From 52dd13fa355be5e5c388e7517608f298bbff56a1 Mon Sep 17 00:00:00 2001 From: Anthony Romano Date: Thu, 20 Jul 2017 15:13:22 -0700 Subject: [PATCH] fixtures: generate wildcard DNS SAN cert DNS: *.etcd.local --- integration/fixtures/ca.crt | 52 +++++----- integration/fixtures/gencerts.sh | 14 ++- integration/fixtures/revoke.crl | Bin 778 -> 782 bytes integration/fixtures/server-revoked.crt | 54 +++++----- .../fixtures/server-revoked.key.insecure | 98 +++++++++--------- integration/fixtures/server-wildcard.crt | 30 ++++++ .../fixtures/server-wildcard.key.insecure | 27 +++++ integration/fixtures/server.crt | 54 +++++----- integration/fixtures/server.key.insecure | 98 +++++++++--------- 9 files changed, 248 insertions(+), 179 deletions(-) create mode 100644 integration/fixtures/server-wildcard.crt create mode 100644 integration/fixtures/server-wildcard.key.insecure diff --git a/integration/fixtures/ca.crt b/integration/fixtures/ca.crt index c042b29c5..3ccaadbfe 100644 --- a/integration/fixtures/ca.crt +++ b/integration/fixtures/ca.crt @@ -1,33 +1,33 @@ -----BEGIN CERTIFICATE----- -MIIFrjCCA5agAwIBAgIUCwleGnPMSwoODcFBty/IC/L6CUIwDQYJKoZIhvcNAQEN +MIIFrjCCA5agAwIBAgIUXWXsuLEZuHtKgeQSIVthb14+9EQwDQYJKoZIhvcNAQEN BQAwbzEMMAoGA1UEBhMDVVNBMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH Ew1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKEwRldGNkMRYwFAYDVQQLEw1ldGNkIFNl -Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0xNzA2MTYyMDMzMDBaFw0yNzA2MTQyMDMz +Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0xNzA3MjAyMjA1MDBaFw0yNzA3MTgyMjA1 MDBaMG8xDDAKBgNVBAYTA1VTQTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE BxMNU2FuIEZyYW5jaXNjbzENMAsGA1UEChMEZXRjZDEWMBQGA1UECxMNZXRjZCBT ZWN1cml0eTELMAkGA1UEAxMCY2EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK -AoICAQDhp9t3WUGpaRtbM52hudffXT0V9dbl1ac4DD37MdIit2yDFsut1IxSgZ40 -9FliVStAWzDhZL6nX4rpInXOEI1WV1xKXu+T8i2LcxnW4QjvKTLMpBdF6q0KzsiZ -CV5uNTQvIuR/hQN4ij03j75nnj/ds5TUCQfz/Mh6T/xwbHp1XUimcVnh38+q+ZE2 -eCmEvcdAEQ9DXj7WTDD4dN0xaJz8rvZSVWVBwuP7dtN54FJmJyRXcCuus5pUd/Lm -n4mEEZ3DLceUM13AK/gwAS3SNHOwuH4pl6IKJ10qSUdzrB+Lt0rx2iqyodN/EMnh -kYJRWG8mv5spN/s695A3MLKk0hZ/bkys91n0hycaPFg8TwxmdXP8P/AOFQXyK4x9 -YhvtF6mGhD/RHqdaujF/tCH34DpMVY9ObTu59R/6qG4Zr3KfqpDp5iM1LjggT4QU -2JBn9zc5rAd/j3clcgfJfW5CZ8ek31HLIKPm5pa8q5l4qL7qWu0FjZTpSgUps29O -ekRhtSCFI3R8TZkWOAV5DM+FkXJACsOJT/Ds4/BFgia05dglNEkFTuSDAT6BfQjy -bghuxYkFP3bPj8rflM9AhXsfHM5qEcSkZcSdjHqn4u2uvRnpc1/T8MVADqkpMukf -IUabqJ0Iy5SHXmqouO2ZkPG8C4ytkUuQW3WKrLNBSXRJVQ3pAQIDAQABo0IwQDAO -BgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUiZ/XuFgs -FCGDhz0eMvNuB/aMvSgwDQYJKoZIhvcNAQENBQADggIBAHHsADO+SiUi51IibgF0 -gdKMurtJq2cdC8YNjkkDeI8jgIljrEi7HgYs9l3IbfRmBd5/5DRdVn8NLkjEVXSL -fcKfGHqJSsA7qLylfXoBUAwcwObdo0fTMBn+NEfK3zb5BndClTaQRs2XiHmEwntR -HUcSruOsWOJs9dxYHe89odMLIZv8rhbEH1vUIKC2vTnxF8vysJfx/ob3kpWiGClO -pwpt5sc/BkWM+zo8gVnypqZzhWkYMJj5xrz0/1Wk9I8NwJnsjCcyFB+GMwX6b0ei -TUU2MgS3krmG8A43JwUzPs8DVkQeWvsZejZzRCqDwlTwXM9pP8zGJFV0MYpyszc6 -Fx+qM2Xso5Gyja8RgHDlgJKAtnZe/vu6ocgnRXeLzLsWYVN3on2PLwL3dXxjciL0 -y4uCuLBb9ckbG3jJd4uvc6OdKVV47xsL6qgm4knHijclhkG4DXojAmdY2g0S0ptX -ingwbLw5YHARLrOeXCgRp23SzXdvtnzbfgbI+9YQrxet8vFWg2Y+7NP2iF2/JufU -HcPpuVGjsLkZBj4j9tOhUMDFk8esy6dBVpJ9+4d9slY0Eg5s5+XmnnVb6+QOCEii -Gcq4nDgM8VEJxYFX9pxpjtiwiy3KVOP5QU+H0fjYfKIAi3IUdW03vzIu/H0vPk5h -zceob2+4yKU2W+OQNeVChUzc +AoICAQCmtwjSg7gQBcVaoMycpePT0qoM0SKJVuvQRXIjL53/Bae5zuWiBdDVTElf +6OOFkjqPAxU7t28jmn/EqNcKkaVuFcFtVbgyD+vXWQITGSGfE1hmqVUcpbSpzLim +UIFNy6slMeUdFGiLG7/4P6mCHePgoW9r1+J2oAHSooCzJDqLNAGkgHhFQPhBC62G +3QrY2gwKlJ6Yl+2Ilb+bdT4PJq8sSlyAynPFTp07hnciEG6Ef6IQxc9pZb+UCa2A +Cyn9RU83AWj/aIcdlB8iNf86np4wFe8VEkgBdih91vfEzvoMhJZYBb0b0CnrRo1e +jVXAJkqTbajQM+yxlvlhB2PNCZusJa69eDCtnnO29MbTjOTqElTxlvU9c3huZycc +VMDgzyzm87F+Me3vh/6l6VC4Pm0zkA3XdwydncxreFoD/G+fQK2m6wXWzIsSGwqG +gzgAq8neJFfkcgzRu6WU1S8S/idqK9AoQAFIEPXYyIk3+K6JzHxhYZIBFE3OrZ58 +oEo2PCP4snzTysZk7eWCe/WTZvReKtytzKAIS/CcjxsmgaviHee5tlV/rIghAxq8 +QFnldJ1J9AtqPriRv0+EDFwOL8eyA+cVbWgX9UR0gWLe5lUqooowpq2ioWHG5F1m +cyi0u8cUtf5YZN6SVktQUdddsOCFfxvCU1NigxVxqs1ZWhSSrwIDAQABo0IwQDAO +BgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUp//gP4sC +l0dWZOXJWaPOYED2YdQwDQYJKoZIhvcNAQENBQADggIBABXyQox/T4kD+sLuTAp9 +IP6Hr/XaHmKj3Zkrp8DdWt62R13ugCdWA8hu2yYzu92mSHBGbssaSaLzsNeb+LqE +/gSNQBvbfV0btQN2h+B3+BmEUuiv4ZTMPNArGfG7L1p35kH0NL46Bcssu59XSFLe +RIc7M5yT/C5+f/muhIxsAT6AdnwwkcxjQvQj9257S1gonOjLmmsVXW+Z+G9Y3YIf +hp84yvrJh86QVGsDC5Cu5i9kC/0CodCouIlBjWdELZDWV5KvbLAuWoQ5Jp1Y6+Jo +Dhx+2HB9mKmDWJfS8rWd//EiX/JH8iSMSaltmrzk6PYlWFAuM8jycDyyQI4mCe6J +wPMRyism7cowcGqHb+Nn2OiPvJtX6bGcVb8DbaGDmfgPdACqjdguzLHnaFyLmDe/ +la0y1FAfW7jOyQrXEzqB4tJ8ZhI+HxRiXAh8ahBcKnMQFpjsEse03d2t65ZPDgev +NjIcoqhbANpYXdygux4hJNCT8KB194frC+eK0XqyO8BJYvid1Qp7SlnpFdEo1vMK +whLje6QkrgIyqoTP1+SiB3R79rtg+41bTb8paPJs9AqNaxS/l2bSnWnRvdkiJv89 +YWgQGNO21XW+VbNV7Z0tMglmTvJc0ubbV5zZpVsuSOAQjdRXKieAxWAePrzDx5AM +ZiQgL5b9icqHm0aV7bcfp8H+ -----END CERTIFICATE----- diff --git a/integration/fixtures/gencerts.sh b/integration/fixtures/gencerts.sh index 6ec4fb377..912e04903 100755 --- a/integration/fixtures/gencerts.sh +++ b/integration/fixtures/gencerts.sh @@ -12,7 +12,9 @@ fi cfssl gencert --initca=true ./ca-csr.json | cfssljson --bare ./ca mv ca.pem ca.crt +openssl x509 -in ca.crt -noout -text +# generate DNS: localhost, IP: 127.0.0.1, CN: example.com certificates cfssl gencert \ --ca ./ca.crt \ --ca-key ./ca-key.pem \ @@ -21,14 +23,24 @@ cfssl gencert \ mv server.pem server.crt mv server-key.pem server.key.insecure +# generate revoked certificates and crl cfssl gencert --ca ./ca.crt \ --ca-key ./ca-key.pem \ --config ./gencert.json \ ./server-ca-csr.json 2>revoked.stderr | cfssljson --bare ./server-revoked mv server-revoked.pem server-revoked.crt mv server-revoked-key.pem server-revoked.key.insecure - grep serial revoked.stderr | awk ' { print $9 } ' >revoke.txt cfssl gencrl revoke.txt ca.crt ca-key.pem | base64 -d >revoke.crl +# generate wildcard certificates DNS: *.etcd.local +cfssl gencert \ + --ca ./ca.crt \ + --ca-key ./ca-key.pem \ + --config ./gencert.json \ + ./server-ca-csr-wildcard.json | cfssljson --bare ./server-wildcard +mv server-wildcard.pem server-wildcard.crt +mv server-wildcard-key.pem server-wildcard.key.insecure + + rm -f *.csr *.pem *.stderr *.txt diff --git a/integration/fixtures/revoke.crl b/integration/fixtures/revoke.crl index aa3a71c2a46274b2c10dee777977c1b94fbb4ee9..dd378e0926590e97a81e2400bb1b8a5a624add57 100644 GIT binary patch delta 660 zcmV;F0&D$>295>?FoFXLFoE-t2Z(<+GB7eSF)%VXS{Ds5H!wFcH!?CYFfuq=Fe@-A z0u%;hIDYiK|J>)v+~fpOdJ_g7pe+{>F*h(bGB7bUF)%VXEigAQFrXtaAut~X163U( z1Q;+DfE1_y;6IB3mq%7)<;hv2&R{_HVbm}U1_>&LNQUs* zCnc5`MMh+z9tSpsG-y;TXzGS>nowdR1GL~#o;`t_?8OQy5m>^55@Mt{{mWoFTXU~C z^nmwt`YO5VDb83MBCH?I@yoDyuW1Wg{vG>(+jXQdh_V~T%x%CPz3H7=W}`WA+n2eW zD5v*+TUzrMK-*40zfvq$Q#gMKZyO%LquJ1s3|T%;m~rq6T~yGW$VliR=eaH2e~U^d zb$Oh0#hNdJMPCa)D_*Qdvy(Amzh2m7V7NC>(RyLN1>{!$&C`8|wrHGaEbj8S+`QB} zy=1nkwGDruk_o-axJ`diX%=cyV(7dU%voad?q!5H3Q?7ckTZGkF&}Jv0I*{0;G7E4;sUO7`M@)7Zq*(_U5=e4g!1`4|kN#1}g-cD)}2e%_unl delta 655 zcmV;A0&x9~28sp;FoFXHFoExp2Z(<*F*Y(VGdM9bS{Ds5H!wCbGcqtUI59I?Fefl2 z0u%!x$QSSLA=Jt#{cy&`J_+^y(lmZ1_>&LNQUwre)a*XEI*fjvg1WAcj*b$=>#`7AtA1=4P{o6 zt98&I922p8W?r5N#yS?6NojxlqTnRcNY!CJGz#YCJ(5Oy2sB?WHHetl8OflXV!ZL@ zD*Y*_VigE$x+0tN)|fvGrx*R3mWMqiR{NJ-LjJj1?7nM~w$QwXU|SKgu2l-+2p?e> zaF_%!FCD1yRFE87j6EIN(bGF`Kt5^Bj)P5Mt(eU9YwB?fFriM{pF zoYLeyudi^Fin^lm@PKvfHXP9&A6|Y?3A%*R2Q53eKi-=I{#_I}Ne@GWnv%kVdHbt4 zKHJ*rQ=ZPUD8sETvIu|A!OEr>?{+@w+a=fjp6qfNEj-yf?e^j;VHr+1$>V1N2@-ny zTbRchNhoBP4>amSk`vF^pK)UH6H0pBXJ_=(Sl27-NEgtrvRrZ-WgR%n_sGXFqYv|< pL%B-5{{zm31Bcc+(N7WaosXk9O^Rg7{poR