37 lines
1.4 KiB
Bash
Executable File
37 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Generate a throwaway CA, a server certificate for the downstream service, and two client
|
|
# certificates - one signed by that CA and one signed by a different CA. Into target/, so
|
|
# nothing here is committed and nothing here should ever be trusted.
|
|
#
|
|
# ./scripts/certs.sh
|
|
set -eu
|
|
cd "$(dirname "$0")/.."
|
|
D=target/certs
|
|
rm -rf "$D" && mkdir -p "$D"
|
|
cd "$D"
|
|
|
|
gen_ca() { # gen_ca <name> <cn>
|
|
openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
|
|
-keyout "$1-ca.key" -out "$1-ca.crt" -subj "/CN=$2" 2>/dev/null
|
|
}
|
|
|
|
sign() { # sign <ca> <name> <subject> [extfile-content]
|
|
openssl req -newkey rsa:2048 -nodes -keyout "$2.key" -out "$2.csr" -subj "$3" 2>/dev/null
|
|
if [ -n "${4:-}" ]; then printf '%s\n' "$4" > "$2.ext"; else : > "$2.ext"; fi
|
|
openssl x509 -req -in "$2.csr" -CA "$1-ca.crt" -CAkey "$1-ca.key" -CAcreateserial \
|
|
-out "$2.crt" -days 3650 -extfile "$2.ext" 2>/dev/null
|
|
}
|
|
|
|
gen_ca internal "Internal Mesh CA"
|
|
gen_ca other "Some Other CA"
|
|
|
|
sign internal server "/CN=localhost" "subjectAltName=DNS:localhost,IP:127.0.0.1"
|
|
sign internal edge "/CN=edge-service/OU=payments"
|
|
sign other rogue "/CN=edge-service/OU=payments"
|
|
|
|
echo "wrote:"
|
|
ls -1 *.crt *.key | sed 's/^/ target\/certs\//'
|
|
echo
|
|
echo "Note that rogue.crt carries the SAME subject as edge.crt. Identity in mTLS is not the"
|
|
echo "subject; it is the subject plus the fact that a trusted CA vouched for it."
|