· 9 years ago · Jan 23, 2017, 10:58 PM
1<?php
2$cwd=getcwd();
3$distname= array(
4 "countryName" => "CA",
5 "stateOrProvinceName" => "Ontario",
6 "localityName" => "Toronto",
7 "organizationName" => "G4 Apps",
8 "organizationalUnitName" => "Development",
9 "commonName" => "Mark Lane",
10 "emailAddress" => "nobody at gmail.com"
11 );
12$password = 'seanix';
13
14$cacert_location=$cwd."/certs/CA/g4CA.crt";
15$cakey_location=$cwd."/certs/CA/g4CA.key";
16$cnf=$cwd.'/certs/myopenssl.cnf';
17$configArgs = array(
18 'config' =>$cnf
19);
20?>
21
22<?php
23function makekey($password,$configArgs) {
24 $key= openssl_pkey_new($configArgs);
25 //print_r($configArgs);
26 openssl_pkey_export($key, $pkeyout,$password);
27 if (($e=openssl_error_string()) ==false) return $pkeyout;
28 else {
29 do {
30
31 echo $e . "<BR>";
32 } while($e=openssl_error_string());
33 return -1;
34 }
35}
36?>
37
38<?php
39function newcsr($distname,$key,$configArgs) {
40 $csr=openssl_csr_new($distname,$key,$configArgs);
41 openssl_csr_export($csr, $csrout);
42 if (($e=openssl_error_string()) ==false) return $csrout;
43 else {
44 do {
45
46 echo $e . "<BR>";
47 } while($e=openssl_error_string());
48 return -1;
49 }
50}
51?>
52
53HOME = .
54RANDFILE = $ENV::HOME/.rnd
55
56oid_section = new_oids
57
58
59[ new_oids ]
60
61
62tsa_policy1 = 1.2.3.4.1
63tsa_policy2 = 1.2.3.4.5.6
64tsa_policy3 = 1.2.3.4.5.7
65
66####################################################################
67[ ca ]
68default_ca = g4CA
69
70####################################################################
71[ g4CA ]
72
73dir = /home/g4apps/secure.g4apps.com/generator/certs
74certs = $dir/
75crl_dir = $dir/crl
76database = $dir/index.txt
77
78
79new_certs_dir = $dir/newcerts
80
81certificate = $dir/CA/g4CA.crt
82serial = $dir/serial
83crlnumber = $dir/crlnumber
84
85crl = $dir/CA/g4CA.crl
86private_key = $dir/CA/g4CA.key
87RANDFILE = $dir/private/.rand
88
89x509_extensions = usr_cert
90
91name_opt = ca_default
92cert_opt = ca_default
93
94
95default_days = 365 # how long to certify for
96default_crl_days= 30 # how long before next CRL
97default_md = default # use public key default MD
98preserve = no # keep passed DN ordering
99
100policy = policy_match
101
102
103[ policy_match ]
104countryName = match
105stateOrProvinceName = match
106organizationName = match
107organizationalUnitName = optional
108commonName = supplied
109emailAddress = optional
110
111[ policy_anything ]
112countryName = optional
113stateOrProvinceName = optional
114localityName = optional
115organizationName = optional
116organizationalUnitName = optional
117commonName = supplied
118emailAddress = optional
119
120####################################################################
121[ req ]
122default_bits = 2048
123default_md = md5
124default_keyfile = privkey.pem
125distinguished_name = req_distinguished_name
126attributes = req_attributes
127x509_extensions = v3_ca # The extentions to add to the self signed cert
128
129string_mask = utf8only
130
131[ req_distinguished_name ]
132countryName = Country Name (2 letter code)
133countryName_default = CA
134countryName_min = 2
135countryName_max = 2
136
137stateOrProvinceName = State or Province Name (full name)
