-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy pathgenerate-certs.sh
More file actions
executable file
·166 lines (132 loc) · 9.43 KB
/
Copy pathgenerate-certs.sh
File metadata and controls
executable file
·166 lines (132 loc) · 9.43 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
#!/bin/bash
# // SPDX-License-Identifier: LGPL-2.1-or-later
# // Copyright (c) 2015-2025 MariaDB Corporation Ab
# Script to generate self-signed certificates for testing
# CN: mariadb.example.com
set -e
echo "Generating self-signed certificates for mariadb.example.com..."
# Create directory for certificates
mkdir -p .github/workflows/certs
echo "Generate CA private key"
openssl genrsa 2048 > .github/workflows/certs/ca.key
echo "[ req ]" > .github/workflows/certs/ca.conf
echo "prompt = no" >> .github/workflows/certs/ca.conf
echo "distinguished_name = req_distinguished_name" >> .github/workflows/certs/ca.conf
echo "x509_extensions = v3_ca" >> .github/workflows/certs/ca.conf
echo "" >> .github/workflows/certs/ca.conf
echo "[ req_distinguished_name ]" >> .github/workflows/certs/ca.conf
echo "countryName = FR" >> .github/workflows/certs/ca.conf
echo "stateOrProvinceName = Loire-atlantique" >> .github/workflows/certs/ca.conf
echo "localityName = Nantes" >> .github/workflows/certs/ca.conf
echo "organizationName = Home" >> .github/workflows/certs/ca.conf
echo "organizationalUnitName = Lab" >> .github/workflows/certs/ca.conf
echo "commonName = mariadb.example.com" >> .github/workflows/certs/ca.conf
echo "emailAddress = admin@mariadb.example.com" >> .github/workflows/certs/ca.conf
echo "" >> .github/workflows/certs/ca.conf
echo "[ v3_ca ]" >> .github/workflows/certs/ca.conf
echo "subjectKeyIdentifier = hash" >> .github/workflows/certs/ca.conf
echo "authorityKeyIdentifier = keyid:always,issuer" >> .github/workflows/certs/ca.conf
echo "basicConstraints = critical,CA:true" >> .github/workflows/certs/ca.conf
echo "keyUsage = critical,keyCertSign,cRLSign" >> .github/workflows/certs/ca.conf
echo "Generate CA certificate (self-signed)"
openssl req -days 365 -new -x509 -nodes -key .github/workflows/certs/ca.key -out .github/workflows/certs/ca.crt -config .github/workflows/certs/ca.conf
echo "[ req ]" > .github/workflows/certs/server.conf
echo "prompt = no" >> .github/workflows/certs/server.conf
echo "distinguished_name = req_distinguished_name" >> .github/workflows/certs/server.conf
echo "req_extensions = req_ext" >> .github/workflows/certs/server.conf
echo "" >> .github/workflows/certs/server.conf
echo "[ req_distinguished_name ]" >> .github/workflows/certs/server.conf
echo "countryName = FR" >> .github/workflows/certs/server.conf
echo "stateOrProvinceName = Loire-atlantique" >> .github/workflows/certs/server.conf
echo "localityName = Nantes" >> .github/workflows/certs/server.conf
echo "organizationName = Home" >> .github/workflows/certs/server.conf
echo "organizationalUnitName = Lab" >> .github/workflows/certs/server.conf
echo "commonName = mariadb.example.com" >> .github/workflows/certs/server.conf
echo "emailAddress = admin@mariadb.example.com" >> .github/workflows/certs/server.conf
echo "" >> .github/workflows/certs/server.conf
echo "[ req_ext ]" >> .github/workflows/certs/server.conf
echo "subjectAltName = DNS:mariadb.example.com,IP:127.0.0.1" >> .github/workflows/certs/server.conf
echo "subjectKeyIdentifier = hash" >> .github/workflows/certs/server.conf
echo "basicConstraints = CA:FALSE" >> .github/workflows/certs/server.conf
echo "keyUsage = digitalSignature,keyEncipherment" >> .github/workflows/certs/server.conf
echo "extendedKeyUsage = serverAuth" >> .github/workflows/certs/server.conf
echo "" >> .github/workflows/certs/server.conf
echo "[ v3_server ]" >> .github/workflows/certs/server.conf
echo "subjectAltName = DNS:mariadb.example.com,IP:127.0.0.1" >> .github/workflows/certs/server.conf
echo "subjectKeyIdentifier = hash" >> .github/workflows/certs/server.conf
echo "authorityKeyIdentifier = keyid:always,issuer" >> .github/workflows/certs/server.conf
echo "basicConstraints = CA:FALSE" >> .github/workflows/certs/server.conf
echo "keyUsage = digitalSignature,keyEncipherment" >> .github/workflows/certs/server.conf
echo "extendedKeyUsage = serverAuth" >> .github/workflows/certs/server.conf
echo "Generating private key..."
openssl genrsa -out .github/workflows/certs/server.key 4096
echo "Generating certificate signing request..."
