START	lib/libcrypto/CA	2024-04-15T21:04:23Z

==== clean ====
rm -f a.out [Ee]rrs mklog *.core y.tab.h       *.pem *.serial *.txt *.attr *.old   stamp-clean stamp-root.serial stamp-intermediate.serial stamp-root.txt stamp-intermediate.txt

==== root.serial ====
echo 1000 >root.serial

==== intermediate.serial ====
echo 1000 >intermediate.serial

==== root.txt ====
true >root.txt

==== intermediate.txt ====
true >intermediate.txt

==== run-verify-intermediate ====
# generate root rsa 4096 key
openssl genrsa -out root.key.pem 4096
Generating RSA private key, 4096 bit long modulus
...............................................................................................................................
........................................................................
e is 65537 (0x010001)
# generate root cert
openssl req -batch -config /usr/src/regress/lib/libcrypto/CA/root.cnf -key root.key.pem  -new -x509 -days 365 -sha256 -extensions v3_ca -out root.cert.pem
# generate intermediate rsa 2048 key
openssl genrsa -out intermediate.key.pem 2048
Generating RSA private key, 2048 bit long modulus
...
...........................................
e is 65537 (0x010001)
# generate intermediate req
openssl req -batch -config /usr/src/regress/lib/libcrypto/CA/intermediate.cnf -new -sha256  -key intermediate.key.pem -out intermediate.csr.pem
# sign intermediate
openssl ca -batch -config /usr/src/regress/lib/libcrypto/CA/root.cnf  -extensions v3_intermediate_ca -days 10 -notext -md sha256  -in intermediate.csr.pem -out intermediate.cert.pem
Using configuration from /usr/src/regress/lib/libcrypto/CA/root.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 4096 (0x1000)
        Validity
            Not Before: Apr 15 21:04:28 2024 GMT
            Not After : Apr 25 21:04:28 2024 GMT
        Subject:
            countryName               = CA
            stateOrProvinceName       = Alberta
            organizationName          = OpenBSD
            organizationalUnitName    = So and Sos
            commonName                = Regress Intermediate CA
            emailAddress              = evilsoandsos@openbsd.org
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                07:49:35:01:E2:86:AD:C4:4A:9E:68:C5:1C:DE:53:12:0F:91:E0:57
            X509v3 Authority Key Identifier:
                keyid:2B:9B:EF:D2:A8:35:64:7E:45:3F:C8:2B:22:DA:C5:CB:FF:0B:80:1E

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Name Constraints: critical
                Permitted:
                  DNS:.openbsd.org
                  DNS:client
                  email:openbsd.org
                  email:@test.openbsd.org
                  URI:.openbsd.org
                  DirName: C = CA, O = OpenBSD
                  othername:<unsupported>
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0

Certificate is to be certified until Apr 25 21:04:28 2024 GMT (10 days)

Write out database with 1 new entries
Data Base Updated
# validate intermediate CA
openssl verify -CAfile root.cert.pem intermediate.cert.pem
intermediate.cert.pem: OK

==== run-verify-server ====
cat intermediate.cert.pem root.cert.pem > chain.pem
# genrsa server
openssl genrsa -out server.key.pem 2048
Generating RSA private key, 2048 bit long modulus
..................................
...........................................
e is 65537 (0x010001)
# server req
openssl req -batch -config /usr/src/regress/lib/libcrypto/CA/intermediate.cnf -new -sha256  -subj '/CN=server.openbsd.org/OU=So and Sos/O=OpenBSD/C=CA'  -key server.key.pem -out server.csr.pem
# server sign
openssl ca -batch -config /usr/src/regress/lib/libcrypto/CA/intermediate.cnf  -extensions server_cert -days 5 -notext -md sha256  -in server.csr.pem -out server.cert.pem
Using configuration from /usr/src/regress/lib/libcrypto/CA/intermediate.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 4096 (0x1000)
        Validity
            Not Before: Apr 15 21:04:29 2024 GMT
            Not After : Apr 20 21:04:29 2024 GMT
        Subject:
            countryName               = CA
            organizationName          = OpenBSD
            organizationalUnitName    = So and Sos
            commonName                = server.openbsd.org
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Cert Type:
                SSL Server
            Netscape Comment:
                OpenSSL Generated Server Certificate
            X509v3 Subject Key Identifier:
                8E:C2:9C:04:34:4F:9A:79:09:48:D1:A8:2F:FF:14:E4:A6:84:CE:13
            X509v3 Authority Key Identifier:
                keyid:07:49:35:01:E2:86:AD:C4:4A:9E:68:C5:1C:DE:53:12:0F:91:E0:57
                DirName:/C=CA/ST=Alberta/L=Edmonton/O=OpenBSD/OU=So and Sos/CN=Regress Root CA/emailAddress=evilsoandsos@openbsd.org
                serial:10:00

            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
Certificate is to be certified until Apr 20 21:04:29 2024 GMT (5 days)

Write out database with 1 new entries
Data Base Updated
# validate server cert
openssl verify -purpose sslserver -CAfile chain.pem server.cert.pem
server.cert.pem: OK

==== run-verify-client ====
# genrsa client
openssl genrsa -out client.key.pem 2048
Generating RSA private key, 2048 bit long modulus
.
......................................................................................
e is 65537 (0x010001)
# client req
openssl req -batch -config /usr/src/regress/lib/libcrypto/CA/intermediate.cnf -new -sha256  -subj '/CN=client/OU=So and Sos/O=OpenBSD/C=CA'  -key client.key.pem -out client.csr.pem
# client sign
openssl ca -batch -config /usr/src/regress/lib/libcrypto/CA/intermediate.cnf  -extensions usr_cert -days 5 -notext -md sha256  -in client.csr.pem -out client.cert.pem
Using configuration from /usr/src/regress/lib/libcrypto/CA/intermediate.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 4097 (0x1001)
        Validity
            Not Before: Apr 15 21:04:29 2024 GMT
            Not After : Apr 20 21:04:29 2024 GMT
        Subject:
            countryName               = CA
            organizationName          = OpenBSD
            organizationalUnitName    = So and Sos
            commonName                = client
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Cert Type:
                SSL Client, S/MIME
            Netscape Comment:
                OpenSSL Generated Client Certificate
            X509v3 Subject Key Identifier:
                12:64:C9:8E:90:F2:13:32:6B:1E:18:10:F7:D7:4B:3E:48:90:7A:51
            X509v3 Authority Key Identifier:
                keyid:07:49:35:01:E2:86:AD:C4:4A:9E:68:C5:1C:DE:53:12:0F:91:E0:57

            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Subject Alternative Name: critical
                email:evilsoandsos@test.openbsd.org
Certificate is to be certified until Apr 20 21:04:29 2024 GMT (5 days)

Write out database with 1 new entries
Data Base Updated
# validate client cert
openssl verify -purpose sslclient -CAfile chain.pem client.cert.pem
client.cert.pem: OK

PASS	lib/libcrypto/CA	Duration 0m06.42s