combine conf files, cleanup scripts, namespaces, simplify, more test certs, bad certs...

diff --git a/bin/generate-ca-certificates-for-cvs.sh b/bin/generate-ca-certificates-for-cvs.sh
index bbbb58d..aebb19e 100755 (executable)
--- a/bin/generate-ca-certificates-for-cvs.sh
+++ b/bin/generate-ca-certificates-for-cvs.sh
@@ -16,18 +16,12 @@
 CONFIGDIR=$PWD/$(dirname $0)/../config
 BASEDIR=$PWD/$(dirname $0)/../test
 CONFIGFILES="index.txt serial.txt req_conf.cnf"
-export PASSWORD='changeit'
-CATYPES='trusted fake big expired bad nokeyusage root subca subsubca'
+PASSWORD='changeit'
+CATYPES='trusted fake big expired nokeyusage root subca subsubca'
 BIG_BITS=8192
 SMALL_BITS=1024
 
-## dummy values for unused env variables in conf file
-export PROXYNAME=dummyprox
-export CA_DIR=dummyCAdir
-export CATYPE_dummyCAtype
-
 function create_ca {
-    export CATYPE=$1
     catype=$1
     echo "+-----------------------"
     echo "| $catype"
@@ -41,9 +35,9 @@ function create_ca {
         done
 
         if [ "$catype" = "big" ]; then
-            export BITS=$BIG_BITS
+            BITS=$BIG_BITS
         else
-            export BITS=$SMALL_BITS
+            BITS=$SMALL_BITS
         fi
 
         if [ "$catype" = "expired" ]; then
@@ -54,28 +48,32 @@ function create_ca {
 
         export CN="the $catype CA"
        if [ "$catype" = "subca" ]; then
-           export CA_DIR=../root-ca
-           export CATYPE=root
-           openssl req -new -out ${catype}.req $DAYS -nodes \
-               -keyout ${catype}.priv -config req_conf.cnf
-           openssl ca -in ${catype}.req -out ${catype}.cert -outdir . \
-                         -md md5 -config req_conf.cnf -batch -extensions ca_cert_req -days 10000
+           generate_ca_cert "$catype" root "${DAYS}" false $BITS
        else
            if [ "$catype" = "subsubca" ]; then
-               export CA_DIR=../subca-ca
-               export CATYPE=subca
-               openssl req -new -out ${catype}.req $DAYS -nodes \
-                   -keyout ${catype}.priv -config req_conf.cnf
-               openssl ca -in ${catype}.req -out ${catype}.cert -outdir . \
-                   -md md5 -config req_conf.cnf -batch -extensions ca_cert_req -days 10000
+               generate_ca_cert "$catype" subca "${DAYS}" false $BITS
 
            else
-               openssl req -new -x509 -out ${catype}.cert $DAYS -nodes \
-                   -keyout ${catype}.priv -config req_conf.cnf -extensions ca_cert_req
-               openssl pkcs12 -export -in ${catype}.cert -inkey ${catype}.priv \
-                   -out ${catype}.p12 -passin "pass:$PASSWORD" -passout "pass:$PASSWORD"
+               generate_ca_cert "$catype" $catype "${DAYS}" true $BITS
            fi
        fi
+
+    # generating a signing_policy file
+    subject_name=`openssl x509 -in ${catype}.cert -subject -noout| sed 's/^subject= //'`
+    cat <<EOF > ${catype}.signing_policy
+# Signing policy file for the $subject_name"
+access_id_CA            X509    '${subject_name}'
+pos_rights              globus  CA:sign
+cond_subjects           globus  '"$(echo "${subject_name}" | sed -e 's#/CN=.*$##')/*"'
+EOF
+
+    cat <<EOF > ${catype}.namespaces
+# Namespace for the $subject_name"
+TO Issuer "${subject_name}" \
+  PERMIT Subject "$(echo "${subject_name}" | sed -e 's#/CN=.*$##')/*"
+ 
+EOF
+
         echo -n "Generated CA certificate with "
         openssl x509 -noout -subject -in ${catype}.cert
     else
@@ -83,6 +81,51 @@ function create_ca {
     fi
 }
 
+function generate_ca_cert {
+    catype=$1         # current CA to generate
+    export CATYPE=$2  # parent CA if applicable
+    DAYS=$3           # days flag
+    selfsign=$4       # whether to generate self signed CA or hierarchical
+    bits=$5           # number of bits for the CA cert
+    export CASROOT=../
+    
+
+    echo `pwd`
+
+    dn="/C=UG/L=Tropic/O=Utopia/OU=Relaxation/CN=the ${catype} CA"
+
+    echo $dn
+
+    if [ x$selfsign == "xfalse" ]; then
+       openssl req -new -out ${catype}.req ${DAYS} -nodes -keyout ${catype}.priv \
+           -config req_conf.cnf -newkey rsa:$bits -subj "$dn"
+       if [ $? -ne "0" ]; then
+           echo CA certificate request generation failed!
+           exit 1
+       fi
+       openssl ca -in ${catype}.req -out ${catype}.cert -outdir . \
+           -md md5 -config req_conf.cnf -batch -extensions ca_cert_req ${DAYS}
+       if [ $? -ne "0" ]; then
+           echo CA certificate signing failed!
+           exit 1
+       fi
+    else
+       openssl req -new -x509 -out ${catype}.cert $DAYS -nodes \
+           -keyout ${catype}.priv -config req_conf.cnf -newkey rsa:$bits -extensions ca_cert_req -subj "${dn}"
+       if [ $? -ne "0" ]; then
+           echo CA certificate generation failed!
+           exit 1
+       fi
+    fi
+
+    openssl pkcs12 -export -in ${catype}.cert -inkey ${catype}.priv \
+       -out ${catype}.p12 -passin "pass:$PASSWORD" -passout "pass:$PASSWORD"
+    if [ $? -ne "0" ]; then
+       echo CA certificate packing into pkcs12 keystore failed!
+       exit 1
+    fi
+}
+
 ############################## main ################################
 
 if [ "$1" != "--i-know-what-i-am-doing" ]; then

diff --git a/bin/generate-test-certificates.sh b/bin/generate-test-certificates.sh
index 7eae449..09ce658 100755 (executable)
--- a/bin/generate-test-certificates.sh
+++ b/bin/generate-test-certificates.sh
@@ -24,12 +24,12 @@ function create_p12 {
 
 function create_cert {
     filebase=$1
-    ##export CN="$VERSION "$2
-    export CN=$2
     flags=$3
     validity=$4
     bits=${5:-1024}
 