openssl req -new -key .github/workflows/certs/server.key -out .github/workflows/certs/server.csr -config .github/workflows/certs/server.conf
echo "Generate the certificate for the server:"
openssl x509 -req -sha256 -days 365 -in .github/workflows/certs/server.csr -out .github/workflows/certs/server.crt -CA .github/workflows/certs/ca.crt -CAkey .github/workflows/certs/ca.key -CAcreateserial -extensions v3_server -extfile .github/workflows/certs/server.conf
echo "Check certificat version:"
openssl x509 -in .github/workflows/certs/server.crt -text -noout | grep Version
cat .github/workflows/certs/ca.crt .github/workflows/certs/server.crt > .github/workflows/certs/ca_server.crt
openssl x509 -noout -fingerprint -sha1 -in .github/workflows/certs/server.crt > .github/workflows/certs/server-cert.sha1
echo "Server certificate SHA1 fingerprint:"
cat .github/workflows/certs/server-cert.sha1
echo "Generating client private key..."
openssl genrsa -out .github/workflows/certs/client.key 4096
echo "[ req ]" > .github/workflows/certs/client.conf
echo "prompt = no" >> .github/workflows/certs/client.conf
echo "distinguished_name = req_distinguished_name" >> .github/workflows/certs/client.conf
echo "req_extensions = req_ext" >> .github/workflows/certs/client.conf
echo "" >> .github/workflows/certs/client.conf
echo "[ req_distinguished_name ]" >> .github/workflows/certs/client.conf
echo "countryName = FR" >> .github/workflows/certs/client.conf
echo "stateOrProvinceName = Loire-atlantique" >> .github/workflows/certs/client.conf
echo "localityName = Nantes" >> .github/workflows/certs/client.conf
echo "organizationName = Home" >> .github/workflows/certs/client.conf
echo "organizationalUnitName = Lab" >> .github/workflows/certs/client.conf
echo "commonName = mariadb-client" >> .github/workflows/certs/client.conf
echo "emailAddress = admin@mariadb.example.com" >> .github/workflows/certs/client.conf
echo "" >> .github/workflows/certs/client.conf
echo "[ req_ext ]" >> .github/workflows/certs/client.conf
echo "subjectKeyIdentifier = hash" >> .github/workflows/certs/client.conf
echo "basicConstraints = CA:FALSE" >> .github/workflows/certs/client.conf
echo "keyUsage = digitalSignature,keyEncipherment" >> .github/workflows/certs/client.conf
echo "extendedKeyUsage = clientAuth" >> .github/workflows/certs/client.conf
echo "" >> .github/workflows/certs/client.conf
echo "[ v3_client ]" >> .github/workflows/certs/client.conf
echo "subjectKeyIdentifier = hash" >> .github/workflows/certs/client.conf
echo "authorityKeyIdentifier = keyid:always,issuer" >> .github/workflows/certs/client.conf
echo "basicConstraints = CA:FALSE" >> .github/workflows/certs/client.conf
echo "keyUsage = digitalSignature,keyEncipherment" >> .github/workflows/certs/client.conf
echo "extendedKeyUsage = clientAuth" >> .github/workflows/certs/client.conf
echo "Generating password-protected client private key..."
openssl rsa -aes256 -in .github/workflows/certs/client.key -out .github/workflows/certs/client-encrypted.key -passout pass:qwerty
echo "Generating client certificate signing request..."
openssl req -new -key .github/workflows/certs/client.key -out .github/workflows/certs/client.csr -config .github/workflows/certs/client.conf
echo "Generate the certificate for the client:"
openssl x509 -req -days 365 -sha256 -in .github/workflows/certs/client.csr -out .github/workflows/certs/client.crt -CA .github/workflows/certs/ca.crt -CAkey .github/workflows/certs/ca.key -CAcreateserial -extensions v3_client -extfile .github/workflows/certs/client.conf
echo "Generate the pkcs for the client:"
openssl pkcs12 -export -in .github/workflows/certs/client.crt -inkey .github/workflows/certs/client.key -out .github/workflows/certs/client.p12 -name "mysqlAlias" -passout pass:kspass
echo "Creating symbolic links..."
ln -sf client.key .github/workflows/certs/client-key.pem
ln -sf client.crt .github/workflows/certs/client-cert.pem
ln -sf ca_server.crt .github/workflows/certs/cacert.pem
ln -sf client-encrypted.key .github/workflows/certs/client-key-enc.pem
# Set appropriate permissions
chmod 644 .github/workflows/certs/*
chmod 600 .github/workflows/certs/ca.key .github/workflows/certs/client.key .github/workflows/certs/client-encrypted.key
# List generated certificates
echo "Generated certificates:"
ls -la .github/workflows/certs/
# Verify certificate
echo "Certificate details:"
openssl x509 -in .github/workflows/certs/server.crt -text -noout | grep -E "(Subject|CN)"
echo ""
echo "Verifying extensions in server certificate:"
openssl x509 -in .github/workflows/certs/server.crt -text -noout | grep -A 1 "Authority Key Identifier" || echo "Warning: Authority Key Identifier not found in server certificate"
echo ""
echo "Verifying extensions in client certificate:"
openssl x509 -in .github/workflows/certs/client.crt -text -noout | grep -A 1 "Authority Key Identifier" || echo "Warning: Authority Key Identifier not found in client certificate"
echo ""
echo "Full server certificate extensions:"
openssl x509 -in .github/workflows/certs/server.crt -text -noout | grep -A 20 "X509v3 extensions:"
echo "Certificate generation completed successfully!"