testing: Script building fresh certificates

testing/hosts/winnetou/etc/apache2/sites-enabled/001-ocsp_vhost.conf

@@ -6,11 +6,11 @@ AddHandler cgi-script .cgi
 
 <VirtualHost *:8880>
     ServerAdmin  [email protected]
-    DocumentRoot /etc/openssl/ocsp
+    DocumentRoot /etc/ca/ocsp
     ServerName   ocsp.strongswan.org
     ServerAlias	 192.168.0.150
     DirectoryIndex ocsp.cgi
-    <Directory "/etc/openssl/ocsp">
+    <Directory "/etc/ca/ocsp">
         Options  +ExecCGI
         Require all granted
    </Directory>
@@ -22,11 +22,11 @@ Listen 8881
 
 <VirtualHost *:8881>
     ServerAdmin  [email protected]
-    DocumentRoot /etc/openssl/research/ocsp
+    DocumentRoot /etc/ca/research/ocsp
     ServerName   ocsp.research.strongswan.org
     ServerAlias	 ocsp.strongswan.org 192.168.0.150
     DirectoryIndex ocsp.cgi
-    <Directory "/etc/openssl/research/ocsp">
+    <Directory "/etc/ca/research/ocsp">
         Options +ExecCGI
         Require all granted
    </Directory>
@@ -38,11 +38,11 @@ Listen 8882
 
 <VirtualHost *:8882>
     ServerAdmin  [email protected]
-    DocumentRoot /etc/openssl/sales/ocsp
+    DocumentRoot /etc/ca/sales/ocsp
     ServerName   ocsp.sales.strongswan.org
     ServerAlias	 ocsp.strongswan.org 192.168.0.150
     DirectoryIndex ocsp.cgi
-    <Directory "/etc/openssl/sales/ocsp">
+    <Directory "/etc/ca/sales/ocsp">
         Options +ExecCGI
         Require all granted
    </Directory>

testing/hosts/winnetou/etc/ca/generate-crl

@@ -0,0 +1,133 @@
+#!/bin/bash
+
+export LEAK_DETECTIVE_DISABLE=1
+
+ROOT="/var/www"
+
+##
+# strongSwan Root CA
+cd /etc/ca
+
+# copy strongsSwan CA certificate
+cp strongswanCert.pem ${ROOT}
+cp strongswanCert.der ${ROOT}
+
+# generate CRL for strongSwan Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --lastcrl strongswan.crl > ${ROOT}/strongswan.crl
+
+# revoke moon's current certificate
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --reason key-compromise --serial 03 \
+    --lastcrl ${ROOT}/strongswan.crl > ${ROOT}/strongswan_moon_revoked.crl
+
+# generate a base CRL
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --crluri http://crl.strongswan.org/strongswan_delta.crl \
+    --lastcrl strongswan.crl --lifetime 30 > ${ROOT}/strongswan_base.crl
+
+# generate a delta CRL revoking moon's current cert
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --basecrl ${ROOT}/strongswan_base.crl --reason key-compromise \
+    --serial 03 --lifetime 15 > ${ROOT}/strongswan_delta.crl
+
+# generate Hash-and-URL certificates
+CERTS_DIR="${ROOT}/certs"
+for cert in `ls certs`
+do
+  openssl x509 -in certs/${cert} -outform der -out ${CERTS_DIR}/cert.der
+  mv ${CERTS_DIR}/cert.der ${CERTS_DIR}/`sha1sum ${CERTS_DIR}/cert.der | head -c 40`
+done
+
+##
+# Research CA
+cd /etc/ca/research
+
+# copy Research CA certificate
+cp researchCert.pem ${ROOT}
+cp researchCert.der ${ROOT}
+
+# generate CRL for Research CA
+pki --signcrl --cakey researchKey.pem --cacert researchCert.pem \
+    > ${ROOT}/research.crl
+
+# generate Hash-and-URL certificates
+CERTS_DIR="${ROOT}/certs/research"
+for cert in `ls certs`
+do
+  openssl x509 -in certs/${cert} -outform der -out ${CERTS_DIR}/cert.der
+  mv ${CERTS_DIR}/cert.der ${CERTS_DIR}/`sha1sum ${CERTS_DIR}/cert.der | head -c 40`
+done
+
+##
+# Sales CA
+cd /etc/ca/sales
+
+# copy Sales CA certificate
+cp salesCert.pem ${ROOT}
+cp salesCert.der ${ROOT}
+
+# generate CRL for Sales CA
+pki --signcrl --cakey salesKey.pem --cacert salesCert.pem \
+    > ${ROOT}/sales.crl
+
+# generate Hash-and-URL certificates
+CERTS_DIR="${ROOT}/certs/sales"
+for cert in `ls certs`
+do
+  openssl x509 -in certs/${cert} -outform der -out ${CERTS_DIR}/cert.der
+  mv ${CERTS_DIR}/cert.der ${CERTS_DIR}/`sha1sum ${CERTS_DIR}/cert.der | head -c 40`
+done
+
+##
+# strongSwan EC Root CA
+cd /etc/ca/ecdsa
+
+# copy ECDSA CA certificate
+cp strongswanCert.pem ${ROOT}/strongswan_ecdsaCert.pem
+openssl ec -in strongswanKey.pem -outform der -out ${ROOT}/strongswan_ecdsaCert.der
+chmod a+r ${ROOT}/strongswan_ecdsaCert.der
+
+# generate CRL for strongSwan EC Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    > ${ROOT}/strongswan_ecdsa.crl
+
+##
+# strongSwan RFC3779 Root CA
+cd /etc/ca/rfc3779
+
+# generate CRL for strongSwan RFC3779 Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    > ${ROOT}/strongswan_rfc3779.crl
+
+##
+# strongSwan SHA3-RSA Root CA
+cd /etc/ca/sha3-rsa
+
+# generate CRL for strongSwan SHA3-RSA Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    --digest sha3_256 > ${ROOT}/strongswan_sha3_rsa.crl
+
+##
+# strongSwan Ed25519 Root CA
+cd /etc/ca/ed25519
+
+# generate CRL for strongSwan Ed25519 Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    > ${ROOT}/strongswan_ed25519.crl
+
+##
+# strongSwan Monster Root CA
+cd /etc/ca/monster
+
+# generate CRL for strongSwan Monster Root CA
+pki --signcrl --cakey strongswanKey.pem --cacert strongswanCert.pem \
+    > ${ROOT}/strongswan_monster.crl
+
+##
+# strongSwan BlISS Root CA
+cd /etc/ca/bliss
+
+# generate CRL for strongSwan BLISS Root CA
+pki --signcrl --cakey strongswan_blissKey.der --cacert strongswan_blissCert.der \
+    --lifetime 30 --digest sha3_512 > ${ROOT}/strongswan_bliss.crl