138stateOrProvinceName_default = ON
139
140localityName = Locality Name (eg, city)
141localityName_default = Toronto
142
1430.organizationName = Organization Name (eg, company)
1440.organizationName_default = G4 Apps
145
146
147
148organizationalUnitName = Organizational Unit Name (eg, section)
149
150commonName = Common Name (eg, your name or your server's hostname)
151commonName_max = 64
152
153emailAddress = Email Address
154emailAddress_default = lmlane@gmail.com
155emailAddress_max = 64
156
157
158[ req_attributes ]
159challengePassword = A challenge password
160challengePassword_min = 4
161challengePassword_max = 20
162
163unstructuredName = An optional company name
164
165[ usr_cert ]
166
167nsComment = "OpenSSL Generated Certificate"
168
169subjectKeyIdentifier=hash
170authorityKeyIdentifier=keyid,issuer
171
172
173
174[ v3_req ]
175
176
177basicConstraints = CA:FALSE
178keyUsage = nonRepudiation, digitalSignature, keyEncipherment
179
180[ v3_ca ]
181
182
183subjectKeyIdentifier=hash
184
185authorityKeyIdentifier=keyid:always,issuer
186basicConstraints = CA:true
187
188
189[ crl_ext ]
190
191authorityKeyIdentifier=keyid:always
192
193[ proxy_cert_ext ]
194basicConstraints=CA:FALSE
195
196nsComment = "OpenSSL Generated Certificate"
197
198subjectKeyIdentifier=hash
199authorityKeyIdentifier=keyid,issuer
200
201proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
202
203####################################################################
204[ tsa ]
205
206default_tsa = tsa_config1
207
208[ tsa_config1 ]
209
210dir = ./demoCA
211serial = $dir/tsaserial
212crypto_device = builtin
213signer_cert = $dir/tsacert.pem
214
215certs = $dir/cacert.pem
216signer_key = $dir/private/tsakey.pem
217default_policy = tsa_policy1
218other_policies = tsa_policy2, tsa_policy3
219digests = md5, sha1
220accuracy = secs:1, millisecs:500, microsecs:100
221clock_precision_digits = 0
222ordering = yes
223
224tsa_name = yes
225ess_cert_id_chain = no
226
227$res = openssl_pkey_new();
228openssl_pkey_export($res, $privkey);
229var_dump(openssl_error_string());
230var_dump($privkey);
231
232string(68) "error:0E06D06C:configuration file routines:NCONF_get_string:no value"
233string(887) "-----BEGIN RSA PRIVATE KEY-----
234MIICXQIBAAKBgQDdh4FiOEtUZzvTSnlb/pJHjmsS9rOHQ7PU2WOO6ZHxYRIgK1NR
235ReY7bBwEsT2ziUpx0b8K2Fx4m+XovzysB/lVrKbrdbHoVtGuJGZjYSXgFlCRTBu+
236+TnAPUBF0LGJfxfVzjOkHzsh02lH3fvzFpFgRZRWs4za+vVzIweeOweYTwIDAQAB
237AoGANZD5iS2BkZQw1COS+tqwtlrKq1g6CwAk8NfsCfeSkaJeRqcTS3iydjXrBHtz
238JwGQnbsRDedJXOSdkE0Ft7dp44lijOAp1ngMDCKbabxVN2Go6b1d743HE0oIhFCC
239Dv2B9kf9vzeYy+0/BVCs5i4iPoKXJJTSJrWoDxrFEJWSJIkCQQDwe39bOFHmQlxz
240pbfT3DZ8Q311xFo6PewcAf7DTsikoPZANx0GQ41WdZj6/n4QVP4k+TnhZLiJzsH+
241p3RUrx8tAkEA69LsgPrQMZ0YjsE2vjRLdJmp1916G1xqSLIVWDUPd9Ns+MA8YKTx
242AQxC3dl3n+w24m7UlCThANlU/+2r0eoi6wJBAKIxGOdEJ/Cdp08UYNRR/Kl4t2A7
243SwNnChylt9awByEJsqwCv9+epe+/Jqt6AzouqK31LXV4AgJn4W1IMWyAJA0CQCp0
2446/2AqnD0PpKc+JUf5yHT9H8Xsb8xUTVLUopx6xoAp5LVUUl5CKbOpU85ss7JAUyc
2459YrCZPv5JNN6379ILwcCQQDDcjtNnhQHukQQQ8iVL9YCrWzyCgplTz3uktueT+Dd
246SDK1bCM4xDehfG3RKu1ZNx80Q0nzmi7FSPJ2md7qSIHc
247-----END RSA PRIVATE KEY-----
248"
249
250default_md = md5