feat: Simplify generation of test certificates

Author: uliSchuster

Diff for: src/test/resources/alice-certgen-rsa.sh

@@ -15,13 +15,8 @@ $openssl_bin genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:4096 -pkeyopt rsa_k
 ### Save the private key without password protection
 $openssl_bin rsa -in ${priv_key_name}.rsakey -out ${priv_key_name}.nopass.rsakey
 
-echo "Issue certificate signing request (CSR) for the RSA key with parameters in ${certificate_config_filename}"
-$openssl_bin req -new -key ${priv_key_name}.nopass.rsakey -sha256 -out ${account_name}.csr -config ${certificate_config_filename}
-echo "Content of the certificate signing request:"
-$openssl_bin req -text -noout -in ${account_name}.csr
-
 echo "Generating self-signed certificate..."
-$openssl_bin x509 -req -days ${validity_days} -in ${account_name}.csr -signkey ${priv_key_name}.nopass.rsakey -sha256 -out ${account_name}.crt -extensions smime -extfile ${certificate_config_filename}
+$openssl_bin req -outform PEM -out ${account_name}.pem -key ${priv_key_name}.nopass.rsakey -keyform PEM -x509 -nodes -batch -days $validity_days -config $certificate_config_filename -pkeyopt rsa_keygen_bits:2048 -sha256
 
 echo "Generating .p12 file with certificate and private key..."
-$openssl_bin pkcs12 -export -in ${account_name}.crt -inkey ${priv_key_name}.nopass.rsakey -out ${account_name}.p12
+$openssl_bin pkcs12 -export -in ${account_name}.pem -inkey ${priv_key_name}.nopass.rsakey -out ${account_name}.p12

Diff for: src/test/resources/alice.p12

@@ -11,17 +11,12 @@ certificate_config_filename="${account_name}.cnf"
 validity_days=1825 # Five years, so the tests won't fail too soon.
 
 echo "Generating private RSASSA-PSS key"
-$openssl_bin genpkey -algorithm rsa-pss -pkeyopt rsa_keygen_bits:4096 -pkeyopt rsa_keygen_pubexp:65537 -pkeyopt rsa_pss_keygen_mgf1_md:sha256 -pkeyopt rsa_pss_keygen_saltlen:32 -out ${priv_key_name}.rsapsskey
+$openssl_bin genpkey -algorithm rsa-pss -pkeyopt rsa_keygen_bits:4096 -pkeyopt rsa_keygen_pubexp:65537 -pkeyopt rsa_pss_keygen_md:sha256 -pkeyopt rsa_pss_keygen_mgf1_md:sha256 -pkeyopt rsa_pss_keygen_saltlen:32 -out ${priv_key_name}.rsapsskey
 ### Save the private key without password protection
 $openssl_bin rsa -in ${priv_key_name}.rsapsskey -out ${priv_key_name}.nopass.rsapsskey
 
-echo "Issue certificate signing request (CSR) for the RSASSA-PSS key with parameters in ${certificate_config_filename}"
-$openssl_bin req -new -key ${priv_key_name}.nopass.rsapsskey -sha256 -out ${account_name}.csr -config ${certificate_config_filename}
-echo "Content of the certificate signing request:"
-$openssl_bin req -text -noout -in ${account_name}.csr
-
 echo "Generating self-signed certificate..."
-$openssl_bin x509 -req -days ${validity_days} -in ${account_name}.csr -signkey ${priv_key_name}.nopass.rsapsskey -sha256 -out ${account_name}.crt -extensions smime -extfile ${certificate_config_filename}
+$openssl_bin req -outform PEM -out ${account_name}.pem -key ${priv_key_name}.nopass.rsapsskey -keyform PEM -x509 -nodes -batch -days $validity_days -config $certificate_config_filename -pkeyopt rsa_keygen_bits:4096 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:32 -sigopt rsa_mgf1_md:sha256 -sha256
 
 echo "Generating .p12 file with certificate and private key..."
-$openssl_bin pkcs12 -export -in ${account_name}.crt -inkey ${priv_key_name}.nopass.rsapsskey -out ${account_name}.p12
+$openssl_bin pkcs12 -export -in ${account_name}.pem -inkey ${priv_key_name}.nopass.rsapsskey -out ${account_name}.p12

Diff for: src/test/resources/bob-certgen-rsa.sh

@@ -1,6 +1,7 @@
 [ req ]
 default_bits            = 4096
 distinguished_name      = req_distinguished_name
+x509_extensions         = x509_ext
 string_mask = utf8only
 
 [ req_distinguished_name ]
@@ -21,15 +22,13 @@ emailAddress                    = Email Address
 emailAddress_default            = [email protected]
 emailAddress_max                = 64
 
-[ usr_cert ]
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer
-subjectAltName=email:move
+# Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
+[ x509_ext ]
 
-[ smime ]
-basicConstraints = CA:FALSE
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment
-extendedKeyUsage = emailProtection
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always, issuer
-subjectAltName = email:copy
+subjectKeyIdentifier            = hash
+authorityKeyIdentifier          = keyid,issuer
+
+basicConstraints                = CA:FALSE
+keyUsage                        = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
+extendedKeyUsage                = clientAuth, emailProtection
+#subjectAltName                 = email:copy