKeyIdentifier=keyid,issuer
  39. # keyUsage may be consistent: digitalSignature and/or keyAgreement
  40. keyUsage = digitalSignature
  41. # extendedKeyUsage for both TLS and IKE
  42. extendedKeyUsage = clientAuth, $ipsecIKE
  43. subjectAltName = $ENV::SAN
  44.  
  45. [ my_code ]
  46. #basicConstraints=CA:FALSE
  47. subjectKeyIdentifier=hash
  48. authorityKeyIdentifier=keyid,issuer
  49. # keyUsage may be consistent: digitalSignature
  50. keyUsage = digitalSignature
  51. extendedKeyUsage = codeSigning
  52. subjectAltName = $ENV::SAN
  53.  
  54. [ my_email ]
  55. #basicConstraints=CA:FALSE
  56. subjectKeyIdentifier=hash
  57. authorityKeyIdentifier=keyid,issuer
  58. # keyUsage may be consistent: digitalSignature, nonRepudiation, and/or (keyEncipherment or keyAgreement)
  59. keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  60. extendedKeyUsage = emailProtection
  61. subjectAltName = $ENV::SAN
  62.  
  63. [ my_ipsec ]
  64. #basicConstraints=CA:FALSE
  65. subjectKeyIdentifier=hash
  66. authorityKeyIdentifier=keyid,issuer
  67. # keyUsage may be consistent: digitalSignature and/or nonRepudiation
  68. keyUsage = digitalSignature
  69. # extendedKeyUsage for IKE, defined but NOT RECOMMENDED in RFC 4945
  70. #extendedKeyUsage = $ipsecIKE
  71. subjectAltName = $ENV::SAN
  72. 【Ctrl-D で抜ける】
  73. root@OpenWrt:/tmp/ssl/test#
  74. root@OpenWrt:/tmp/ssl/test# diff -u "${openssldir:?}/openssl.cnf" "${OPENSSL_CONF:?}"
  75. --- /etc/ssl/openssl.cnf    2013-03-24 01:43:14.000000000 +0900
  76. +++ ../openssl.cnf  2013-11-07 22:42:50.711171717 +0900
  77. @@ -39,7 +39,7 @@
  78.  ####################################################################
  79.  [ CA_default ]
  80.  
  81. -dir        = ./demoCA      # Where everything is kept
  82. +dir        = $ENV::DIR     # Where everything is kept
  83.  certs      = $dir/certs        # Where the issued certs are kept
  84.  crl_dir        = $dir/crl      # Where the issued crl are kept
  85.  database   = $dir/index.txt    # database index file.
  86. root@OpenWrt:/tmp/ssl/test# cat "${extfile:?}"
  87. # subjectAltName
  88. SAN = email:copy
  89.  
  90. # OIDs for IKE
  91. ipsecIKE        = 1.3.6.1.5.5.7.3.17    # RFC 4945
  92. #iKEIntermediate = 1.3.6.1.5.5.8.2.2    # draft-ietf-ipsec-pki-req (expired)
  93.  
  94. [ my_ca ]
  95. subjectKeyIdentifier = hash
  96. authorityKeyIdentifier = keyid:always,issuer
  97. basicConstraints = critical, CA:true
  98. keyUsage = cRLSign, keyCertSign
  99. subjectAltName = $ENV::SAN
  100.  
  101. [ my_server ]
  102. #basicConstraints=CA:FALSE
  103. subjectKeyIdentifier=hash
  104. authorityKeyIdentifier=keyid,issuer
  105. # keyUsage may be consistent: digitalSignature, keyEncipherment or keyAgreement
  106. keyUsage = digitalSignature, keyEncipherment
  107. # extendedKeyUsage for both TLS and IKE
  108. extendedKeyUsage = serverAuth, $ipsecIKE
  109. subjectAltName = $ENV::SAN
  110.  
  111. [ my_client ]
  112. #basicConstraints=CA:FALSE
  113. subjectKeyIdentifier=hash
  114. authorityKeyIdentifier=keyid,issuer
  115. # keyUsage may be consistent: digitalSignature and/or keyAgreement
  116. keyUsage = digitalSignature
  117. # extendedKeyUsage for both TLS and IKE
  118. extendedKeyUsage = clientAuth, $ipsecIKE
  119. subjectAltName = $ENV::SAN
  120.  
