mirror of
https://github.com/moparisthebest/curl
synced 2024-12-23 08:38:49 -05:00
moparisthebest
93e450793c
Option --pinnedpubkey takes a path to a public key in DER format and only connect if it matches (currently only implemented with OpenSSL). Provides CURLOPT_PINNEDPUBLICKEY for curl_easy_setopt(). Extract a public RSA key from a website like so: openssl s_client -connect google.com:443 2>&1 < /dev/null | \ sed -n '/-----BEGIN/,/-----END/p' | openssl x509 -noout -pubkey \ | openssl rsa -pubin -outform DER > google.com.der
116 lines
3.4 KiB
Bash
Executable File
116 lines
3.4 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# (c) CopyRight EdelWeb for EdelKey and OpenEvidence, 2000-2004, 2009
|
|
# Author: Peter Sylvester
|
|
|
|
# "libre" for integration with curl
|
|
|
|
OPENSSL=openssl
|
|
if [ -f /usr/local/ssl/bin/openssl ] ; then
|
|
OPENSSL=/usr/local/ssl/bin/openssl
|
|
fi
|
|
|
|
USAGE="echo Usage is genserv.sh <prefix> <caprefix>"
|
|
|
|
HOME=`pwd`
|
|
cd $HOME
|
|
|
|
KEYSIZE=1024
|
|
DURATION=3000
|
|
|
|
REQ=YES
|
|
P12=NO
|
|
DHP=NO
|
|
|
|
PREFIX=$1
|
|
if [ ".$PREFIX" = . ] ; then
|
|
echo No configuration prefix
|
|
NOTOK=1
|
|
else
|
|
if [ ! -f $PREFIX-sv.prm ] ; then
|
|
echo No configuration file $PREFIX-sv.prm
|
|
NOTOK=1
|
|
fi
|
|
fi
|
|
|
|
CAPREFIX=$2
|
|
if [ ".$CAPREFIX" = . ] ; then
|
|
echo No CA prefix
|
|
NOTOK=1
|
|
else
|
|
if [ ! -f $CAPREFIX-ca.cacert ] ; then
|
|
echo No CA certficate file $CAPREFIX-ca.caert
|
|
NOTOK=1
|
|
fi
|
|
if [ ! -f $CAPREFIX-ca.key ] ; then
|
|
echo No $CAPREFIX key
|
|
NOTOK=1
|
|
fi
|
|
fi
|
|
|
|
if [ ".$NOTOK" != . ] ; then
|
|
echo "Sorry, I can't do that for you."
|
|
$USAGE
|
|
exit
|
|
fi
|
|
|
|
if [ ".$SERIAL" = . ] ; then
|
|
GETSERIAL="\$t = time ;\$d = \$t . substr(\$t+$$ ,-4,4)-1;print \$d"
|
|
SERIAL=`/usr/bin/env perl -e "$GETSERIAL"`
|
|
fi
|
|
|
|
echo SERIAL=$SERIAL PREFIX=$PREFIX CAPREFIX=$CAPREFIX DURATION=$DURATION KEYSIZE=$KEYSIZE
|
|
|
|
if [ "$DHP." = YES. ] ; then
|
|
echo "openssl dhparam -2 -out $PREFIX-sv.dhp $KEYSIZE"
|
|
$OPENSSL dhparam -2 -out $PREFIX-sv.dhp $KEYSIZE
|
|
fi
|
|
|
|
if [ "$REQ." = YES. ] ; then
|
|
echo "openssl req -config $PREFIX-sv.prm -newkey rsa:$KEYSIZE -keyout $PREFIX-sv.key -out $PREFIX-sv.csr -passout XXX"
|
|
$OPENSSL req -config $PREFIX-sv.prm -newkey rsa:$KEYSIZE -keyout $PREFIX-sv.key -out $PREFIX-sv.csr -passout pass:secret
|
|
fi
|
|
|
|
echo "openssl rsa -in $PREFIX-sv.key -out $PREFIX-sv.key"
|
|
$OPENSSL rsa -in $PREFIX-sv.key -out $PREFIX-sv.key -passin pass:secret
|
|
echo pseudo secrets generated
|
|
|
|
echo "openssl rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der"
|
|
$OPENSSL rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der
|
|
|
|
echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -out $PREFIX-sv.crt -text -nameopt multiline -sha1"
|
|
|
|
$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -out $PREFIX-sv.crt -text -nameopt multiline -sha1
|
|
|
|
if [ "$P12." = YES. ] ; then
|
|
|
|
echo "$OPENSSL pkcs12 -export -des3 -out $PREFIX-sv.p12 -caname $CAPREFIX -name $PREFIX -inkey $PREFIX-sv.key -in $PREFIX-sv.crt -certfile $CAPREFIX-ca.crt "
|
|
|
|
$OPENSSL pkcs12 -export -des3 -out $PREFIX-sv.p12 -caname $CAPREFIX -name $PREFIX -inkey $PREFIX-sv.key -in $PREFIX-sv.crt -certfile $CAPREFIX-ca.crt
|
|
fi
|
|
|
|
echo "openssl x509 -noout -text -hash -in $PREFIX-sv.selfcert -nameopt multiline"
|
|
$OPENSSL x509 -noout -text -hash -in $PREFIX-sv.crt -nameopt multiline
|
|
|
|
# revoke server cert
|
|
touch $CAPREFIX-ca.db
|
|
echo 01 > $CAPREFIX-ca.cnt
|
|
echo "openssl ca -config $CAPREFIX-ca.cnf -revoke $PREFIX-sv.crt"
|
|
$OPENSSL ca -config $CAPREFIX-ca.cnf -revoke $PREFIX-sv.crt
|
|
|
|
# issue CRL
|
|
echo "openssl ca -config $CAPREFIX-ca.cnf -gencrl -out $PREFIX-sv.crl"
|
|
$OPENSSL ca -config $CAPREFIX-ca.cnf -gencrl -out $PREFIX-sv.crl
|
|
|
|
echo "openssl x509 -in $PREFIX-sv.crt -outform der -out $PREFIX-sv.der "
|
|
$OPENSSL x509 -in $PREFIX-sv.crt -outform der -out $PREFIX-sv.der
|
|
|
|
# all together now
|
|
touch $PREFIX-sv.dhp
|
|
cat $PREFIX-sv.prm $PREFIX-sv.key $PREFIX-sv.crt $PREFIX-sv.dhp >$PREFIX-sv.pem
|
|
chmod o-r $PREFIX-sv.prm
|
|
|
|
echo "$PREFIX-sv.pem done"
|
|
|
|
|