+    dn="/C=UG/L=Tropic/O=Utopia/OU=Relaxation/CN=$2"
+
     echo "Creating a cert for '$CN' in files named $filebase.(cert|priv)"
     echo "                with $flags flags and $validity days validity time"
 
@@ -39,58 +39,86 @@ function create_cert {
         return 
     fi
 
-    if [ $flags == "bigclient" ]; then
-        flags="client"
-    fi
+    castring=""
 
     # if we are in a state where we are generating proxies (${CA_DIR}/serial_proxy.txt exists)
     # then let's transfer the serial number of the last proxy to the serial.txt file for the 
     # next new certificate...
-
+    CMD="openssl req -out $filebase.req -newkey rsa:$bits -new -keyout $filebase.priv -config $REQ_CONFIG_FILE -subj \"$dn\" -passout pass:$PASSWORD"
 
     case $flags in
         clientserial)
            echo serial cert $flags
            flags="client"
-           CMD="openssl req -out $filebase.req -newkey rsa:$bits -new -keyout $filebase.priv -config $REQ_CONFIG_FILE_SERIAL"
-           echo $CMD; $CMD;
+           CMD="$CMD -subj \"$dn/serialNumber=12341\""
             ;;
         clientemail)
            echo email cert $flags
            flags="client"
-           CMD="openssl req -out $filebase.req -newkey rsa:$bits -new -keyout $filebase.priv -config $REQ_CONFIG_FILE_EMAIL"
-           echo $CMD; $CMD;
+           CMD="$CMD -subj \"$dn/emailAddress=john.doe@foo.bar\""
             ;;
         clientuid)
            echo UID cert $flags
            flags="client"
-           CMD="openssl req -out $filebase.req -newkey rsa:$bits -new -keyout $filebase.priv -config $REQ_CONFIG_FILE_UID"
-           echo $CMD; $CMD;
+           CMD="$CMD -subj \"$dn/UID=haahaa\""
             ;;
+       clientbaddn)
+           echo bad DN cert $flags
+           flags="client"
+           CMD="$CMD -subj \"`echo $dn | sed 's/Relaxation/Chilling/'`\""
+           ;;
+       hostbaddn)
+           echo bad DN cert $flags
+           flags="server"
+           CMD="$CMD -subj \"`echo $dn | sed 's/Relaxation/Chilling/'`\""
+           ;;
+       clientfuture)
+           echo bad DN cert $flags
+           flags="client"
+           CMD="$CMD "
+           castring=" -startdate 350101000000Z"
+           ;;
         *)
            echo normal cert $flags
-           CMD="openssl req -out $filebase.req -newkey rsa:$bits -new -keyout $filebase.priv -config $REQ_CONFIG_FILE"
-           echo $CMD; $CMD;
+           CMD="$CMD -subj \"$dn\""
     esac
+    
+    echo $CMD;eval $CMD;
+    if [ $? != 0 ]; then
+       echo Certification request generation failed!
+       exit 1
+    fi
 
     case $flags in
         client|server|clientserver|fclient|none|altname)
             echo "Generating a $flags certificate"
             echo $CA_DIR
+           echo PDW=`pwd`
             CMD="openssl ca -in $filebase.req -out $filebase.cert -outdir $tmpdir \
-                         -md md5 -config $CA_CONF -batch -extensions ca_$flags -days $validity"
-            echo $CMD; $CMD
+                         -md md5 -config $REQ_CONFIG_FILE -batch -preserveDN -extensions ca_$flags -passin pass:$PASSWORD -days $validity $castring"
             ;;
         *)
             echo "Unknown flags: $flags"
             echo "No certificate is generated."
+           exit 1
     esac
 
+    # save the index and serial for the possible proxy to be generated next
+    echo save the index and serial
+    cp $CA_DIR/index.txt $CA_DIR/index_proxy.txt
+    cp $CA_DIR/serial.txt $CA_DIR/serial_proxy.txt
+
+    echo $CMD; eval $CMD
+    if [ $? != 0 ]; then
+       echo Certificate signing failed!
+       exit 1
+    fi
+
     # Get the serial number of the certificate that will eventually sign the proxy.
     # Put it into a temporary file to be read by the ca command later.
 
-        SERIAL=$(openssl x509 -in ${filebase}.cert -noout -serial | sed 's/^serial=//')
-        echo ${SERIAL} > ${CA_DIR}/serial_proxy.txt
+#        SERIAL=$(openssl x509 -in ${filebase}.cert -noout -serial | sed 's/^serial=//')
+#        echo ${SERIAL} > ${CA_DIR}/serial_proxy.txt
         # cat ${CA_DIR}/serial_proxy.txt
 
     # some minor cleanup
@@ -104,16 +132,9 @@ function create_cert_proxy {
     echo "create_cert_proxy Start"
 
     filebase=$1
-    export FILEBASE=${filebase}
-    export CN=$2
     ident=$3
-    export PROXYNAME=$4
     validity=$5
 
-
-#   create_cert_proxy $CERT_DIR/${catype}_client "$catype client" proxy "proxy" 1
-#   create_cert_proxy $CERT_DIR/${catype}_client "$catype client" proxy_exp "expired proxy" -1
-
     ending="grid_proxy"
 
     # This really depends on if we make a proxy or a proxy-proxy
@@ -124,6 +145,8 @@ function create_cert_proxy {
     X509_PROX_KEY=${filebase}.${ident}.priv
     X509_PROX_REQ=${filebase}.${ident}.req
     X509_PROX_GRID=${filebase}.${ident}.${ending}
+
+    dn="`openssl x509 -in ${X509_SIGNING_CERT} -subject -noout| sed 's/^subject= //'`/CN=$4"
  
     echo "Creating a proxy cert ${X509_PROX_CERT} for '$CN/CN=$PROXYNAME'"
     echo "         in files named $filebase.(cert|priv)"
@@ -138,49 +161,89 @@ function create_cert_proxy {
 
