# * Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR # A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR # CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED # TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY # OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING # NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF # THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # # # Generate the certificates and keys for testing. # PROJECT_NAME="Nodemcu Project" # Generate the openssl configuration files. cat > ca_cert.conf << EOF [ req ] distinguished_name = req_distinguished_name prompt = no [ req_distinguished_name ] O = $PROJECT_NAME Dodgy Certificate Authority EOF cat > certs.conf << EOF [ req ] distinguished_name = req_distinguished_name prompt = no [ req_distinguished_name ] O = $PROJECT_NAME CN = Nodemcu Client cert EOF cat > device_cert.conf << EOF [ req ] distinguished_name = req_distinguished_name prompt = no [ req_distinguished_name ] O = $PROJECT_NAME Device Certificate EOF # private key generation openssl genrsa -out TLS.ca_key.pem 2048 openssl genrsa -out TLS.key_2048.pem 2048 # convert private keys into DER format openssl rsa -in TLS.key_2048.pem -out TLS.key_2048 -outform DER # cert requests openssl req -out TLS.ca_x509.req -sha256 -key TLS.ca_key.pem -new \ -config ./ca_cert.conf openssl req -out TLS.x509_2048.req -sha256 -key TLS.key_2048.pem -new \ -config ./certs.conf # generate the actual certs. openssl x509 -req -in TLS.ca_x509.req -sha256 -out TLS.ca_x509.pem \ -sha1 -days 5000 -signkey TLS.ca_key.pem openssl x509 -req -in TLS.x509_2048.req -sha256 -out TLS.x509_2048.pem \ -sha1 -CAcreateserial -days 5000 \ -CA TLS.ca_x509.pem -CAkey TLS.ca_key.pem # some cleanup rm TLS*.req rm *.conf openssl x509 -in TLS.ca_x509.pem -outform DER -out TLS.ca_x509.cer openssl x509 -in TLS.x509_2048.pem -outform DER -out TLS.x509_2048.cer # # Generate the certificates and keys for encrypt. # # set default cert for use in the client xxd -i TLS.x509_2048.cer | sed -e \ "s/TLS_x509_2048_cer/default_certificate/" > cert.h # set default key for use in the server xxd -i TLS.key_2048 | sed -e \ "s/TLS_key_2048/default_private_key/" > private_key.h