testing/hosts/winnetou/etc/ca/index.html

@@ -0,0 +1,58 @@
+<html>
+<head>
+  <title>strongSwan Web Services</title>
+  <base target="_self">
+</head>
+
+<body bgcolor="#FFFFFF">
+<table border=0 cellpadding=0 cellspacing=0 width=600>
+
+<tr><td>
+  <h2>strongSwan Testing Environment</h2>
+  <ul>
+    <li>
+      <a href="testresults/">Test Results</a>
+    </li>
+  </ul>
+  <a href="images/umlArchitecture_large.png" target="_blank">
+    <img src="images/umlArchitecture_small.png" border="0">
+  </a>
+
+    <h2>strongSwan Certification Authorities</h2>
+  <ul>
+    <li>
+      <bold>Root CA: </bold>
+      <a href="strongswanCert.pem">PEM</a> ,
+      <a href="strongswanCert.der">DER</a> ,
+      <a href="strongswan.crl">CRL</a>
+    </li>
+  </ul>
+  <ul>
+    <li>
+      <bold>Research CA: </bold>
+      <a href="researchCert.pem">PEM</a> ,
+      <a href="researchCert.der">DER</a> ,
+      <a href="research.crl">CRL</a>
+    </li>
+  </ul>
+  <ul>
+    <li>
+      <bold>Sales CA: </bold>
+       <a href="salesCert.pem">PEM</a> ,
+      <a href="salesCert.der">DER</a> ,
+      <a href="sales.crl">CRL</a>
+    </li>
+  </ul>
+  <ul>
+    <li>
+      <bold>ECDSA CA: </bold>
+      <a href="strongswan_ecdsaCert.pem">PEM</a> ,
+      <a href="strongswan_ecdsaCert.der">DER</a> ,
+     <a href="strongswan_ecdsa.crl">CRL</a>
+    </li>
+  </ul>
+  <hr>
+  <address>The strongSwan Project (<a href="https://www.strongswan.org">www.strongswan.org</a>)</address>
+</td></tr>
+</table>
+</body>

