fileca: add intermediate certificate testdata

Signed-off-by: Nathan Smith <nathan@nfsmith.ca>
sigstore · Jan 8, 2022 · 12a9942 · 12a9942
1 parent 71f212c
commit 12a9942
Show file tree

Hide file tree

Showing 4 changed files with 79 additions and 0 deletions.
diff --git a/pkg/ca/fileca/testdata/generate.sh b/pkg/ca/fileca/testdata/generate.sh
@@ -74,3 +74,45 @@ openssl req -x509 \
     -days $duration \
     -addext basicConstraints=critical,CA:FALSE,pathlen:1 \
     -passout pass:"$password"
+
+####  Intermediate CA
+
+# Root CA
+openssl req -x509 \
+    -newkey ed25519 \
+    -sha256 \
+    -keyout root-key.pem \
+    -out root-cert.pem \
+    -subj "/CN=rootca" \
+    -days $duration \
+    -addext basicConstraints=critical,CA:TRUE,pathlen:2 \
+    -nodes
+
+# Certificate Signing Request
+openssl req \
+    -newkey ed25519 \
+    -sha256 \
+    -passout pass:"$password" \
+    -subj "/CN=intermediate" \
+    -out intermediate-csr.pem \
+    -keyout intermediate-key.pem \
+    -outform PEM
+
+# Sign certificate
+openssl x509 \
+    -req \
+    -in intermediate-csr.pem \
+    -days $duration \
+    -CA root-cert.pem \
+    -CAkey root-key.pem \
+    -set_serial 22 \
+    -out intermediate-cert.pem \
+    -extfile openssl-ca.conf \
+    -extensions signing_req
+
+# Full chain
+mv intermediate-cert.pem tmp.pem
+cat tmp.pem root-cert.pem > intermediate-cert.pem
+
+# Clean up
+rm intermediate-csr.pem tmp.pem root-cert.pem root-key.pem
diff --git a/pkg/ca/fileca/testdata/intermediate-cert.pem b/pkg/ca/fileca/testdata/intermediate-cert.pem
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIBNTCB6KADAgECAgEWMAUGAytlcDARMQ8wDQYDVQQDDAZyb290Y2EwIBcNMjIw
+MTA4MDQyOTM3WhgPMjEyMTEyMTUwNDI5MzdaMBcxFTATBgNVBAMMDGludGVybWVk
+aWF0ZTAqMAUGAytlcAMhABxIp+uxTqva39hqLoV6GMzS4/0RGpvZ6UuiBiIqe7Nu
+o10wWzAdBgNVHQ4EFgQUYMZkOOfGmfPTEs83wGDZRuNhHQIwHwYDVR0jBBgwFoAU
+hQF6u+wPlhpfVNyVGI90oQpUSYMwDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCBaAw
+BQYDK2VwA0EA35RoOqPglrqCvjTebrx1KSck8TPk8Nrr2ga75ND1xpUwcVBC0xul
+FK6msSlGwU4JWwyDwK/NAhshaWBxV3cFBQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIBTDCB/6ADAgECAhQly4C9Kx50JaOxPSmy7o3tf21rkDAFBgMrZXAwETEPMA0G
+A1UEAwwGcm9vdGNhMCAXDTIyMDEwODA0MjkzN1oYDzIxMjExMjE1MDQyOTM3WjAR
+MQ8wDQYDVQQDDAZyb290Y2EwKjAFBgMrZXADIQAm65BwsxLNuBYkBIiHE2SGec8v
+FYju2qKuhO6kVgx+hKNnMGUwHQYDVR0OBBYEFIUBervsD5YaX1TclRiPdKEKVEmD
+MB8GA1UdIwQYMBaAFIUBervsD5YaX1TclRiPdKEKVEmDMA8GA1UdEwEB/wQFMAMB
+Af8wEgYDVR0TAQH/BAgwBgEB/wIBAjAFBgMrZXADQQC5Uk+groK6+m0DoPXdFp+j
+6gInepNfYONRKzSxVe+rgi3OSQ4GX1UaML0Rzy6uGALNk1gQiOnplSZz7Y+pLKoE
+-----END CERTIFICATE-----
diff --git a/pkg/ca/fileca/testdata/intermediate-key.pem b/pkg/ca/fileca/testdata/intermediate-key.pem
@@ -0,0 +1,5 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIGKME4GCSqGSIb3DQEFDTBBMCkGCSqGSIb3DQEFDDAcBAgOOujHxCUlcgICCAAw
+DAYIKoZIhvcNAgkFADAUBggqhkiG9w0DBwQILfK4b9k62+IEOE6l+NWyFeGlKcb9
+cMojzzwLT0qUbBQfVcHu3XVwKnwgON6jBIRRA12AHrH9sOjHdQO4NFco10A0
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/pkg/ca/fileca/testdata/openssl-ca.conf b/pkg/ca/fileca/testdata/openssl-ca.conf
@@ -0,0 +1,14 @@
+[ signing_policy ]
+countryName            = optional
+stateOrProvinceName    = optional
+localityName           = optional
+organizationName       = optional
+organizationalUnitName = optional
+commonName             = supplied
+emailAddress           = optional
+
+[ signing_req ]
+subjectKeyIdentifier   = hash
+authorityKeyIdentifier = keyid,issuer
+basicConstraints       = CA:TRUE
+keyUsage               = digitalSignature, keyEncipherment