     # Have to 'edit' the ca database to remove the entry for the signing certificate.
     # maybe no need... make a dummy database, touch and then delete afterwards...
-    touch ${CA_DIR}/index_proxy.txt
+#    touch ${CA_DIR}/index_proxy.txt
 
+    # instead save the ones for real certs and copy the ones saved before and use them and later switch back
+    cp ${CA_DIR}/index.txt ${CA_DIR}/index_cert_save.txt
+    cp ${CA_DIR}/serial.txt ${CA_DIR}/serial_cert_save.txt
+    cp ${CA_DIR}/index_proxy.txt ${CA_DIR}/index.txt 
+    cp ${CA_DIR}/serial_proxy.txt ${CA_DIR}/serial.txt 
+    
     CMD="openssl genrsa -f4 -out ${X509_PROX_KEY} ${PROXY_BITS}; chmod 400 ${filebase}.proxy.priv"
     echo $CMD; $CMD
+    if [ $? != 0 ]; then
+       echo Private key generation for proxy failed!
+       exit 1
+    fi
 
     # Create the certificate request.
     CMD="openssl req -new -out ${X509_PROX_REQ} \
                  -key ${X509_PROX_KEY} \
-                 -config ${REQ_PROXY_CONFIG_FILE}"
-    echo $CMD; $CMD
+                 -config ${REQ_CONFIG_FILE} -subj \"$dn\""
+    echo $CMD; eval $CMD
+
+    if [ $? != 0 ]; then
+       echo Certificate generation for proxy failed!
+       exit 1
+    fi
 
     # Sign the cert request with the user cert and key. Set the serial number here!
 
-    CMD="openssl ca -in ${X509_PROX_REQ} \
+    CMD="openssl ca -verbose -in ${X509_PROX_REQ} \
                     -cert ${X509_SIGNING_CERT} \
                     -keyfile ${X509_SIGNING_KEY} \
                     -out ${X509_PROX_CERT} \
                     -outdir $tmpdir \
-                    -config ${CA_PROXY_CONF} -md md5 -days ${validity} -batch \
-                    -passin pass:${PASSWORD} -notext \
-                    -extensions proxy_none "
+                    -preserveDN \
+                    -config ${REQ_CONFIG_FILE} -md md5 -days ${validity} -batch \
+                    -passin pass:${PASSWORD} -notext"
     echo $CMD; $CMD
 
+    if [ $? != 0 ]; then
+       echo Proxy certificate signing failed!
+       exit 1
+    fi
+
     # Add the user and proxy certs and the proxy private key to the keystore
-    openssl pkcs12 -in ${X509_PROX_CERT} \
+    CMD="openssl pkcs12 -in ${X509_PROX_CERT} \
                    -out ${filebase}.proxy.p12 -export \
                    -inkey ${X509_PROX_KEY} \
                    -passin pass:${PASSWORD} -passout pass:${PASSWORD} \
-                   -name "${catype} proxy certificate" -certfile ${filebase}.cert
+                   -name \"${catype} proxy certificate\" -certfile ${filebase}.cert"
+
+    echo $CMD; eval $CMD
 
     # Create a grid proxy file... 
     # Copy the proxy cert to the grid proxy file.
     cp ${X509_PROX_CERT} ${X509_PROX_GRID}
     
+    if [ $? != 0 ]; then
+       echo Proxy file generation failed!
+       exit 1
+    fi
+
     # Now add the proxy private key to the grid proxy file.
     openssl rsa -in ${X509_PROX_KEY} -passin pass:${PASSWORD} >> ${X509_PROX_GRID}
     
+    if [ $? != 0 ]; then
+       echo Proxy file generation failed!
+       exit 1
+    fi
+
     # Now add the original certificate used to sign the request to the proxy file.
     # This should be the certificate issued by the CA to the 'user'.
     openssl x509 -in ${X509_SIGNING_CERT} >> ${X509_PROX_GRID}
+
+    if [ $? != 0 ]; then
+       echo Proxy file generation failed!
+       exit 1
+    fi
+
     chmod 600 ${X509_PROX_GRID}
 
-    cp ${CA_DIR}/serial_proxy.txt ${CA_DIR}/serial.txt
+    # copy the normal cert files back
+    cp ${CA_DIR}/index_cert_save.txt ${CA_DIR}/index.txt
+    cp ${CA_DIR}/serial_cert_save.txt ${CA_DIR}/serial.txt
 
     # Clean up stuff
     # rm ${CA_DIR}/serial_proxy.txt ${CA_DIR}/index_proxy.txt
@@ -196,8 +259,6 @@ function create_cert_proxy_proxy {
     export FILEBASE=${filebase}
     export CN=$2
     ident=$3
-    export PROXYNAME=$4
-    export PROXYPROXYNAME=$4
     validity=$5
     signing_pair=$6
  
@@ -214,10 +275,12 @@ function create_cert_proxy_proxy {
     X509_PROX_REQ=${filebase}.${ident}.proxy.req
     X509_PROX_GRID=${filebase}.${ident}.${ending}
 
+    dn="`openssl x509 -in ${X509_SIGNING_CERT} -subject -noout| sed 's/^subject= //'`/CN=$4"
+
     if [ -r "${X509_PROX_CERT}" ]; then
         echo "There already exists a file named ${X509_PROX_CERT}"
         echo "file. Proxy-proxy certificate is not generated for '$CN'"
-        return 
+        return 0
     fi
 
     # Get the serial number of the certificate that will eventually sign the proxy.
@@ -227,16 +290,31 @@ function create_cert_proxy_proxy {
 
     # Have to 'edit' the ca database to remove the entry for the signing certificate.
     # maybe no need... make a dummy database, touch and then delete afterwards...
-    touch ${CA_DIR}/index_proxy.txt
+    #touch ${CA_DIR}/index_proxy.txt
 
