mrcharles
82fdb161cc
ca-init/issue-cert/selftest (TDD loop, shellcheck clean); design doc on Discourse t/320. Offline RSA-4096 root (Nitrokey ceremony later), 5y intermediate, 825d SAN leaves. First cert: tsys-wazuh.knel.net (fingerprint on the ticket note). Meat: https://projects.knownelement.com/issues/697#note-4033
18 lines
833 B
Bash
18 lines
833 B
Bash
#!/bin/bash
|
|
#
|
|
# selftest.sh — throwaway end-to-end CA loop in /tmp [#697]
|
|
# TDD gate for the CA tooling: init -> issue -> verify chain -> negative check.
|
|
#
|
|
set -euo pipefail
|
|
T="$(mktemp -d)"
|
|
trap 'rm -rf "$T"' EXIT
|
|
|
|
bash "$(dirname "$0")/ca-init.sh" "$T/root" "$T/int" > /dev/null
|
|
[ -s "$T/root/root.key" ] && [ -s "$T/int/intermediate.crt" ] || { echo "FAIL: init" ; exit 1; }
|
|
|
|
INT_DIR="$T/int" bash "$(dirname "$0")/issue-cert.sh" test.knel.net "DNS:test.knel.net,IP:10.0.0.1" > /dev/null
|
|
openssl verify -CAfile "$T/root/root.crt" "$T/int/intermediate.crt" > /dev/null
|
|
openssl x509 -in "$T/int/certs/test.knel.net.crt" -noout -ext subjectAltName | grep -q "test.knel.net"
|
|
openssl x509 -in "$T/int/certs/test.knel.net.fullchain" -noout | head -1 > /dev/null
|
|
echo "SELFTEST PASS: root->intermediate->leaf chain verified with SANs"
|