verify

   1 #!/bin/bash
   2 set -e
   3 [ "$1" == "" ] && echo "Usage: $0 <year>" && exit 1
   4 year=$1
   5
   6 . structure.bash
   7 cd generated
   8
   9 verify(){ # crt, [untrusted], additional
  10     untrusted="$2"
  11     [[ "$untrusted" != "" ]] && untrusted="-untrusted $untrusted"
  12     openssl verify $3 -CAfile root.ca/key.crt $untrusted "$1" || error "$1 did not verify"
  13     echo openssl verify $3 -CAfile root.ca/key.crt $untrusted "$1" || error "$1 did not verify"
  14 }
  15
  16 error() { # message
  17     echo $1
  18     exit -1
  19 }
  20
  21 verifyExtlist() { # ext
  22         EXTLIST=`echo "$1" | grep "X509v3\|Authority Information" | sed "s/^[ \t]*//"`
  23         BASIC=$2
  24         if [[ $BASIC == "" ]]; then
  25             BASIC="critical"
  26         else
  27             BASIC="critical, $BASIC"
  28         fi
  29         VAR="X509v3 extensions:
  30 X509v3 Basic Constraints: $BASIC
  31 X509v3 Key Usage: critical
  32 ${3}X509v3 Subject Key Identifier:
  33 X509v3 Authority Key Identifier:
  34 X509v3 CRL Distribution Points:
  35 Authority Information Access: "
  36
  37         diff <(echo "$EXTLIST") <(echo "$VAR") || error "Extensions order is wrong for $ca"
  38
  39 }
  40
  41 # Verify root
  42 verify root.ca/key.crt
  43 verifyExtlist "$(openssl x509 -in "root.ca/key.crt" -noout -text)"
  44
  45 # Verify level-1 structure
  46 for ca in $STRUCT_CAS; do
  47     verify $ca.ca/key.crt
  48     verifyExtlist "$(openssl x509 -in "$ca.ca/key.crt" -noout -text)"
  49 done
  50
  51 # Verify level-2 (time) structure
  52 for ca in ${STRUCT_CAS}; do
  53     for i in $TIME_IDX; do
  54         . ../CAs/$ca
  55         if [ "$ca" == "env" ]; then
  56             CA_FILE=$year/ca/${ca}_${year}_${i}.ca/key.crt
  57         else
  58             CA_FILE=$year/ca/${ca}_${year}_${i}.crt
  59         fi
  60         time=${points[${i}]}
  61         timestamp=$(date --date="${time:0:2}/${time:2:2}/${year} 03:00:00 UTC" +"%s")
  62         verify "$CA_FILE" "$ca.ca/key.crt" "-attime ${timestamp}"
  63         EXT=`openssl x509 -in "$CA_FILE" -noout -text`
  64
  65         verifyExtlist "$EXT"
  66
  67         echo "$EXT" | grep "Subject: " | grep "CN=$name" > /dev/null || error "Subject field did not verify"
  68
  69         echo "$EXT" | grep -A 2 "Basic Constraints" | grep "CA:TRUE" > /dev/null || error "Basic Constraints field is wrong for $ca"
  70         echo "$EXT" | grep -A 2 "Key Usage" | grep "^ *Certificate Sign, CRL Sign$" > /dev/null || error "KeyUsage field is wrong for $ca"
  71
  72         echo "$EXT" | grep -A 4 "CRL Distribution" | grep "g2.crl.${DOMAIN}/g2/$ca.crl" > /dev/null || error "CRL field is wrong for $ca"
  73         echo "$EXT" | grep "CA Issuers" | grep "/$ca.crt" | grep "g2.crt.${DOMAIN}/g2/" > /dev/null || error "CA Issuers field is wrong for $ca"
  74         echo "$EXT" | grep "OCSP" | grep "http://g2.ocsp.${DOMAIN}" > /dev/null || error "OCSP field is wrong for $ca"
  75     done
  76 done
  77
  78 # Verify infra keys
  79 cat env.ca/key.crt $year/ca/env_${year}_1.ca/key.crt > envChain.crt
  80
  81 for key in $SERVER_KEYS signer_client signer_server; do
  82     verify ${year}/keys/$key.crt envChain.crt
  83     verifyExtlist "$(openssl x509 -in "${year}/keys/$key.crt" -noout -text)" critical "X509v3 Extended Key Usage:
  84 "
  85 done
  86
  87 rm envChain.crt
  88