+    # instead save the ones for real certs and copy the ones saved before and use them and later switch back
+    cp ${CA_DIR}/index.txt ${CA_DIR}/index_cert_save.txt
+    cp ${CA_DIR}/serial.txt ${CA_DIR}/serial_cert_save.txt
+    cp ${CA_DIR}/index_proxy.txt ${CA_DIR}/index.txt 
+    cp ${CA_DIR}/serial_proxy.txt ${CA_DIR}/serial.txt 
+    
     CMD="openssl genrsa -f4 -out ${X509_PROX_KEY} ${PROXY_BITS}; chmod 400 ${X509_PROX_KEY}"
     echo $CMD; $CMD
+    if [ $? != 0 ]; then
+       echo Private key generation for proxy failed!
+       exit 1
+    fi
 
     # Create the certificate request.
     CMD="openssl req -new -out ${X509_PROX_REQ} \
                  -key ${X509_PROX_KEY} \
-                 -config ${REQ_PROXY_PROXY_CONFIG_FILE}"
-    echo $CMD; $CMD
+                 -config ${REQ_CONFIG_FILE} -subj \"$dn\""
+    echo $CMD; eval $CMD
+
+    if [ $? != 0 ]; then
+       echo Certificate generation for proxy failed!
+       exit 1
+    fi
 
     # Sign the cert request with the user cert and key. Set the serial number here!
 
@@ -245,25 +323,42 @@ function create_cert_proxy_proxy {
                     -keyfile ${X509_SIGNING_KEY} \
                     -out ${X509_PROX_CERT} \
                     -outdir $tmpdir \
-                    -config ${CA_PROXY_CONF} -md md5 -days ${validity} -batch \
-                    -passin pass:${PASSWORD} -notext \
-                    -extensions proxy_none "
+                    -preserveDN \
+                    -config ${REQ_CONFIG_FILE} -md md5 -days ${validity} -batch \
+                    -passin pass:${PASSWORD} -notext"
     echo $CMD; $CMD
 
+    if [ $? != 0 ]; then
+       echo Proxy certificate signing failed!
+       exit 1
+    fi
+
     # Add the user and proxy certs and the proxy private key to the keystore
-    openssl pkcs12 -in ${X509_PROX_CERT} \
+    CMD="openssl pkcs12 -in ${X509_PROX_CERT} \
                    -out ${filebase}.proxy.proxy.p12 -export \
                    -inkey ${X509_PROX_KEY} \
                    -passin pass:${PASSWORD} -passout pass:${PASSWORD} \
-                   -name "${catype} proxy certificate" -certfile ${X509_SIGNING_CERT}
+                   -name \"${catype} proxy certificate\" -certfile ${X509_SIGNING_CERT}"
+
+    echo $CMD; eval $CMD
 
     # Create a grid proxy file... 
     # Copy the proxy cert to the grid proxy file.
     cp ${X509_PROX_CERT} ${X509_PROX_GRID}
     
+    if [ $? != 0 ]; then
+       echo Proxy file generation failed!
+       exit 1
+    fi
+
     # Now add the proxy private key to the grid proxy file.
     openssl rsa -in ${X509_PROX_KEY} -passin pass:${PASSWORD} >> ${X509_PROX_GRID}
     
+    if [ $? != 0 ]; then
+       echo Proxy file generation failed!
+       exit 1
+    fi
+
     # Now add the original certificate used to sign the request to the proxy file.
     # In this case it is the proxy certificate!
     openssl x509 -in ${X509_SIGNING_CERT} >> ${X509_PROX_GRID}
@@ -271,9 +366,17 @@ function create_cert_proxy_proxy {
     # adding in the original certificate to the chain. 03/06/05
     openssl x509 -in ${filebase}.cert >> ${X509_PROX_GRID}
 
+    if [ $? != 0 ]; then
+       echo Proxy file generation failed!
+       exit 1
+    fi
+
     chmod 600 ${X509_PROX_GRID}
 
-    cp ${CA_DIR}/serial_proxy.txt ${CA_DIR}/serial.txt
+#    cp ${CA_DIR}/serial_proxy.txt ${CA_DIR}/serial.txt
+    # copy the normal cert files back
+    cp ${CA_DIR}/index_cert_save.txt ${CA_DIR}/index.txt
+    cp ${CA_DIR}/serial_cert_save.txt ${CA_DIR}/serial.txt
 
     # Clean up stuff
     # rm ${CA_DIR}/serial_proxy.txt ${CA_DIR}/index_proxy.txt \
@@ -363,7 +466,7 @@ function create_some {
     create_cert $CERT_DIR/${catype}_host "$HOSTNAME" server $DAYS
 
     # generating CRL
-    openssl ca -gencrl -crldays 10000 -out $CA_DIR/${catype}.crl -config $CA_CONF
+    openssl ca -gencrl -crldays 10000 -out $CA_DIR/${catype}.crl -config $REQ_CONFIG_FILE
 
