istio.io/istio@v0.0.0-20240520182934-d79c90f27776/tests/testdata/certs/generate.sh (about)

     1  #!/bin/bash
     2  
     3  # Copyright 2018 Istio Authors
     4  #
     5  # Licensed under the Apache License, Version 2.0 (the "License");
     6  # you may not use this file except in compliance with the License.
     7  # You may obtain a copy of the License at
     8  #
     9  #     http:#www.apache.org/licenses/LICENSE-2.0
    10  #
    11  # Unless required by applicable law or agreed to in writing, software
    12  # distributed under the License is distributed on an "AS IS" BASIS,
    13  # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    14  # See the License for the specific language governing permissions and
    15  # limitations under the License.
    16  
    17  # Generates certificates used for testing
    18  # We generate a cert for a workload (ns=default, sa=default) and control plane
    19  WD=$(dirname "$0")
    20  WD=$(cd "$WD"; pwd)
    21  
    22  set -ex
    23  
    24  touch "${WD}/index.txt"
    25  
    26  cat > "${WD}/client.conf" <<EOF
    27  [req]
    28  req_extensions = v3_req
    29  distinguished_name = req_distinguished_name
    30  [req_distinguished_name]
    31  [ v3_req ]
    32  basicConstraints = CA:FALSE
    33  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
    34  extendedKeyUsage = clientAuth, serverAuth
    35  subjectAltName = @alt_names
    36  [alt_names]
    37  URI = spiffe://cluster.local/ns/default/sa/default
    38  EOF
    39  
    40  cat > "${WD}/dns-client.conf" <<EOF
    41  [req]
    42  req_extensions = v3_req
    43  distinguished_name = req_distinguished_name
    44  [req_distinguished_name]
    45  [ v3_req ]
    46  basicConstraints = CA:FALSE
    47  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
    48  extendedKeyUsage = clientAuth, serverAuth
    49  subjectAltName = @alt_names
    50  [alt_names]
    51  DNS = server.default.svc
    52  EOF
    53  
    54  cat > "${WD}/server.conf" <<EOF
    55  [req]
    56  req_extensions = v3_req
    57  distinguished_name = req_distinguished_name
    58  [req_distinguished_name]
    59  [ v3_req ]
    60  basicConstraints = CA:FALSE
    61  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
    62  extendedKeyUsage = clientAuth, serverAuth
    63  subjectAltName = @alt_names
    64  [alt_names]
    65  URI = spiffe://cluster.local/ns/istio-system/sa/istio-pilot-service-account
    66  DNS.1 = istiod.istio-system
    67  DNS.2 = istiod.istio-system.svc
    68  DNS.3 = istio-pilot.istio-system
    69  DNS.4 = istio-pilot.istio-system.svc
    70  DNS.5 = localhost
    71  EOF
    72  
    73  
    74  cat > "${WD}/mountedcerts-server.conf" <<EOF
    75  [req]
    76  req_extensions = v3_req
    77  distinguished_name = req_distinguished_name
    78  [req_distinguished_name]
    79  [ v3_req ]
    80  basicConstraints = CA:FALSE
    81  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
    82  extendedKeyUsage = clientAuth, serverAuth
    83  subjectAltName = @alt_names
    84  [alt_names]
    85  URI = spiffe://cluster.local/ns/mounted-certs/sa/server
    86  DNS = server.mounted-certs.svc
    87  EOF
    88  
    89  cat > "${WD}/mountedcerts-client.conf" <<EOF
    90  [req]
    91  req_extensions = v3_req
    92  distinguished_name = req_distinguished_name
    93  [req_distinguished_name]
    94  [ v3_req ]
    95  basicConstraints = CA:FALSE
    96  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
    97  extendedKeyUsage = clientAuth, serverAuth
    98  subjectAltName = @alt_names
    99  [alt_names]
   100  URI = spiffe://cluster.local/ns/mounted-certs/sa/client
   101  DNS = client.mounted-certs.svc
   102  EOF
   103  
   104  cat > "${WD}/crl.conf" <<EOF
   105  [ ca ]
   106  default_ca      = CA_default            # The default ca section
   107  
   108  [ CA_default ]
   109  dir             = "${WD}"         # Where everything is kept
   110  database        = "${WD}/index.txt"    # database index file.
   111  certificate     = "${WD}/pilot/ca-cert.pem"    # The CA certificate
   112  private_key     = "${WD}/pilot/ca-key.pem"    # The private key
   113  
   114  # crlnumber must also be commented out to leave a V1 CRL.
   115  crl_extensions = crl_ext
   116  
   117  default_md      = sha256                # use SHA-256 by default
   118  default_crl_days= 3650                  # how long before next CRL
   119  
   120  [ crl_ext ]
   121  # CRL extensions.
