Mit openssl zum self-signed certificate

eine demoCA ist nur ein “klick” enfernt:
-----------8<-----------8<-----------8<-----------8<-----------
#!/bin/sh
#mkcert.sh
#Sascha Teske 2011
BASEDIR=’./demoCA’
CACERT=“${BASEDIR}/certs/cacert.pem”
CAKEY=“ ${BASEDIR}/keys/cakey.pem”
mkdir ${BASEDIR}
mkdir ${BASEDIR}/keys
mkdir ${BASEDIR}/certs
mkdir ${BASEDIR}/crl
mkdir ${BASEDIR}/newcerts
echo ‘00’ > ./${BASEDIR}/serial
touch ./${BASEDIR}/index.txt
export OPENSSL_CONF=’./openssl.cnf’
openssl req -x509 -newkey rsa:2048 -out ${CACERT} -outform PEM -keyout ${CAKEY} -keyform PEM -nodes
openssl req -newkey rsa:1024 -nodes -keyout testkey.pem -keyform PEM -out testreq.pem -outform PEM
openssl ca -in testreq.pem
cp ${BASEDIR}/newcerts/00.pem testcert.pem
openssl verify -CAfile ${CACERT} testcert.pem
openssl verify -CAfile ${CACERT} -verbose testcert.pem
openssl verify -CAfile ${CACERT} -issuer_checks testcert.pem
openssl verify -CAfile ${CACERT} -purpose sslserver testcert.pem
openssl verify -CAfile ${CACERT} -purpose sslserver -verbose testcert.pem
----------->8----------->8----------->8----------->8-----------

-----------8<-----------8<-----------8<-----------8<-----------
#openssl.cnf
#Sascha Teske 2011
HOME = $ENV::PWD/demoCA
oid_section = new_oids
[ new_oids ]
[ ca ]
default_ca = CA_default
[ CA_default ]
dir = $HOME
certs = $dir/certs
crl_dir = $dir/crl
database = $dir/index.txt
new_certs_dir = $dir/newcerts
certificate = $certs/cacert.pem
serial = $dir/serial
crlnumber = $dir/crlnumber
crl = $dir/crl.pem
private_key = $dir/keys/cakey.pem
RANDFILE = $dir/keys/.rand
x509_extensions = usr_cert
name_opt = ca_default
cert_opt = ca_default
default_days = 365
default_crl_days= 30
default_md = sha1
preserve = no
policy = policy_match
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ req ]
default_bits = 1024
default_keyfile = key.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = v3_ca
string_mask = nombstr
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = DE
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Hamburg
localityName = Locality Name (eg, city)
localityName_default = Hamburg
0.organizationName = Organization Name (eg, company)
0.organizationName_default = DEMO
organizationalUnitName = Organizational Unit Name (eg, section)
commonName = Common Name (eg, YOUR name)
commonName_default = www.example.com
commonName_max = 64
emailAddress = Email Address
emailAddress_max = 64
[ req_attributes ]
challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20
unstructuredName = An optional company name
[ usr_cert ]
basicConstraints=CA:FALSE
nsComment = “for demonstrational purposes only”
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
[ v3_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
basicConstraints = CA:true
[ crl_ext ]
authorityKeyIdentifier=keyid:always,issuer:always
[ proxy_cert_ext ]
basicConstraints=CA:FALSE
nsComment = “for demonstrational purposes only”
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

----------->8----------->8----------->8----------->8-----------