testing/hosts/winnetou/etc/ca/index.txt.template

@@ -0,0 +1,22 @@
+V	EE_EXPIRATION		01	unknown	/C=CH/O=strongSwan Project/OU=Research/[email protected]
+V	EE_EXPIRATION		02	unknown	/C=CH/O=strongSwan Project/OU=Accounting/[email protected]
+V	EE_EXPIRATION		03	unknown	/C=CH/O=strongSwan Project/CN=moon.strongswan.org
+V	EE_EXPIRATION		04	unknown	/C=CH/O=strongSwan Project/CN=sun.strongswan.org
+V	EE_EXPIRATION		05	unknown	/C=CH/O=strongSwan Project/OU=Sales/[email protected]
+V	EE_EXPIRATION		06	unknown	/C=CH/O=strongSwan Project/CN=venus.strongswan.org
+V	EE_EXPIRATION		07	unknown	/C=CH/O=strongSwan Project/OU=Research/[email protected]
+R	EE_EXPIRATION	REVOCATION,keyCompromise	08	unknown	/C=CH/O=strongSwan Project/OU=Research/[email protected]
+V	EE_EXPIRATION		09	unknown	/C=CH/O=strongSwan Project/OU=Research/serialNumber=002/[email protected]
+R	IM_EXPIRATION	REVOCATION,CACompromise	0A	unknown	/C=CH/O=strongSwan Project/OU=Research/CN=Research CA
+V	IM_EXPIRATION		0B	unknown	/C=CH/O=strongSwan Project/OU=Research/CN=Research CA
+V	IM_EXPIRATION		0C	unknown	/C=CH/O=strongSwan Project/OU=Sales/CN=Sales CA
+V	EE_EXPIRATION		0D	unknown	/C=CH/O=strongSwan Project/OU=SHA-224/CN=moon.strongswan.org
+V	EE_EXPIRATION		0E	unknown	/C=CH/O=strongSwan Project/OU=SHA-384/[email protected]
+V	EE_EXPIRATION		0F	unknown	/C=CH/O=strongSwan Project/OU=SHA-512/[email protected]
+V	EE_EXPIRATION		10	unknown	/C=CH/O=strongSwan Project/OU=OCSP/[email protected]
+V	EE_EXPIRATION		11	unknown	/C=CH/O=strongSwan Project/OU=OCSP Signing Authority/CN=ocsp.strongswan.org
+V	EE_EXPIRATION		12	unknown	/C=CH/O=strongSwan Project/OU=Virtual VPN Gateway/CN=mars.strongswan.org
+V	EE_EXPIRATION		13	unknown	/C=CH/O=strongSwan Project/CN=winnetou.strongswan.org
+V	EE_EXPIRATION		14	unknown	/C=CH/O=strongSwan Project/CN=aaa.strongswan.org
+V	IM_EXPIRATION		15	unknown	/C=CH/O=strongSwan Project/CN=strongSwan Attribute Authority
+V	SH_EXPIRATION		16	unknown	/C=CH/O=strongSwan Project/CN=strongSwan Legacy AA

testing/hosts/winnetou/etc/ca/ocsp/ocsp.cgi

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/ca
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+	-rkey ocspKey.pem -rsigner ocspCert.pem \
+	-nmin 5 \
+	-reqin /dev/stdin -respout /dev/stdout | cat

testing/hosts/winnetou/etc/ca/research/index.txt.template

@@ -0,0 +1,4 @@
+V	EE_EXPIRATION		01	unknown	/C=CH/O=strongSwan Project/OU=Research/[email protected]
+V	EE_EXPIRATION		02	unknown	/C=CH/O=strongSwan Project/OU=Research OCSP Signing Authority/CN=ocsp.research.strongswan.org
+V	EE_EXPIRATION		03	unknown	/C=CH/O=strongSwan Project/OU=Sales/CN=Sales CA
+V	EE_EXPIRATION		04	unknown	/C=CH/O=strongSwan Project/OU=Research/CN=Duck Research CA

testing/hosts/winnetou/etc/ca/research/ocsp/ocsp.cgi

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/ca/research
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+cat | /usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \
+	-rkey ocspKey.pem -rsigner ocspCert.pem \
+	-nmin 5 \
+	-reqin /dev/stdin -respout /dev/stdout | cat

testing/hosts/winnetou/etc/ca/sales/index.txt.template

@@ -0,0 +1,3 @@
+V	EE_EXPIRATION		01	unknown	/C=CH/O=strongSwan Project/OU=Sales/[email protected]
+V	EE_EXPIRATION		02	unknown	/C=CH/O=strongSwan Project/OU=Sales OCSP Signing Authority/CN=ocsp.sales.strongswan.org
+V	EE_EXPIRATION		03	unknown	/C=CH/O=strongSwan Project/OU=Research/CN=Research CA

testing/hosts/winnetou/etc/ca/sales/ocsp/ocsp.cgi

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/ca/sales
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+cat | /usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \
+	-rkey ocspKey.pem -rsigner ocspCert.pem \
+	-nmin 5 \
+	-reqin /dev/stdin -respout /dev/stdout | cat

testing/hosts/winnetou/etc/ldap/ldif.txt

@@ -1,39 +1,39 @@
-dn: o=Linux strongSwan, c=CH
+dn: o=strongSwan Project, c=CH
 objectclass: organization
-o: Linux strongSwan
+o: strongSwan Project
 
