mirror of
https://github.com/samsonjs/agate.git
synced 2026-03-27 09:25:54 +00:00
782e043083
The tests now actually check that a specific certificate is being used by only loading the correct one into the trust chain while running the test. The problem before was that openssl-req by default generates CA-capable certs which are not accepted by rustls.
36 lines
843 B
Bash
Executable file
36 lines
843 B
Bash
Executable file
#!/bin/bash
|
|
|
|
mkdir -p example.com example.org
|
|
|
|
for domain in "example.com" "example.org"
|
|
do
|
|
# create private key
|
|
openssl genpkey -out $domain/key.rsa -algorithm RSA -pkeyopt rsa_keygen_bits:4096
|
|
|
|
# create config file:
|
|
# the generated certificates must not be CA-capable, otherwise rustls complains
|
|
cat >openssl.conf <<EOT
|
|
[req]
|
|
default_bits = 4096
|
|
distinguished_name = req_distinguished_name
|
|
req_extensions = req_ext
|
|
prompt = no
|
|
|
|
[v3_ca]
|
|
basicConstraints = critical, CA:false
|
|
|
|
[req_distinguished_name]
|
|
commonName = $domain
|
|
|
|
[req_ext]
|
|
subjectAltName = DNS:$domain
|
|
EOT
|
|
|
|
openssl req -new -sha256 -out request.csr -key $domain/key.rsa -config openssl.conf
|
|
|
|
openssl x509 -req -sha256 -days 3650 -in request.csr -out $domain/cert.pem \
|
|
-extensions req_ext -extfile openssl.conf -signkey $domain/key.rsa
|
|
done
|
|
|
|
# clean up
|
|
rm openssl.conf request.csr
|