wok annotate cacerts/stuff/make-ca.sh @ rev 17898
Add clearlooks-colors.
author | Aleksej Bobylev <al.bobylev@gmail.com> |
---|---|
date | Fri Apr 03 01:31:15 2015 +0300 (2015-04-03) |
parents | d805d3de4546 |
children | cfa2c2f63692 |
rev | line source |
---|---|
al@14468 | 1 #!/bin/sh |
al@14468 | 2 # Begin make-ca.sh |
al@14468 | 3 # Script to populate OpenSSL's CApath from a bundle of PEM formatted CAs |
al@14468 | 4 # |
al@14468 | 5 # The file certdata.txt must exist in the local directory |
al@14468 | 6 # Version number is obtained from the version of the data. |
al@14468 | 7 # |
al@14468 | 8 # Authors: DJ Lucas |
al@14468 | 9 # Bruce Dubbs |
al@14468 | 10 # |
al@14468 | 11 # Version 20120211 |
al@14468 | 12 |
al@14468 | 13 certdata="certdata.txt" |
al@14468 | 14 |
al@14468 | 15 if [ ! -r $certdata ]; then |
al@14468 | 16 echo "$certdata must be in the local directory" |
al@14468 | 17 exit 1 |
al@14468 | 18 fi |
al@14468 | 19 |
al@14468 | 20 REVISION=$(grep CVS_ID $certdata | cut -f4 -d'$') |
al@14468 | 21 |
al@14468 | 22 if [ -z "${REVISION}" ]; then |
al@14468 | 23 echo "$certfile has no 'Revision' in CVS_ID" |
al@14468 | 24 exit 1 |
al@14468 | 25 fi |
al@14468 | 26 |
al@14468 | 27 VERSION=$(echo $REVISION | cut -f2 -d" ") |
al@14468 | 28 |
al@14468 | 29 TEMPDIR=$(mktemp -d) |
al@14468 | 30 TRUSTATTRIBUTES="CKA_TRUST_SERVER_AUTH" |
al@14468 | 31 BUNDLE="ca-bundle.crt" |
al@14468 | 32 CONVERTSCRIPT="./make-cert.pl" |
al@14468 | 33 SSLDIR="${DESTDIR}/etc/ssl" |
al@14468 | 34 |
al@14468 | 35 mkdir "${TEMPDIR}/certs" |
al@14468 | 36 |
al@17865 | 37 # Get a list of starting lines for each cert |
al@14468 | 38 CERTBEGINLIST=$(grep -n "^# Certificate" "${certdata}" | cut -d ":" -f1) |
al@14468 | 39 |
al@14468 | 40 # Get a list of ending lines for each cert |
al@14468 | 41 CERTENDLIST=`grep -n "^CKA_TRUST_STEP_UP_APPROVED" "${certdata}" | cut -d ":" -f 1` |
al@14468 | 42 |
al@14468 | 43 # Start a loop |
al@14468 | 44 for certbegin in ${CERTBEGINLIST}; do |
al@14468 | 45 for certend in ${CERTENDLIST}; do |
al@14468 | 46 if test "${certend}" -gt "${certbegin}"; then |
al@14468 | 47 break |
al@14468 | 48 fi |
al@14468 | 49 done |
al@14468 | 50 |
al@14468 | 51 # Dump to a temp file with the name of the file as the beginning line number |
al@14468 | 52 sed -n "${certbegin},${certend}p" "${certdata}" > "${TEMPDIR}/certs/${certbegin}.tmp" |
al@14468 | 53 done |
al@14468 | 54 |
al@17865 | 55 unset CERTBEGINLIST CERTDATA CERTENDLIST certbegin certend |
al@14468 | 56 |
al@14468 | 57 mkdir -p certs |
al@17865 | 58 rm -f certs/* # Make sure the directory is clean |
al@14468 | 59 |
al@14468 | 60 for tempfile in ${TEMPDIR}/certs/*.tmp; do |
al@14468 | 61 # Make sure that the cert is trusted... |
al@14468 | 62 grep "CKA_TRUST_SERVER_AUTH" "${tempfile}" | \ |
al@14468 | 63 egrep "TRUST_UNKNOWN|NOT_TRUSTED" > /dev/null |
al@14468 | 64 |
al@14468 | 65 if test "${?}" = "0"; then |
al@14468 | 66 # Throw a meaningful error and remove the file |
al@14468 | 67 cp "${tempfile}" tempfile.cer |
al@14468 | 68 perl ${CONVERTSCRIPT} > tempfile.crt |
al@14468 | 69 keyhash=$(openssl x509 -noout -in tempfile.crt -hash) |
al@14468 | 70 echo "Certificate ${keyhash} is not trusted! Removing..." |
al@14468 | 71 rm -f tempfile.cer tempfile.crt "${tempfile}" |
al@14468 | 72 continue |
al@14468 | 73 fi |
al@14468 | 74 |
al@14468 | 75 # If execution made it to here in the loop, the temp cert is trusted |
al@14468 | 76 # Find the cert data and generate a cert file for it |
al@14468 | 77 |
al@14468 | 78 cp "${tempfile}" tempfile.cer |
al@14468 | 79 perl ${CONVERTSCRIPT} > tempfile.crt |
al@14468 | 80 keyhash=$(openssl x509 -noout -in tempfile.crt -hash) |
al@14468 | 81 mv tempfile.crt "certs/${keyhash}.pem" |
al@14468 | 82 rm -f tempfile.cer "${tempfile}" |
al@14468 | 83 echo "Created ${keyhash}.pem" |
al@14468 | 84 done |
al@14468 | 85 |
al@14468 | 86 # Remove blacklisted files |
al@14468 | 87 # MD5 Collision Proof of Concept CA |
al@14468 | 88 if test -f certs/8f111d69.pem; then |
al@14468 | 89 echo "Certificate 8f111d69 is not trusted! Removing..." |
al@14468 | 90 rm -f certs/8f111d69.pem |
al@14468 | 91 fi |
al@14468 | 92 |
al@14468 | 93 # Finally, generate the bundle and clean up. |
al@14468 | 94 cat certs/*.pem > ${BUNDLE} |
al@14468 | 95 rm -r "${TEMPDIR}" |