  121. [ my_code ]
  122. #basicConstraints=CA:FALSE
  123. subjectKeyIdentifier=hash
  124. authorityKeyIdentifier=keyid,issuer
  125. # keyUsage may be consistent: digitalSignature
  126. keyUsage = digitalSignature
  127. extendedKeyUsage = codeSigning
  128. subjectAltName = $ENV::SAN
  129.  
  130. [ my_email ]
  131. #basicConstraints=CA:FALSE
  132. subjectKeyIdentifier=hash
  133. authorityKeyIdentifier=keyid,issuer
  134. # keyUsage may be consistent: digitalSignature, nonRepudiation, and/or (keyEncipherment or keyAgreement)
  135. keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  136. extendedKeyUsage = emailProtection
  137. subjectAltName = $ENV::SAN
  138.  
  139. [ my_ipsec ]
  140. #basicConstraints=CA:FALSE
  141. subjectKeyIdentifier=hash
  142. authorityKeyIdentifier=keyid,issuer
  143. # keyUsage may be consistent: digitalSignature and/or nonRepudiation
  144. keyUsage = digitalSignature
  145. # extendedKeyUsage for IKE, defined but NOT RECOMMENDED in RFC 4945
  146. #extendedKeyUsage = $ipsecIKE
  147. subjectAltName = $ENV::SAN
  148. root@OpenWrt:/tmp/ssl/test#
  149. root@OpenWrt:/tmp/ssl/test# prefix="/C=JP/ST=Tokyo/O=Example"
  150. root@OpenWrt:/tmp/ssl/test# email="[email protected]"
  151. root@OpenWrt:/tmp/ssl/test#
  152. root@OpenWrt:/tmp/ssl/test# export DIR="./myCA"
  153. root@OpenWrt:/tmp/ssl/test# mkdir -p "${DIR:?}"
  154. root@OpenWrt:/tmp/ssl/test# mkdir -p "${DIR:?}/certs"
  155. root@OpenWrt:/tmp/ssl/test# mkdir -p "${DIR:?}/crl"
  156. root@OpenWrt:/tmp/ssl/test# mkdir -p "${DIR:?}/newcerts"
  157. root@OpenWrt:/tmp/ssl/test# mkdir -p "${DIR:?}/private"
  158. root@OpenWrt:/tmp/ssl/test# mkdir -p "${DIR:?}/private/.rand"
  159. root@OpenWrt:/tmp/ssl/test# touch "${DIR:?}/index.txt"
  160. root@OpenWrt:/tmp/ssl/test# echo 01 > "${DIR:?}/crlnumber"
  161. root@OpenWrt:/tmp/ssl/test#
  162. root@OpenWrt:/tmp/ssl/test# ca="Test CA"
  163. root@OpenWrt:/tmp/ssl/test# openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -aes-256-cbc -out "${DIR:?}/private/cakey.pem"
  164. .........................................+++
  165. .......+++
  166. Enter PEM pass phrase:
  167. Verifying - Enter PEM pass phrase:
  168. root@OpenWrt:/tmp/ssl/test# openssl req -new -subj "${prefix:?}/CN=${ca:?}/emailAddress=${email:?}" -sha1 -out "${DIR:?}/careq.pem" -key "${DIR:?}/private/cakey.pem"
  169. Enter pass phrase for ./myCA/private/cakey.pem:
  170. root@OpenWrt:/tmp/ssl/test# openssl ca -extfile "${extfile:?}" -extensions my_ca -create_serial -days 3652 -md sha1 -out "${DIR:?}/cacert.pem" -batch -keyfile "${DIR:?}/private/cakey.pem" -selfsign -infiles "${DIR:?}/careq.pem"
  171. Using configuration from ../openssl.cnf
  172. Enter pass phrase for ./myCA/private/cakey.pem:
  173. Check that the request matches the signature
  174. Signature ok
  175. Certificate Details:
  176.         Serial Number:
  177.             d2:e1:ad:42:a4:49:87:8d
  178.         Validity
  179.             Not Before: Nov  7 13:43:50 2013 GMT
  180.             Not After : Nov  7 13:43:50 2023 GMT
  181.         Subject:
  182.             countryName               = JP
  183.             stateOrProvinceName       = Tokyo
  184.             organizationName          = Example
  185.             commonName                = Test CA
  186.             emailAddress              = test@example.net
  187.         X509v3 extensions:
  188.             X509v3 Subject Key Identifier:
  189.                 22:E0:FC:E9:D4:B3:CD:F8:F8:9C:87:20:CA:7D:92:11:CE:B7:94:8E
  190.             X509v3 Authority Key Identifier:
  191.                 keyid:22:E0:FC:E9:D4:B3:CD:F8:F8:9C:87:20:CA:7D:92:11:CE:B7:94:8E
  192.  
