marking extensions critical, adding CPS-identifiers, adding Country

[nre.git] / generateKeys.sh

diff --git a/generateKeys.sh b/generateKeys.sh
index 353acb15773b3dc47c336b7a2adc9ec154e42174..d032a7b6aa832a6810acf28d41bda1af02cdfd9e 100755 (executable)
--- a/generateKeys.sh
+++ b/generateKeys.sh
@@ -5,27 +5,48 @@ set -e
 . structure
 . commonFunctions
 
+mkdir -p generated
+cd generated
 
 ####### create various extensions files for the various certificate types ######
 cat <<TESTCA > ca.cnf
-basicConstraints = CA:true
-subjectKeyIdentifier = hash
-keyUsage = keyCertSign, cRLSign
-crlDistributionPoints=URI:http://g2.crl.cacert.org/g2/root.crl
-authorityInfoAccess = OCSP;URI:http://g2.ocsp.cacert.org,caIssuers;URI:http://g2.crt.cacert.org/root.crt
-TESTCA
+basicConstraints = critical,CA:true
+keyUsage =critical, keyCertSign, cRLSign
 
-cat <<TESTCA > subca.cnf
-basicConstraints = CA:true
 subjectKeyIdentifier = hash
-keyUsage = keyCertSign, cRLSign
-crlDistributionPoints=URI:http://g2.crl.cacert.org/g2/root.crl
-authorityInfoAccess = OCSP;URI:http://g2.ocsp.cacert.org,caIssuers;URI:http://g2.crt.cacert.org/root.crt
+authorityKeyIdentifier = keyid:always
+
+crlDistributionPoints=URI:http://g2.crl.${DOMAIN}/g2/root.crl
+authorityInfoAccess = OCSP;URI:http://g2.ocsp.${DOMAIN},caIssuers;URI:http://g2.crt.${DOMAIN}/g2/root.crt
 TESTCA
 
 
 rootSign(){ # csr
-    caSign "$1.ca/key" root subca.cnf
+    POLICY=ca.cnf
+    if [[ "$1" != "root" ]] ; then
+       KNAME=$1
+       POLICY=subca.cnf
+       . ../CAs/${KNAME}
+       cat <<TESTCA > subca.cnf
+
+basicConstraints =critical, CA:true
+keyUsage =critical, keyCertSign, cRLSign
+
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always
+
+crlDistributionPoints=URI:http://g2.crl.${DOMAIN}/g2/root.crl
+authorityInfoAccess = OCSP;URI:http://g2.ocsp.${DOMAIN},caIssuers;URI:http://g2.crt.${DOMAIN}/g2/root.crt
+
+certificatePolicies=@polsect
+
+[polsect]
+policyIdentifier = 1.3.6.1.4.1.18506.9.${CPSID}
+CPS.1="http://g2.cps.${DOMAIN}/g2/${KNAME}.cps"
+
+TESTCA
+    fi
+    caSign "$1.ca/key" root $POLICY
 }
 
 
@@ -36,7 +57,7 @@ rootSign root
 
 # generate the various sub-CAs
 for ca in $STRUCT_CAS; do
-    . CAs/$ca
+    . ../CAs/$ca
     genca "/CN=$name" $ca
     rootSign $ca
 done