-dn: cn=Manager,o=Linux strongSwan, c=CH
+dn: cn=Manager,o=strongSwan Project, c=CH
 objectclass: organizationalRole
 cn: Manager
 
-dn: cn=strongSwan Root CA, o=Linux strongSwan, c=CH
+dn: cn=strongSwan Root CA, o=strongSwan Project, c=CH
 objectClass: organizationalRole
 cn: strongSwan Root CA
 objectClass: certificationAuthority
-authorityRevocationList;binary:< file:///etc/openssl/strongswan.crl
-certificateRevocationList;binary:< file:///etc/openssl/strongswan.crl
-cACertificate;binary:< file:///etc/openssl/strongswanCert.der
+authorityRevocationList;binary:< file:///var/www/strongswan.crl
+certificateRevocationList;binary:< file:///var/www/strongswan.crl
+cACertificate;binary:< file:///var/www/strongswanCert.der
 
-dn: ou=Research, o=Linux strongSwan, c=CH
+dn: ou=Research, o=strongSwan Project, c=CH
 objectclass: organizationalUnit
 ou: Research
 
-dn: cn=Research CA, ou=Research, o=Linux strongSwan, c=CH
+dn: cn=Research CA, ou=Research, o=strongSwan Project, c=CH
 objectClass: organizationalRole
 cn: Research CA
 objectClass: certificationAuthority
-authorityRevocationList;binary:< file:///etc/openssl/research/research.crl
-certificateRevocationList;binary:< file:///etc/openssl/research/research.crl
-cACertificate;binary:< file:///etc/openssl/research/researchCert.der
+authorityRevocationList;binary:< file:///var/www/research.crl
+certificateRevocationList;binary:< file:///var/www/research.crl
+cACertificate;binary:< file:///var/www/researchCert.der
 
-dn: ou=Sales, o=Linux strongSwan, c=CH
+dn: ou=Sales, o=strongSwan Project, c=CH
 objectclass: organizationalUnit
 ou: Sales
 
-dn: cn=Sales CA, ou=Sales, o=Linux strongSwan, c=CH
+dn: cn=Sales CA, ou=Sales, o=strongSwan Project, c=CH
 objectClass: organizationalRole
 cn: Sales CA
 objectClass: certificationAuthority
-authorityRevocationList;binary:< file:///etc/openssl/sales/sales.crl
-certificateRevocationList;binary:< file:///etc/openssl/sales/sales.crl
-cACertificate;binary:< file:///etc/openssl/sales/salesCert.der
+authorityRevocationList;binary:< file:///var/www/sales.crl
+certificateRevocationList;binary:< file:///var/www/sales.crl
+cACertificate;binary:< file:///var/www/salesCert.der

testing/hosts/winnetou/etc/ldap/slapd.conf

@@ -15,8 +15,8 @@ argsfile	/var/run/openldap/slapd.args
 #######################################################################
 
 database	bdb
-suffix		"o=Linux strongSwan,c=CH"
-rootdn		"cn=Manager,o=Linux strongSwan,c=CH"
+suffix		"o=strongSwan Project,c=CH"
+rootdn		"cn=Manager,o=strongSwan Project,c=CH"
 checkpoint	32	30
 rootpw		tuxmux
 directory	/var/lib/ldap

testing/hosts/winnetou/etc/openssl/index.html

@@ -1,36 +0,0 @@
-<html>
-<head>
-  <title>strongSwan Web Services</title>
-  <base target="_self">
-</head>
-
-<body bgcolor="#FFFFFF">
-<table border=0 cellpadding=0 cellspacing=0 width=600>
-
-<tr><td>
-  <h2>strongSwan Certification Authority</h2>
-  <ul>
-    <li>
-      <a href="strongswanCert.pem">Root CA Certificate</a>
-    </li>
-  </ul>
-  <ul>
-    <li>
-      <a href="strongswan.crl">Certificate Revocation List (CRL)</a>
-    </li>
-  </ul>
-
-  <h2>strongSwan Testing Environment</h2>
-  <ul>
-    <li>
-      <a href="testresults/">Test Results</a>
-    </li>
-  </ul>
-  <a href="images/umlArchitecture_large.png" target="_blank">
-    <img src="images/umlArchitecture_small.png" border="0">
-  </a>
-  <hr>
-  <address>Linux strongSwan (<a href="http://www.strongswan.org">www.strongswan.org</a>)</address>
-</td></tr>
-</table>
-</body>

testing/hosts/winnetou/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # strongswan.conf - strongSwan configuration file
 
 pki {
-  load = random pem sha1 sha2 sha3 pkcs1 pkcs8 pem gmp mgf1 bliss curve25519 x509
+  load = random pem sha1 sha2 sha3 pkcs1 pkcs8 pem gmp mgf1 bliss curve25519 x509 openssl
 }