genKey(){ #subj, internalName
openssl genrsa -out $2.key ${KEYSIZE}
- openssl req -new -key $2.key -out $2.csr -subj "$1/O=Test Environment CA Ltd./OU=Test Environment CAs"
+ openssl req -new -key $2.key -out $2.csr -subj "$1/O=Test Environment CA Ltd./OU=Test Environment CAs/C=AU"
}
####### create various extensions files for the various certificate types ######
cat <<TESTCA > ca.cnf
-basicConstraints = CA:true
-keyUsage = keyCertSign, cRLSign
+basicConstraints = critical,CA:true
+keyUsage =critical, keyCertSign, cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always
authorityInfoAccess = OCSP;URI:http://g2.ocsp.${DOMAIN},caIssuers;URI:http://g2.crt.${DOMAIN}/g2/root.crt
TESTCA
-cat <<TESTCA > subca.cnf
-basicConstraints = CA:true
-keyUsage = keyCertSign, cRLSign
+
+rootSign(){ # csr
+ POLICY=ca.cnf
+ if [[ "$1" != "root" ]] ; then
+ KNAME=$1
+ POLICY=subca.cnf
+ . ../CAs/${KNAME}
+ cat <<TESTCA > subca.cnf
+
+basicConstraints =critical, CA:true
+keyUsage =critical, keyCertSign, cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always
crlDistributionPoints=URI:http://g2.crl.${DOMAIN}/g2/root.crl
authorityInfoAccess = OCSP;URI:http://g2.ocsp.${DOMAIN},caIssuers;URI:http://g2.crt.${DOMAIN}/g2/root.crt
-TESTCA
+certificatePolicies=@polsect
-rootSign(){ # csr
- caSign "$1.ca/key" root subca.cnf
+[polsect]
+policyIdentifier = 1.3.6.1.4.1.18506.9.${CPSID}
+CPS.1="http://g2.cps.${DOMAIN}/g2/${KNAME}.cps"
+
+TESTCA
+ fi
+ caSign "$1.ca/key" root $POLICY
}
cd generated
genTimeCA(){ #csr,ca to sign with,start,end
+ KNAME=$2
+ . ../CAs/${KNAME}
cat <<TESTCA > timesubca.cnf
-basicConstraints = CA:true
-keyUsage = keyCertSign, cRLSign
+basicConstraints=critical,CA:true
+keyUsage=critical,keyCertSign, cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always
crlDistributionPoints=URI:http://g2.crl.${DOMAIN}/g2/$2.crl
authorityInfoAccess = OCSP;URI:http://g2.ocsp.${DOMAIN},caIssuers;URI:http://g2.crt.${DOMAIN}/g2/$2.crt
+
+certificatePolicies=@polsect
+
+[polsect]
+policyIdentifier = 1.3.6.1.4.1.18506.9.${CPSID}
+CPS.1="http://g2.cps.${DOMAIN}/g2/${KNAME}.cps"
+
TESTCA
caSign $1 $2 timesubca.cnf "$3" "$4"
rm timesubca.cnf