Add the service-to-service module

service-to-service/scripts/certs.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Generate a throwaway CA, a server certificate for the downstream service, and two client
+# certificates - one signed by that CA and one signed by a different CA. Into target/, so
+# nothing here is committed and nothing here should ever be trusted.
+#
+#   ./scripts/certs.sh
+set -eu
+cd "$(dirname "$0")/.."
+D=target/certs
+rm -rf "$D" && mkdir -p "$D"
+cd "$D"
+
+gen_ca() {   # gen_ca <name> <cn>
+  openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
+    -keyout "$1-ca.key" -out "$1-ca.crt" -subj "/CN=$2" 2>/dev/null
+}
+
+sign() {     # sign <ca> <name> <subject> [extfile-content]
+  openssl req -newkey rsa:2048 -nodes -keyout "$2.key" -out "$2.csr" -subj "$3" 2>/dev/null
+  if [ -n "${4:-}" ]; then printf '%s\n' "$4" > "$2.ext"; else : > "$2.ext"; fi
+  openssl x509 -req -in "$2.csr" -CA "$1-ca.crt" -CAkey "$1-ca.key" -CAcreateserial \
+    -out "$2.crt" -days 3650 -extfile "$2.ext" 2>/dev/null
+}
+
+gen_ca internal "Internal Mesh CA"
+gen_ca other    "Some Other CA"
+
+sign internal server "/CN=localhost" "subjectAltName=DNS:localhost,IP:127.0.0.1"
+sign internal edge   "/CN=edge-service/OU=payments"
+sign other    rogue  "/CN=edge-service/OU=payments"
+
+echo "wrote:"
+ls -1 *.crt *.key | sed 's/^/  target\/certs\//'
+echo
+echo "Note that rogue.crt carries the SAME subject as edge.crt. Identity in mTLS is not the"
+echo "subject; it is the subject plus the fact that a trusted CA vouched for it."