wok-next view cacerts/stuff/make-ca.sh @ rev 20718

paulstretch: fix build
author Aleksej Bobylev <al.bobylev@gmail.com>
date Sun May 27 15:09:21 2018 +0300 (2018-05-27)
parents f29d4912ea56
children
line source
1 #!/bin/sh
2 # Begin make-ca.sh
3 # Script to populate OpenSSL's CApath from a bundle of PEM formatted CAs
4 #
5 # The file certdata.txt must exist in the local directory
6 # Version number is obtained from the version of the data.
7 #
8 # Authors: DJ Lucas
9 # Bruce Dubbs
10 #
11 # Version 20120211
12
13 # Some data in the certs have UTF-8 characters
14 export LANG=en_US.utf8
15
16 certdata="certdata.txt"
17
18 if [ ! -r $certdata ]; then
19 echo "$certdata must be in the local directory"
20 exit 1
21 fi
22
23 REVISION=$(grep CVS_ID $certdata | cut -f4 -d'$')
24
25 if [ -z "${REVISION}" ]; then
26 echo "$certfile has no 'Revision' in CVS_ID"
27 exit 1
28 fi
29
30 VERSION=$(echo $REVISION | cut -f2 -d" ")
31
32 TEMPDIR=$(mktemp -d)
33 TRUSTATTRIBUTES="CKA_TRUST_SERVER_AUTH"
34 BUNDLE="ca-bundle.crt"
35 CONVERTSCRIPT="./make-cert.pl"
36 SSLDIR="${DESTDIR}/etc/ssl"
37
38 mkdir "${TEMPDIR}/certs"
39
40 # Get a list of starting lines for each cert
41 CERTBEGINLIST=$(grep -n "^# Certificate" "${certdata}" | cut -d ":" -f1)
42
43 # Get a list of ending lines for each cert
44 CERTENDLIST=`grep -n "^CKA_TRUST_STEP_UP_APPROVED" "${certdata}" | cut -d ":" -f 1`
45
46 # Start a loop
47 for certbegin in ${CERTBEGINLIST}; do
48 for certend in ${CERTENDLIST}; do
49 if test "${certend}" -gt "${certbegin}"; then
50 break
51 fi
52 done
53
54 # Dump to a temp file with the name of the file as the beginning line number
55 sed -n "${certbegin},${certend}p" "${certdata}" > "${TEMPDIR}/certs/${certbegin}.tmp"
56 done
57
58 unset CERTBEGINLIST CERTDATA CERTENDLIST certbegin certend
59
60 mkdir -p certs
61 rm -f certs/* # Make sure the directory is clean
62
63 for tempfile in ${TEMPDIR}/certs/*.tmp; do
64 # Make sure that the cert is trusted...
65 grep "CKA_TRUST_SERVER_AUTH" "${tempfile}" | \
66 egrep "TRUST_UNKNOWN|NOT_TRUSTED" > /dev/null
67
68 if test "${?}" = "0"; then
69 # Throw a meaningful error and remove the file
70 cp "${tempfile}" tempfile.cer
71 perl ${CONVERTSCRIPT} > tempfile.crt
72 keyhash=$(openssl x509 -noout -in tempfile.crt -hash)
73 echo "Certificate ${keyhash} is not trusted! Removing..."
74 rm -f tempfile.cer tempfile.crt "${tempfile}"
75 continue
76 fi
77
78 # If execution made it to here in the loop, the temp cert is trusted
79 # Find the cert data and generate a cert file for it
80
81 cp "${tempfile}" tempfile.cer
82 perl ${CONVERTSCRIPT} > tempfile.crt
83 keyhash=$(openssl x509 -noout -in tempfile.crt -hash)
84 mv tempfile.crt "certs/${keyhash}.pem"
85 rm -f tempfile.cer "${tempfile}"
86 echo "Created ${keyhash}.pem"
87 done
88
89 # Remove blacklisted files
90 # MD5 Collision Proof of Concept CA
91 if test -f certs/8f111d69.pem; then
92 echo "Certificate 8f111d69 is not trusted! Removing..."
93 rm -f certs/8f111d69.pem
94 fi
95
96 # Finally, generate the bundle and clean up.
97 cat certs/*.pem > ${BUNDLE}
98 rm -r "${TEMPDIR}"