     # make it user friendly
     if [ ! -d 'grid-security/certificates' ]; then
@@ -442,66 +545,19 @@ EOF
 
 function create_bad {
 
-    # generating client certificate
-    create_cert $CERT_DIR/${catype}_client00 "$LOGNAME" client $DAYS
-
-    # create cert with mismatched signing_policy
-    export CN="bad policy client"
-    CMD="openssl req -out $CERT_DIR/bad_policy.req -newkey rsa:$bits -new -keyout $CERT_DIR/bad_policy.priv -config $CA_DIR/req_conf_policy.cnf"
-    echo $CMD; $CMD
-    CMD="openssl ca -in $CERT_DIR/bad_policy.req -out $CERT_DIR/bad_policy.cert -outdir $tmpdir -md md5 -config $CA_CONF -batch -days $DAYS"
-    echo $CMD; $CMD
-
-    # create a cert which is not vaild yet
-    export CN="bad future client"
-    theyear=`date +%Y` 
-    let "theyear += 10 "
-    valid=${theyear:2}`date +%m%d`000000Z
-    CMD="openssl req -out $CERT_DIR/bad_future.req -newkey rsa:$bits -new -keyout $CERT_DIR/bad_future.priv -config $CA_DIR/req_conf_future.cnf"
-    echo $CMD; eval $CMD
-    CMD="openssl ca -in $CERT_DIR/bad_future.req -out $CERT_DIR/bad_future.cert -outdir $tmpdir -md md5 -config $CA_CONF -batch -startdate $valid -days $DAYS"
-    echo $CMD; $CMD
- 
-    # create host cert with mismatched signing_policy
-    export CN="$HOSTNAME"
-    CMD="openssl req -out $CERT_DIR/bad_policy_host.req -newkey rsa:$bits -new -keyout $CERT_DIR/bad_policy_host.priv -config $CA_DIR/req_conf_policy.cnf"
-    echo $CMD; $CMD
-    CMD="openssl ca -in $CERT_DIR/bad_policy_host.req -out $CERT_DIR/bad_policy_host.cert -outdir $tmpdir -md md5 -config $CA_CONF -batch -days $DAYS"
-    echo $CMD; $CMD
-
-    # create revoked host cert 
-    export CN="$HOSTNAME"
-    CMD="openssl req -out $CERT_DIR/bad_revoked_host.req -newkey rsa:$bits -new -keyout $CERT_DIR/bad_revoked_host.priv -config $CA_DIR/req_conf.cnf"
-    echo $CMD; $CMD
-    CMD="openssl ca -in $CERT_DIR/bad_revoked_host.req -out $CERT_DIR/bad_revoked_host.cert -outdir $tmpdir -md md5 -config $CA_CONF -batch -days $DAYS"
-    echo $CMD; $CMD
-
-    openssl ca -revoke $CERT_DIR/bad_revoked_host.cert -config $CA_CONF
-
-    # create expired host cert 
-    export CN="$HOSTNAME"
-    CMD="openssl req -out $CERT_DIR/bad_expired_host.req -newkey rsa:$bits -new -keyout $CERT_DIR/bad_expired_host.priv -config $CA_DIR/req_conf.cnf"
-    echo $CMD; $CMD
-    CMD="openssl ca -in $CERT_DIR/bad_expired_host.req -out $CERT_DIR/bad_expired_host.cert -outdir $tmpdir -md md5 -config $CA_CONF -batch -days -1"
-    echo $CMD; $CMD
-
-
-    # generating CRL
-    openssl ca -gencrl -crldays 10000 -out $CA_DIR/${catype}.crl -config $CA_CONF
-
     # generating a signing_policy file
-    subject_name=$(openssl x509 -in $CA_DIR/${catype}.cert -subject -noout)
+    subject_name=`openssl x509 -in $CA_DIR/${catype}.cert -subject -noout| sed 's/^subject= //'`
     cat <<EOF > $CA_DIR/${catype}.signing_policy
-# Signing policy file for the $(echo "$subject_name" | sed -e 's#^.*/CN=##')
-access_id_CA            X509    '${subject_name:9}'
+# Signing policy file for the $subject_name"
+access_id_CA            X509    '${subject_name}'
 pos_rights              globus  CA:sign
-cond_subjects           globus  '"$(echo "${subject_name:9}" | sed -e 's#/CN=.*$##')/*"'
+cond_subjects           globus  '"$(echo "${subject_name}" | sed -e 's#/CN=.*$##')/*"'
 EOF
 
     cat <<EOF > $CA_DIR/${catype}.namespaces
-# Namespace for the $(echo "$subject_name" | sed -e 's#^.*/CN=##')
-TO Issuer "${subject_name:9}" \
-  PERMIT Subject "$(echo "${subject_name:9}" | sed -e 's#/CN=.*$##')/*"
+# Namespace for the $subject_name"
+TO Issuer "${subject_name}" \
+  PERMIT Subject "$(echo "${subject_name}" | sed -e 's#/CN=.*$##')/*"
  
 EOF
     
@@ -527,21 +583,28 @@ function create_all {
     TYPE="client"
     CTYPE="client"
 
-    # i=0;
-    # let "i += 1"; echo "State : $i"; cat ${CA_DIR}/serial_proxy.txt; echo;
-    # ls -l  ${CA_DIR}/.
-   
     create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE} $DAYS
-
-    # let "i += 1"; echo "State : $i"; cat ${CA_DIR}/serial_proxy.txt; echo;
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
+    create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_exp "expired proxy" -1
+    create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
+    create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy_exp "expired proxy" -1 proxy_exp
+
+    TYPE="clientbaddn"
+    CTYPE="client with bad DN"
 
-    # let "i += 1"; echo "State : $i"; cat ${CA_DIR}/serial_proxy.txt; echo;
+    create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE} $DAYS
+    create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_exp "expired proxy" -1
+    create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
+    create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy_exp "expired proxy" -1 proxy_exp
 
-    # let "i += 1"; echo "State : $i"; cat ${CA_DIR}/serial_proxy.txt; echo;
+    TYPE="clientfuture"
+    CTYPE="client future"
+
+    create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE} $DAYS
+    create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
+    create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_exp "expired proxy" -1
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
-    # let "i += 1"; echo "State : $i"; cat ${CA_DIR}/serial_proxy.txt; echo;
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy_exp "expired proxy" -1 proxy_exp
 
     TYPE="clientserial"
@@ -574,27 +637,29 @@ function create_all {
     TYPE="fclient"
     CTYPE="flag client"
 
-    # let "i += 1"; echo "State : $i"; cat ${CA_DIR}/serial_proxy.txt; echo;
     create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE} $DAYS
-    # Is there a problem here? The serial # does not advance after writing the certificate. Check later.
-    # let "i += 1"; echo "State : $i"; cat ${CA_DIR}/serial_proxy.txt; echo;
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
-    # let "i += 1"; echo "State : $i"; cat ${CA_DIR}/serial_proxy.txt; echo;
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_exp "expired proxy" -1
-
-    # let "i += 1"; echo "State : $i"; cat ${CA_DIR}/serial_proxy.txt; echo;
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
-    # let "i += 1"; echo "State : $i"; cat ${CA_DIR}/serial_proxy.txt; echo;
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy_exp "expired proxy" -1 proxy_exp
 
