1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
#include <fstream>
#include <sstream>
#include <boost/filesystem.hpp>
#include <boost/algorithm/string.hpp>
#include "crypt_chain.h"
using std::string;
using std::ofstream;
using std::ifstream;
using std::stringstream;
void
libdcp::make_crypt_chain (string directory)
{
boost::filesystem::current_path (directory);
system ("openssl genrsa -out ca.key 2048");
{
ofstream f ("ca.cnf");
f << "[ req ]\n"
<< "distinguished_name = req_distinguished_name\n"
<< "x509_extensions = v3_ca\n"
<< "[ v3_ca ]\n"
<< "basicConstraints = critical,CA:true,pathlen:3\n"
<< "keyUsage = keyCertSign,cRLSign\n"
<< "subjectKeyIdentifier = hash\n"
<< "authorityKeyIdentifier = keyid:always,issuer:always\n"
<< "[ req_distinguished_name ]\n"
<< "O = Unique organization name\n"
<< "OU = Organization unit\n"
<< "CN = Entity and dnQualifier\n";
}
system ("openssl rsa -outform PEM -pubout -in ca.key | openssl base64 -d | dd bs=1 skip=24 2>/dev/null | openssl sha1 -binary | openssl base64 > ca_dnq");
string ca_dnq;
{
ifstream f ("ca_dnq");
getline (f, ca_dnq);
boost::replace_all (ca_dnq, "/", "\\/");
}
string const ca_subject = "/O=example.org/OU=example.org/CN=.smpte-430-2.ROOT.NOT_FOR_PRODUCTION/dnQualifier=" + ca_dnq;
{
stringstream c;
c << "openssl req -new -x509 -sha256 -config ca.cnf -days 3650 -set_serial 5 -subj " << ca_subject << " -key ca.key -outform PEM -out ca.self-signed.pem";
system (c.str().c_str());
}
system ("openssl genrsa -out intermediate.key 2048");
{
ofstream f ("intermediate.cnf");
f << "[ default ]\n"
<< "distinguished_name = req_distinguished_name\n"
<< "x509_extensions = v3_ca\n"
<< "[ v3_ca ]\n"
<< "basicConstraints = critical,CA:true,pathlen:2\n"
<< "keyUsage = keyCertSign,cRLSign\n"
<< "subjectKeyIdentifier = hash\n"
<< "authorityKeyIdentifier = keyid:always,issuer:always\n"
<< "[ req_distinguished_name ]\n"
<< "O = Unique organization name\n"
<< "OU = Organization unit\n"
<< "CN = Entity and dnQualifier\n";
}
system ("openssl rsa -outform PEM -pubout -in intermediate.key | openssl base64 -d | dd bs=1 skip=24 2>/dev/null | openssl sha1 -binary | openssl base64 > inter_dnq");
string inter_dnq;
{
ifstream f ("inter_dnq");
getline (f, inter_dnq);
boost::replace_all (inter_dnq, "/", "\\/");
}
string const inter_subject = "/O=example.org/OU=example.org/CN=.smpte-430-2.INTERMEDIATE.NOT_FOR_PRODUCTION/dnQualifier=" + inter_dnq;
{
stringstream s;
s << "openssl req -new -config intermediate.cnf -days 3649 -subj " << inter_subject << " -key intermediate.key -out intermediate.csr";
system (s.str().c_str());
}
system ("openssl x509 -req -sha256 -days 3649 -CA ca.self-signed.pem -CAkey ca.key -set_serial 6 -in intermediate.csr -extfile intermediate.cnf -extensions v3_ca -out intermediate.signed.pem");
system ("openssl genrsa -out leaf.key 2048");
{
ofstream f ("leaf.cnf");
f << "[ default ]\n"
<< "distinguished_name = req_distinguished_name\n"
<< "x509_extensions = v3_ca\n"
<< "[ v3_ca ]\n"
<< "basicConstraints = critical,CA:false\n"
<< "keyUsage = digitalSignature,keyEncipherment\n"
<< "subjectKeyIdentifier = hash\n"
<< "authorityKeyIdentifier = keyid,issuer:always\n"
<< "[ req_distinguished_name ]\n"
<< "O = Unique organization name\n"
<< "OU = Organization unit\n"
<< "CN = Entity and dnQualifier\n";
}
system ("openssl rsa -outform PEM -pubout -in leaf.key | openssl base64 -d | dd bs=1 skip=24 2>/dev/null | openssl sha1 -binary | openssl base64 > leaf_dnq");
string leaf_dnq;
{
ifstream f ("leaf_dnq");
getline (f, leaf_dnq);
boost::replace_all (leaf_dnq, "/", "\\/");
}
string const leaf_subject = "/O=example.org/OU=example.org/CN=CS.smpte-430-2.LEAF.NOT_FOR_PRODUCTION/dnQualifier=" + leaf_dnq;
{
stringstream s;
s << "openssl req -new -config leaf.cnf -days 3648 -subj " << leaf_subject << " -key leaf.key -outform PEM -out leaf.csr";
system (s.str().c_str());
}
system ("openssl x509 -req -sha256 -days 3648 -CA intermediate.signed.pem -CAkey intermediate.key -set_serial 7 -in leaf.csr -extfile leaf.cnf -extensions v3_ca -out leaf.signed.pem");
}
|
