mirror of
https://github.com/freebsd/freebsd-src.git
synced 2026-10-28 11:25:21 +01:00
Dag-Erling Smørgrav
c340ef28fd
Notable changes include: * We no longer forget manually untrusted certificates when rehashing. * Rehash will now scan the existing directory and progressively replace its contents with those of the new trust store. The trust store as a whole is not replaced atomically, but each file within it is. * We no longer attempt to link to the original files, but we don't copy them either. Instead, we write each certificate out in its minimal form. * We now generate a trust bundle in addition to the hashed diretory. This also contains only the minimal DER form of each certificate. This allows e.g. Unbound to preload the bundle before chrooting. * The C version is approximately two orders of magnitude faster than the sh version, with rehash taking ~100 ms vs ~5-25 s depending on whether ca_root_nss is installed. * We now also have tests. Reviewed by: kevans, markj Differential Revision: https://reviews.freebsd.org/D42320 Differential Revision: https://reviews.freebsd.org/D51896
45 lines
861 B
Plaintext
45 lines
861 B
Plaintext
#
|
|
# Copyright (c) 2025 Dag-Erling Smørgrav <[email protected]>
|
|
#
|
|
# SPDX-License-Identifier: BSD-2-Clause
|
|
#
|
|
|
|
# Generate a random name
|
|
rand_name() {
|
|
local length=${1:-32}
|
|
|
|
jot -r -c -s '' ${length} A Z
|
|
}
|
|
|
|
# Generate a subject for a given name
|
|
subject() {
|
|
local crtname=$1
|
|
|
|
echo "/CN=${crtname}/O=FreeBSD/OU=Test/"
|
|
}
|
|
|
|
# Generate a key
|
|
gen_key() {
|
|
local keyname=$1
|
|
|
|
env -i PATH="${PATH}" OPENSSL_CONF=/dev/null \
|
|
openssl genrsa -out ${keyname}.key
|
|
}
|
|
|
|
# Generate a certificate for a given name, key, and serial number
|
|
gen_crt() {
|
|
local crtname=$1
|
|
local keyname=${2:-${crtname}}
|
|
local serial=${3:-1}
|
|
|
|
if ! [ -f "${keyname}".key ]; then
|
|
gen_key "${keyname}"
|
|
fi
|
|
env -i PATH="${PATH}" OPENSSL_CONF=/dev/null \
|
|
openssl req -x509 -new \
|
|
-subj="$(subject ${crtname})" \
|
|
-set_serial ${serial} \
|
|
-key ${keyname}.key \
|
|
-out ${crtname}.crt
|
|
}
|