     TYPE="bigclient"
     CTYPE="bigclient"
+    TYPE2="client"
 
-    create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE} $DAYS 4096
-
+    create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE2} $DAYS 4096
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_exp "expired proxy" -1
+    create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
+    create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy_exp "expired proxy" -1 proxy_exp
 
+    TYPE="verybigclient"
+    CTYPE="very big client"
+    TYPE2="client"
+
+    create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE2} $DAYS 8192
+    create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
+    create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_exp "expired proxy" -1
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy_exp "expired proxy" -1 proxy_exp
 
@@ -602,17 +667,41 @@ function create_all {
     CTYPE="server"
 
     create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE} $DAYS
-
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_exp "expired proxy" -1
-
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy_exp "expired proxy" -1 proxy_exp
 
+    TYPE="host"
+    CTYPE="$HOSTNAME"
+    TYPE2="server"
+
+    create_cert $CERT_DIR/${catype}_${TYPE} "${CTYPE}" ${TYPE2} $DAYS
+
+    TYPE="host_rev"
+    CTYPE="$HOSTNAME"
+    TYPE2="server"
+
+    create_cert $CERT_DIR/${catype}_${TYPE} "${CTYPE}" ${TYPE2} $DAYS
+    openssl ca -revoke $CERT_DIR/${catype}_${TYPE}.cert -config $REQ_CONFIG_FILE
+
+
+    TYPE="host_exp"
+    CTYPE="$HOSTNAME"
+    TYPE2="server"
+
+    create_cert $CERT_DIR/${catype}_${TYPE} "${CTYPE}" ${TYPE2} -1
+
+    TYPE="host_baddn"
+    CTYPE="$HOSTNAME"
+    TYPE2="hostbaddn"
+
+    create_cert $CERT_DIR/${catype}_${TYPE} "${CTYPE}" ${TYPE2} $DAYS
+
     TYPE="altname"
     CTYPE="altname"
 
-    create_cert $CERT_DIR/${catype}_${TYPE} "$catype/xxx.foo.bar" ${TYPE} $DAYS
+    create_cert $CERT_DIR/${catype}_${TYPE} "$catype\/xxx.foo.bar" ${TYPE} $DAYS
 
     TYPE="altname"
     CTYPE="altname2"
@@ -628,10 +717,8 @@ function create_all {
     CTYPE="clientserver"
 
     create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE} $DAYS
-
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_exp "expired proxy" -1
-
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy_exp "expired proxy" -1 proxy_exp
 
@@ -639,10 +726,8 @@ function create_all {
     CTYPE="none"
 
     create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE} $DAYS
-
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_exp "expired proxy" -1
-
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy_exp "expired proxy" -1 proxy_exp
 
@@ -688,7 +773,7 @@ function create_all {
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
 
-# Create revoked certificates
+    # Create revoked certificates with otherwise valid proxies
 
     TYPE="client_rev"
     CTYPE="client revoked"
@@ -697,7 +782,7 @@ function create_all {
     create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE2} $DAYS
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
-    openssl ca -revoke $CERT_DIR/${catype}_${TYPE}.cert -config $CA_CONF
+    openssl ca -revoke $CERT_DIR/${catype}_${TYPE}.cert -config $REQ_CONFIG_FILE
 
     TYPE="fclient_rev"
     CTYPE="flag client revoked"
@@ -706,7 +791,7 @@ function create_all {
     create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE2} $DAYS
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
-    openssl ca -revoke $CERT_DIR/${catype}_${TYPE}.cert -config $CA_CONF
+    openssl ca -revoke $CERT_DIR/${catype}_${TYPE}.cert -config $REQ_CONFIG_FILE
 
     TYPE="server_rev"
     CTYPE="server revoked"
@@ -715,7 +800,7 @@ function create_all {
     create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE2} $DAYS
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
-    openssl ca -revoke $CERT_DIR/${catype}_${TYPE}.cert -config $CA_CONF
+    openssl ca -revoke $CERT_DIR/${catype}_${TYPE}.cert -config $REQ_CONFIG_FILE
 
     TYPE="clientserver_rev"
     CTYPE="clientserver revoked"
@@ -724,7 +809,7 @@ function create_all {
     create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE2} $DAYS
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
-    openssl ca -revoke $CERT_DIR/${catype}_${TYPE}.cert -config $CA_CONF
+    openssl ca -revoke $CERT_DIR/${catype}_${TYPE}.cert -config $REQ_CONFIG_FILE
 
     TYPE="none_rev"
     CTYPE="none revoked"
@@ -733,27 +818,21 @@ function create_all {
     create_cert $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" ${TYPE2} $DAYS
     create_cert_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy "proxy" $PROXY_VALIDITY
     create_cert_proxy_proxy $CERT_DIR/${catype}_${TYPE} "$catype ${CTYPE}" proxy_proxy "proxy" $PROXY_VALIDITY proxy
-    openssl ca -revoke $CERT_DIR/${catype}_${TYPE}.cert -config $CA_CONF
+    openssl ca -revoke $CERT_DIR/${catype}_${TYPE}.cert -config $REQ_CONFIG_FILE
 
     # some extra certificates
     
-    TYPE="client"
-    CTYPE="client dnerror"
-    TYPE2="proxy_dnerror"
-    create_cert_proxy $CERT_DIR/${catype}_client "$catype client dnerror" ${TYPE2} "proxy" $DAYS
-
     # generating CRL
-    openssl ca -gencrl -crldays 10000 -out $CA_DIR/${catype}.crl -config $CA_CONF
+    openssl ca -gencrl -crldays 10000 -out $CA_DIR/${catype}.crl -config $REQ_CONFIG_FILE
 
     # now do the clean-up?
-    
-    rm ${CA_DIR}/serial_proxy.txt ${CA_DIR}/index_proxy.txt
+    rm ${CA_DIR}/serial_proxy.txt ${CA_DIR}/index_proxy.txt ${CA_DIR}/serial_cert_save.txt ${CA_DIR}/index_cert_save.txt
 