   122  # Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
   123  authorityKeyIdentifier=keyid:always
   124  [req]
   125  req_extensions = v3_req
   126  distinguished_name = req_distinguished_name
   127  [req_distinguished_name]
   128  [ v3_req ]
   129  basicConstraints = CA:FALSE
   130  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   131  extendedKeyUsage = clientAuth, serverAuth
   132  subjectAltName = @alt_names
   133  [alt_names]
   134  DNS = cluster.local
   135  EOF
   136  
   137  # Create a certificate authority
   138  openssl genrsa -out "${WD}/pilot/ca-key.pem" 2048
   139  openssl req -x509 -new -nodes -key "${WD}/pilot/ca-key.pem" -days 100000 -out "${WD}/pilot/root-cert.pem" -subj "/CN=cluster.local"
   140  cp "${WD}/pilot/root-cert.pem" "${WD}/default/root-cert.pem"
   141  cp "${WD}/pilot/root-cert.pem" "${WD}/dns/root-cert.pem"
   142  cp "${WD}/pilot/root-cert.pem" "${WD}/pilot/ca-cert.pem"
   143  cp "${WD}/pilot/root-cert.pem" "${WD}/mountedcerts-server/root-cert.pem"
   144  cp "${WD}/pilot/root-cert.pem" "${WD}/mountedcerts-client/root-cert.pem"
   145  
   146  # Create a server certificate
   147  openssl genrsa -out "${WD}/pilot/key.pem" 2048
   148  openssl req -new -sha256 -key "${WD}/pilot/key.pem" -out "${WD}/server.csr" -subj "/CN=istiod.istio-system.svc.cluster.local" -config "${WD}/server.conf"
   149  openssl x509 -req -in "${WD}/server.csr" -CA "${WD}/pilot/root-cert.pem" -CAkey "${WD}/pilot/ca-key.pem" -CAcreateserial -out "${WD}/pilot/cert-chain.pem"  -days 100000 -extensions v3_req -extfile "${WD}/server.conf"
   150  
   151  # Create a client certificate
   152  openssl genrsa -out "${WD}/default/key.pem" 2048
   153  openssl req -new -sha256 -key "${WD}/default/key.pem" -out "${WD}/client.csr" -subj "/CN=default.default.svc.cluster.local" -config "${WD}/client.conf"
   154  openssl x509 -req -in "${WD}/client.csr" -CA "${WD}/pilot/root-cert.pem" -CAkey "${WD}/pilot/ca-key.pem" -CAcreateserial -out "${WD}/default/cert-chain.pem" -days 100000 -extensions v3_req -extfile "${WD}/client.conf"
   155  
   156  # Create a DNS client certificate
   157  openssl genrsa -out "${WD}/dns/key.pem" 2048
   158  openssl req -new -sha256 -key "${WD}/dns/key.pem" -out "${WD}/dns-client.csr" -subj "/CN=server.default.svc.cluster.local" -config "${WD}/dns-client.conf"
   159  openssl x509 -req -in "${WD}/dns-client.csr" -CA "${WD}/pilot/root-cert.pem" -CAkey "${WD}/pilot/ca-key.pem" -CAcreateserial -out "${WD}/dns/cert-chain.pem" -days 100000 -extensions v3_req -extfile "${WD}/dns-client.conf"
   160  
   161  # Create a server certificate for MountedCerts test
   162  openssl genrsa -out "${WD}/mountedcerts-server/key.pem" 2048
   163  openssl req -new -sha256 -key "${WD}/mountedcerts-server/key.pem" -out "${WD}/mountedcerts-server.csr" -subj "/CN=server.mounted-certs.svc.cluster.local" -config "${WD}/mountedcerts-server.conf"
   164  openssl x509 -req -in "${WD}/mountedcerts-server.csr" -CA "${WD}/pilot/root-cert.pem" -CAkey "${WD}/pilot/ca-key.pem" -CAcreateserial -out "${WD}/mountedcerts-server/cert-chain.pem" -days 100000 -extensions v3_req -extfile "${WD}/mountedcerts-server.conf"
   165  
   166  # Create a client certificate for MountedCerts test
   167  openssl genrsa -out "${WD}/mountedcerts-client/key.pem" 2048
   168  openssl req -new -sha256 -key "${WD}/mountedcerts-client/key.pem" -out "${WD}/mountedcerts-client.csr" -subj "/CN=client.mounted-certs.svc.cluster.local" -config "${WD}/mountedcerts-client.conf"
   169  openssl x509 -req -in "${WD}/mountedcerts-client.csr" -CA "${WD}/pilot/root-cert.pem" -CAkey "${WD}/pilot/ca-key.pem" -CAcreateserial -out "${WD}/mountedcerts-client/cert-chain.pem" -days 100000 -extensions v3_req -extfile "${WD}/mountedcerts-client.conf"
   170  
   171  # revoke one of the server certificates for CRL testing purpose
   172  openssl ca -config "${WD}/crl.conf" -revoke "${WD}/dns/cert-chain.pem"
   173  openssl ca -gencrl -out "${WD}/ca.crl" -config "${WD}/crl.conf"
   174  
   175  # remove the database entry for the previous revoked certificate, so that we can generate a new dummy CRL entry for an unused server cert,
   176  # to be used for integration tests
   177  cat /dev/null > "${WD}/index.txt"
   178  
   179  openssl x509 -req -in "${WD}/server.csr" -CA "${WD}/pilot/root-cert.pem" -CAkey "${WD}/pilot/ca-key.pem" -CAcreateserial -out "${WD}/dns/cert-chain-unused.pem"  -days 100000 -extensions v3_req -extfile "${WD}/server.conf"
   180  
   181  openssl ca -config "${WD}/crl.conf" -revoke "${WD}/dns/cert-chain-unused.pem"
   182  openssl ca -gencrl -out "${WD}/dummy.crl" -config "${WD}/crl.conf"
   183  
   184  rm "${WD}/server.conf" "${WD}/client.conf" "${WD}/dns-client.conf" "${WD}/crl.conf"
   185  rm "${WD}/server.csr" "${WD}/client.csr" "${WD}/dns-client.csr"
   186  rm "${WD}/mountedcerts-server.conf" "${WD}/mountedcerts-server.csr"
   187  rm "${WD}/mountedcerts-client.conf" "${WD}/mountedcerts-client.csr"
   188  rm "${WD}"/index.txt*