  193.             X509v3 Basic Constraints: critical
  194.                 CA:TRUE
  195.             X509v3 Key Usage:
  196.                 Certificate Sign, CRL Sign
  197.             X509v3 Subject Alternative Name:
  198.                 email:test@example.net
  199. Certificate is to be certified until Nov  7 13:43:50 2023 GMT (3652 days)
  200.  
  201. Write out database with 1 new entries
  202. Data Base Updated
  203. root@OpenWrt:/tmp/ssl/test#
  204. root@OpenWrt:/tmp/ssl/test# cn="server.example.net"
  205. root@OpenWrt:/tmp/ssl/test# openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "${cn:?}.key"
  206. ...................................................................................................+++
  207. ............+++
  208. root@OpenWrt:/tmp/ssl/test# openssl req -new -subj "${prefix:?}/CN=${cn:?}/emailAddress=${email:?}" -sha1 -out newreq.pem -key "${cn:?}.key"
  209. root@OpenWrt:/tmp/ssl/test# env SAN="DNS:${cn:?}" openssl ca -extfile "${extfile:?}" -extensions my_server -days 3652 -md sha1 -out "${cn:?}.crt" -infiles newreq.pem
  210. Using configuration from ../openssl.cnf
  211. Enter pass phrase for ./myCA/private/cakey.pem:
  212. Check that the request matches the signature
  213. Signature ok
  214. Certificate Details:
  215.         Serial Number:
  216.             d2:e1:ad:42:a4:49:87:8e
  217.         Validity
  218.             Not Before: Nov  7 13:44:27 2013 GMT
  219.             Not After : Nov  7 13:44:27 2023 GMT
  220.         Subject:
  221.             countryName               = JP
  222.             stateOrProvinceName       = Tokyo
  223.             organizationName          = Example
  224.             commonName                = server.example.net
  225.             emailAddress              = test@example.net
  226.         X509v3 extensions:
  227.             X509v3 Subject Key Identifier:
  228.                 EF:89:66:88:5A:98:F1:66:C5:E0:82:5C:43:26:84:9B:E8:64:06:D9
  229.             X509v3 Authority Key Identifier:
  230.                 keyid:22:E0:FC:E9:D4:B3:CD:F8:F8:9C:87:20:CA:7D:92:11:CE:B7:94:8E
  231.  
  232.             X509v3 Key Usage:
  233.                 Digital Signature, Key Encipherment
  234.             X509v3 Extended Key Usage:
  235.                 TLS Web Server Authentication, 1.3.6.1.5.5.7.3.17
  236.             X509v3 Subject Alternative Name:
  237.                 DNS:server.example.net
  238. Certificate is to be certified until Nov  7 13:44:27 2023 GMT (3652 days)
  239. Sign the certificate? [y/n]:y
  240.  
  241.  
  242. 1 out of 1 certificate requests certified, commit? [y/n]y
  243. Write out database with 1 new entries
  244. Data Base Updated
  245. root@OpenWrt:/tmp/ssl/test#
  246. root@OpenWrt:/tmp/ssl/test# cn="client.example.net"
  247. root@OpenWrt:/tmp/ssl/test# openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -aes-256-cbc -out "${cn:?}.key"
  248. ......................................+++
  249. ....+++
  250. Enter PEM pass phrase:
  251. Verifying - Enter PEM pass phrase:
  252. root@OpenWrt:/tmp/ssl/test# openssl req -new -subj "${prefix:?}/CN=${cn:?}/emailAddress=${email:?}" -sha1 -out newreq.pem -key "${cn:?}.key"
  253. Enter pass phrase for client.example.net.key:
  254. root@OpenWrt:/tmp/ssl/test# env SAN="DNS:${cn:?}" openssl ca -extfile "${extfile:?}" -extensions my_client -days 3652 -md sha1 -out "${cn:?}.crt" -infiles newreq.pem
  255. Using configuration from ../openssl.cnf
  256. Enter pass phrase for ./myCA/private/cakey.pem:
  257. Check that the request matches the signature
  258. Signature ok
  259. Certificate Details:
  260.         Serial Number:
  261.             d2:e1:ad:42:a4:49:87:8f
  262.         Validity
  263.             Not Before: Nov  7 13:45:05 2013 GMT
  264.             Not After : Nov  7 13:45:05 2023 GMT
  265.         Subject:
  266.             countryName               = JP
  267.             stateOrProvinceName       = Tokyo
  268.             organizationName          = Example
  269.             commonName                = client.example.net
  270.             emailAddress              = test@example.net
  271.         X509v3 extensions:
  272.             X509v3 Subject Key Identifier:
  273.                 AD:81:69:86:57:82:41:90:BC:34:27:9C:26:BD:1F:DE:7C:08:89:D5
  274.             X509v3 Authority Key Identifier:
  275.                 keyid:22:E0:FC:E9:D4:B3:CD:F8:F8:9C:87:20:CA:7D:92:11:CE:B7:94:8E
  276.  