 }
 
 ############################## main ################################
 
-USAGE="$0 [--help] [--all|--some] [--voms] [--onlyenv] [--extra #extra-user-certs]"
+USAGE="$0 [--help] [--all|--some] [--voms] [--onlyenv] [--extra #extra-user-certs] target_dir"
 
 TEMP=$(getopt -o hasvoe: --long help,all,some,voms,onlyenv,extra: -- "$@")
 eval set -- "$TEMP"
@@ -773,7 +852,7 @@ while true; do
     case "$1" in
         -a|--all)
             ALL='yes'
-            CATYPES='trusted fake big expired bad'
+            CATYPES='trusted fake big expired nokeyusage subsubca'
             shift
             ;;
         -s|--some)
@@ -820,7 +899,7 @@ openssl version
 TARGETDIR=$1
 CONFIGDIR=$(cd $(dirname $0)/..; echo $PWD)/test
 
-export PASSWORD='changeit'
+PASSWORD='changeit'
 DAYS=10000
 
 if [ -z "$TARGETDIR" ]; then
@@ -850,22 +929,9 @@ for catype in $CATYPES; do
     export CATYPE=${catype}
     export CA_DIR=${catype}-ca
     export CERT_DIR=${catype}-certs
-    export CA_CONF=$CA_DIR/ca_conf.cnf
-    export CA_PROXY_CONF=$CA_DIR/ca_proxy_conf.cnf
     export REQ_CONFIG_FILE=$CA_DIR/req_conf.cnf
-    export REQ_CONFIG_FILE_SERIAL=$CA_DIR/req_conf_sn.cnf
-    export REQ_CONFIG_FILE_EMAIL=$CA_DIR/req_conf_email.cnf
-    export REQ_CONFIG_FILE_UID=$CA_DIR/req_conf_uid.cnf
-    export REQ_CONFIG_FILE_ALTNAME=$CA_DIR/req_conf_altname.cnf
-    export REQ_PROXY_CONFIG_FILE=$CA_DIR/req_proxy_conf.cnf
-    export REQ_PROXY_PROXY_CONFIG_FILE=$CA_DIR/req_proxy_proxy_conf.cnf
-    export PROXY_BITS=512
-
-    if [ "$catype" = "big" ]; then
-        export BITS=8192
-    else
-        export BITS=1024
-    fi
+    export PROXY_BITS=1024
+    export CASROOT=./
 
     # putting the CA certificate to the right place
     if [ ! -d "$CONFIGDIR/${catype}-ca" ]; then

diff --git a/config/ca_conf.cnf b/config/ca_conf.cnf
deleted file mode 100644 (file)
index 42d548d..0000000
--- a/config/ca_conf.cnf
+++ /dev/null
@@ -1,60 +0,0 @@
-[ca]\r
-default_ca = CA_default\r
-\r
-[CA_default]\r
-dir = $ENV::CA_DIR\r
-database = $dir/index.txt\r
-serial = $dir/serial.txt\r
-default_md = sha1\r
-\r
-certificate = $dir/$ENV::CATYPE.cert\r
-private_key = $dir/$ENV::CATYPE.priv\r
-\r
-policy = policy_any\r
-\r
-[policy_any]\r
-countryName            = supplied\r
-stateOrProvinceName    = optional\r
-localityName           = optional\r
-organizationName       = optional\r
-organizationalUnitName = optional\r
-commonName             = supplied\r
-emailAddress           = optional\r
-\r
-[ ca_cert ]\r
-basicConstraints=CA:TRUE\r
-\r
-\r
-[ ca_server ]\r
-# This is OK for an SSL server.\r
-nsCertType                     = server\r
-nsComment                      = "OpenSSL Generated Server Certificate"\r
-\r
-# For an object signing certificate this would be used.\r
-# nsCertType = objsign\r
-\r
-[ ca_client ]\r
-# For normal client use this is typical\r
-nsCertType = client, email\r
-nsComment                      = "OpenSSL Generated Client Certificate"\r
-\r
-[ ca_clientserver ]\r
-# For normal client use this is typical\r
-nsCertType = server, client, email\r
-nsComment                      = "OpenSSL Generated Client Server Certificate"\r
-\r
-# and for everything including object signing:\r
-# nsCertType = client, email, objsign\r
-\r
-[ ca_fclient ]\r
-# This is typical in keyUsage for a client certificate.\r
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment\r
-\r
-# This will be displayed in Netscape's comment listbox.\r
-nsComment                      = "OpenSSL Generated Client Certificate with Flags"\r
-\r
-[ ca_none ]\r
-nsComment                      = "OpenSSL Generated Client Certificate with Flags"\r
-\r
-[ proxy_none ]\r
-keyUsage=critical,digitalSignature,keyEncipherment\r

diff --git a/config/ca_proxy_conf.cnf b/config/ca_proxy_conf.cnf
deleted file mode 100644 (file)
index 465a9a0..0000000
--- a/config/ca_proxy_conf.cnf
+++ /dev/null
@@ -1,27 +0,0 @@
-[ca]\r
-default_ca = CA_default\r
-\r
-[CA_default]\r
-dir = $ENV::CA_DIR\r
-database = $dir/index_proxy.txt\r
-serial = $dir/serial_proxy.txt\r
-\r
-certificate = $dir/$ENV::CATYPE.cert\r
-private_key = $dir/$ENV::CATYPE.priv\r
-\r
-policy = policy_any\r
-\r
-[policy_any]\r
-countryName            = supplied\r
-stateOrProvinceName    = optional\r
-localityName           = optional\r
-organizationName       = optional\r
-organizationalUnitName = optional\r
-commonName             = supplied\r
-emailAddress           = optional\r
-\r
-[ ca_cert ]\r
-basicConstraints=CA:TRUE\r
-\r
-[ proxy_none ]\r
-\r

