init

results/scripts/gen-certs.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+set -eu
+
+SSL_DIR="${SSL_DIR:-/ssl}"
+cd "$SSL_DIR"
+
+openssl genrsa -out ca.key 4096
+openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
+  -subj "/CN=PMI Test CA" -out ca.crt
+
+openssl genrsa -out server.key 2048
+openssl req -new -key server.key -subj "/CN=nginx-test" -out server.csr
+openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
+  -out server.crt -days 825 -sha256
+
+openssl genrsa -out client.key 2048
+openssl req -new -key client.key -subj "/CN=trusted-client" -out client.csr
+openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
+  -out client.crt -days 825 -sha256
+
+openssl genrsa -out untrusted.key 2048
+openssl req -x509 -new -nodes -key untrusted.key -sha256 -days 365 \
+  -subj "/CN=untrusted-client" -out untrusted.crt
+
+chmod 600 ca.key server.key client.key untrusted.key
+chmod 644 ca.crt server.crt client.crt untrusted.crt
+cat server.crt ca.crt > fullchain.crt
+chmod 644 fullchain.crt
+rm -f server.csr client.csr ca.srl
+
+echo "Certificates generated in $SSL_DIR"