| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647 |
- #!/bin/bash
- #
- # Creates a trust collection certificate (ca.crt)
- # and self-signed server certificate (server.crt) and private key (server.pem)
- # and client certificate (client.crt) and key file (client.pem) for mutual TLS.
- # Replace "example.com" with the host name you'd like for your certificate.
- #
- # https://github.com/grpc/grpc-java/tree/master/examples
- #
- set -euo pipefail
- SIZE=2048
- # CA
- openssl genrsa -out ca.key $SIZE
- openssl req -new -x509 -days 365 -key ca.key -out ca.crt -subj "/CN=some-ca"
- # Other CA
- openssl genrsa -out other-ca.key $SIZE
- openssl req -new -x509 -days 365 -key other-ca.key -out other-ca.crt -subj "/CN=some-other-ca"
- # Server certs (localhost)
- openssl genrsa -out server-localhost.key $SIZE
- openssl req -new -key server-localhost.key -out server-localhost.csr -subj "/CN=localhost"
- openssl x509 -req -days 365 -in server-localhost.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server-localhost.crt
- openssl x509 -req -days 365 -in server-localhost.csr -CA other-ca.crt -CAkey other-ca.key -set_serial 01 -out server-localhost-other-ca.crt
- # Server certs (example.com)
- openssl genrsa -out server-example.com.key $SIZE
- openssl req -new -key server-example.com.key -out server-example.com.csr -subj "/CN=example.com"
- openssl x509 -req -days 365 -in server-example.com.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server-example.com.crt
- # Client certs (localhost)
- openssl genrsa -out client.key $SIZE
- openssl req -new -key client.key -out client.csr -subj "/CN=localhost"
- openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt
- openssl x509 -req -days 365 -in client.csr -CA other-ca.crt -CAkey other-ca.key -set_serial 01 -out client-other-ca.crt
- # netty only supports PKCS8 keys. openssl is used to convert from PKCS1 to PKCS8
- # http://netty.io/wiki/sslcontextbuilder-and-private-key.html
- openssl pkcs8 -topk8 -nocrypt -in client.key -out client.pem
- openssl pkcs8 -topk8 -nocrypt -in server-example.com.key -out server.pem
- # Server cert with explicit EC parameters (not supported)
- openssl ecparam -name prime256v1 -genkey -param_enc explicit -out server-explicit-ec.key
- openssl req -new -x509 -days 365 -key server-explicit-ec.key -out server-explicit-ec.crt -subj "/CN=example.com"
|