diff --git a/config/req_conf.cnf b/config/req_conf.cnf
index 2495b5f..2262038 100644 (file)
--- a/config/req_conf.cnf
+++ b/config/req_conf.cnf
@@ -1,19 +1,10 @@
 ### req command\r
 \r
 [ req ]\r
-default_bits           = $ENV::BITS\r
-default_keyfile                = keyfile.pem\r
+default_bits           = 1024\r
 distinguished_name     = req_distinguished_name\r
-prompt                 = no\r
-output_password                = $ENV::PASSWORD\r
-ca_cert                        = ca_cert\r
 \r
 [ req_distinguished_name ]\r
-countryName            = UG\r
-localityName           = Tropic\r
-organizationName       = Utopia\r
-organizationalUnitName = Relaxation\r
-0.commonName           = $ENV::CN\r
 \r
 [ ca_cert_req ]\r
 basicConstraints       = CA:true\r
@@ -21,21 +12,18 @@ subjectKeyIdentifier        = hash
 authorityKeyIdentifier = keyid:always,issuer:always\r
 keyUsage               = cRLSign, keyCertSign\r
 \r
-[ serial_cert_req ]\r
-serialNumber           = 12341324\r
+#[ serial_cert_req ]\r
+#serialNumber          = 12341324\r
 \r
-[ email_cert_req ]\r
-emailAddress           = test@home.org\r
+#[ email_cert_req ]\r
+#emailAddress          = test@home.org\r
 \r
-[ uid_cert_req ]\r
-userId                 = testuserid\r
+#[ uid_cert_req ]\r
+#userId                        = testuserid\r
 \r
 [ proxy_cert_req ]\r
-1.commonName           = $ENV::PROXYNAME\r
 \r
 [ proxy_proxy_cert_req ]\r
-1.commonName           = $ENV::PROXYNAME\r
-2.commonName           = $ENV::PROXYNAME\r
 \r
 #### ca command\r
 \r
@@ -43,7 +31,7 @@ userId                        = testuserid
 default_ca             = CA_default\r
 \r
 [CA_default]\r
-dir                    = $ENV::CA_DIR\r
+dir                    = $ENV::CASROOT/$ENV::CATYPE-ca\r
 database               = $dir/index.txt\r
 serial                         = $dir/serial.txt\r
 default_md             = sha1\r
@@ -62,6 +50,7 @@ organizationalUnitName        = optional
 commonName             = supplied\r
 emailAddress           = optional\r
 userId                 = optional\r
+serialNumber           = optional\r
 \r
 [ ca_cert ]\r
 basicConstraints       = CA:TRUE\r
@@ -74,6 +63,12 @@ nsComment            = "OpenSSL Generated Server Certificate"
 # For an object signing certificate this would be used.\r
 # nsCertType           = objsign\r
 \r
+[ ca_altname ]\r
+# This is OK for an SSL server.\r
+nsCertType                     = server\r
+nsComment                      = "OpenSSL Generated Server Certificate"\r
+subjectAltName = DNS:*.hoo.org,DNS:joo.haa.org,IP:123.124.220.1,DNS:g*a.e*.com\r
+\r
 [ ca_client ]\r
 # For normal client use this is typical\r
 nsCertType             = client, email\r
@@ -83,8 +78,6 @@ nsComment             = "OpenSSL Generated Client Certificate"
 # For normal client use this is typical\r
 nsCertType             = server, client, email\r
 nsComment              = "OpenSSL Generated Client Server Certificate"\r
-# and for everything including object signing:\r
-# nsCertType           = client, email, objsign\r
 \r
 [ ca_fclient ]\r
 # This is typical in keyUsage for a client certificate.\r
@@ -96,3 +89,4 @@ nsComment             = "OpenSSL Generated Client Certificate without Flags"
 \r
 [ proxy_none ]\r
 keyUsage               = critical,digitalSignature,keyEncipherment\r
+\r

diff --git a/config/req_proxy_conf.cnf b/config/req_proxy_conf.cnf
deleted file mode 100644 (file)
index 61a1812..0000000
--- a/config/req_proxy_conf.cnf
+++ /dev/null
@@ -1,46 +0,0 @@
-[ca]
-default_ca = CA_default
-
-[CA_default]
-dir = $ENV::CA_DIR
-database = $dir/index.txt
-serial = $dir/serial.txt
-
-certificate = $dir/$ENV::CATYPE.cert
-private_key = $dir/$ENV::CATYPE.priv
-
-[ req ]
-
-default_bits           = 1024
-default_keyfile        = keyfile.pem
-distinguished_name     = req_distinguished_name
-attributes             = req_attributes
-prompt                 = no
-output_password        = $ENV::PASSWORD
-# ca_cert                   = CA_cert
-
-[ req_distinguished_name ]
-
-countryName                    = UG
-
-#stateOrProvinceName          = South area
-
-localityName                   = Tropic
-
-organizationName                      = Utopia
-
-organizationalUnitName         = Relaxation
-
-0.commonName                     = $ENV::CN
-
-1.commonName                     = $ENV::PROXYNAME
-
-#emailAddress                   = Email Address
-
-[ req_attributes ]
-
-[ CA_cert]
-
-basicConstraints = CA:true
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid:always,issuer:always

diff --git a/config/req_proxy_proxy_conf.cnf b/config/req_proxy_proxy_conf.cnf
deleted file mode 100644 (file)
index f95b0ca..0000000
--- a/config/req_proxy_proxy_conf.cnf
+++ /dev/null
@@ -1,35 +0,0 @@
-[ req ]
-default_bits           = 1024
-default_keyfile        = keyfile.pem
-distinguished_name     = req_distinguished_name
-attributes             = req_attributes
-prompt                 = no
-output_password        = $ENV::PASSWORD
-ca_cert                     = CA_cert
-
-[ req_distinguished_name ]
-countryName                    = UG
-
-#stateOrProvinceName          = South area
-
-localityName                   = Tropic
-
-organizationName                      = Utopia
-
-organizationalUnitName         = Relaxation
-
-0.commonName                     = $ENV::CN
-
-1.commonName                     = $ENV::PROXYNAME
-
-2.commonName                     = $ENV::PROXYNAME
- 
-#emailAddress                   = Email Address
-
-[ req_attributes ]
-#challengePassword              = $ENV::PASSWORD
-
-[ CA_cert]
-basicConstraints = CA:true
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid:always,issuer:always