  277.             X509v3 Key Usage:
  278.                 Digital Signature
  279.             X509v3 Extended Key Usage:
  280.                 TLS Web Client Authentication, 1.3.6.1.5.5.7.3.17
  281.             X509v3 Subject Alternative Name:
  282.                 DNS:client.example.net
  283. Certificate is to be certified until Nov  7 13:45:05 2023 GMT (3652 days)
  284. Sign the certificate? [y/n]:y
  285.  
  286.  
  287. 1 out of 1 certificate requests certified, commit? [y/n]y
  288. Write out database with 1 new entries
  289. Data Base Updated
  290. root@OpenWrt:/tmp/ssl/test# openssl pkcs12 -in "${cn:?}.crt" -inkey "${cn:?}.key" -certfile "${DIR:?}/cacert.pem" -export -name "${cn:?}" -caname "${ca:?}" -aes256 -out "${cn:?}.p12"
  291. Enter pass phrase for client.example.net.key:
  292. Enter Export Password:
  293. Verifying - Enter Export Password:
  294. root@OpenWrt:/tmp/ssl/test#
  295. root@OpenWrt:/tmp/ssl/test# ls -AFl . .. ./myCA
  296. .:
  297. -rw-r--r--    1 root     root          4687 Nov  7 22:45 client.example.net.crt
  298. -rw-r--r--    1 root     root          1858 Nov  7 22:44 client.example.net.key
  299. -rw-r--r--    1 root     root          3754 Nov  7 22:45 client.example.net.p12
  300. drwxr-xr-x    6 root     root           300 Nov  7 22:45 myCA/
  301. -rw-r--r--    1 root     root          1013 Nov  7 22:44 newreq.pem
  302. -rw-r--r--    1 root     root          4705 Nov  7 22:44 server.example.net.crt
  303. -rw-r--r--    1 root     root          1708 Nov  7 22:44 server.example.net.key
  304.  
  305. ..:
  306. -rw-r--r--    1 root     root          1887 Nov  7 22:42 extensions.cnf
  307. -rw-r--r--    1 root     root         10836 Nov  7 22:42 openssl.cnf
  308. drwxr-xr-x    3 root     root           180 Nov  7 22:45 test/
  309.  
  310. ./myCA:
  311. -rw-r--r--    1 root     root          4610 Nov  7 22:43 cacert.pem
  312. -rw-r--r--    1 root     root           997 Nov  7 22:43 careq.pem
  313. drwxr-xr-x    2 root     root            40 Nov  7 22:43 certs/
  314. drwxr-xr-x    2 root     root            40 Nov  7 22:43 crl/
  315. -rw-r--r--    1 root     root             3 Nov  7 22:43 crlnumber
  316. -rw-r--r--    1 root     root           346 Nov  7 22:45 index.txt
  317. -rw-r--r--    1 root     root            21 Nov  7 22:45 index.txt.attr
  318. -rw-r--r--    1 root     root            21 Nov  7 22:44 index.txt.attr.old
  319. -rw-r--r--    1 root     root           227 Nov  7 22:44 index.txt.old
  320. drwxr-xr-x    2 root     root           100 Nov  7 22:45 newcerts/
  321. drwxr-xr-x    3 root     root            80 Nov  7 22:43 private/
  322. -rw-r--r--    1 root     root            17 Nov  7 22:45 serial
  323. -rw-r--r--    1 root     root            17 Nov  7 22:44 serial.old
  324. root@OpenWrt:/tmp/ssl/test#
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!