Lines Matching refs:cert
3 # Primary root: root-cert
4 ./mkcert.sh genroot "Root CA" root-key root-cert
5 # root cert variants: CA:false, key2, DN2, expired
8 ./mkcert.sh genroot "Root Cert 2" root-key root-name2
10 # cross root and root cross cert
12 ./mkcert.sh genca "Root CA" root-key root-cross-cert cross-key cross-root
14 openssl x509 -in root-cert.pem -trustout \
16 openssl x509 -in root-cert.pem -trustout \
18 openssl x509 -in root-cert.pem -trustout \
20 openssl x509 -in root-cert.pem -trustout \
23 openssl x509 -in root-cert.pem -trustout \
25 openssl x509 -in root-cert.pem -trustout \
43 ./mkcert.sh genroot "Root CA" root-key root-cert-md5
46 ./mkcert.sh genroot "Root CA" root-key-768 root-cert-768
48 # primary client-EKU root: croot-cert
49 ./mkcert.sh genroot "Root CA" root-key croot-cert clientAuth
51 openssl x509 -in croot-cert.pem -trustout \
53 openssl x509 -in croot-cert.pem -trustout \
55 openssl x509 -in croot-cert.pem -trustout \
57 openssl x509 -in croot-cert.pem -trustout \
59 openssl x509 -in croot-cert.pem -trustout \
61 openssl x509 -in croot-cert.pem -trustout \
64 # primary server-EKU root: sroot-cert
65 ./mkcert.sh genroot "Root CA" root-key sroot-cert serverAuth
67 openssl x509 -in sroot-cert.pem -trustout \
69 openssl x509 -in sroot-cert.pem -trustout \
71 openssl x509 -in sroot-cert.pem -trustout \
73 openssl x509 -in sroot-cert.pem -trustout \
75 openssl x509 -in sroot-cert.pem -trustout \
77 openssl x509 -in sroot-cert.pem -trustout \
80 # Primary intermediate ca: ca-cert
81 ./mkcert.sh genca "CA" ca-key ca-cert root-key root-cert
83 ./mkcert.sh genee "CA" ca-key ca-nonca root-key root-cert
84 ./mkcert.sh gen_nonbc_ca "CA" ca-key ca-nonbc root-key root-cert
85 ./mkcert.sh genca "CA" ca-key2 ca-cert2 root-key root-cert
86 ./mkcert.sh genca "CA2" ca-key ca-name2 root-key root-cert
88 DAYS=-1 ./mkcert.sh genca "CA" ca-key ca-expired root-key root-cert
90 openssl x509 -in ca-cert.pem -trustout \
92 openssl x509 -in ca-cert.pem -trustout \
94 openssl x509 -in ca-cert.pem -trustout \
96 openssl x509 -in ca-cert.pem -trustout \
99 openssl x509 -in ca-cert.pem -trustout \
101 openssl x509 -in ca-cert.pem -trustout \
112 ./mkcert.sh genca "CA" ca-key ca-cert-md5 root-key root-cert
113 openssl x509 -in ca-cert-md5.pem -trustout \
114 -addtrust anyExtendedKeyUsage -out ca-cert-md5-any.pem
116 ./mkcert.sh genca "CA" ca-key ca-cert-768i root-key-768 root-cert-768
119 ./mkcert.sh genca "CA" ca-key-768 ca-cert-768 root-key root-cert
120 # EC cert with explicit curve
121 ./mkcert.sh genca "CA" ca-key-ec-explicit ca-cert-ec-explicit root-key root-cert
122 # EC cert with named curve
123 ./mkcert.sh genca "CA" ca-key-ec-named ca-cert-ec-named root-key root-cert
125 # client intermediate ca: cca-cert
126 ./mkcert.sh genca -p clientAuth "CA" ca-key cca-cert root-key root-cert
128 openssl x509 -in cca-cert.pem -trustout \
130 openssl x509 -in cca-cert.pem -trustout \
132 openssl x509 -in cca-cert.pem -trustout \
134 openssl x509 -in cca-cert.pem -trustout \
136 openssl x509 -in cca-cert.pem -trustout \
138 openssl x509 -in cca-cert.pem -trustout \
141 # server intermediate ca: sca-cert
142 ./mkcert.sh genca -p serverAuth "CA" ca-key sca-cert root-key root-cert
144 openssl x509 -in sca-cert.pem -trustout \
146 openssl x509 -in sca-cert.pem -trustout \
148 openssl x509 -in sca-cert.pem -trustout \
150 openssl x509 -in sca-cert.pem -trustout \
152 openssl x509 -in sca-cert.pem -trustout \
154 openssl x509 -in sca-cert.pem -trustout \
157 # Primary leaf cert: ee-cert with default purpose: serverAuth
158 ./mkcert.sh genee server.example ee-key ee-cert ca-key ca-cert
160 ./mkcert.sh genee server.example ee-key ee-expired ca-key ca-cert -days -1
163 ./mkcert.sh genee server.example ee-key ee-pathlen ca-key ca-cert \
166 ./mkcert.sh genee -p clientAuth server.example ee-key ee-client ca-key ca-cert
168 openssl x509 -in ee-cert.pem -trustout \
170 openssl x509 -in ee-cert.pem -trustout \
178 ./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum ca-key ca-cert
179 ./mkcert.sh genee -p timeStamping -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-noncritxku ca-key ca-cert
180 ./mkcert.sh genee -p critical,timeStamping,serverAuth -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-serverauth ca-key ca-cert
181 ./mkcert.sh genee -p critical,timeStamping,2.5.29.37.0 -k critical,digitalSignature server.example ee-key ee-timestampsign-CABforum-anyextkeyusage ca-key ca-cert
182 ./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature,cRLSign server.example ee-key ee-timestampsign-CABforum-crlsign ca-key ca-cert
183 ./mkcert.sh genee -p critical,timeStamping -k critical,digitalSignature,keyCertSign server.example ee-key ee-timestampsign-CABforum-keycertsign ca-key ca-cert
184 ./mkcert.sh genee -p critical,timeStamping server.example ee-key ee-timestampsign-rfc3161 ca-key ca-cert
185 ./mkcert.sh genee -p timeStamping server.example ee-key ee-timestampsign-rfc3161-noncritxku ca-key ca-cert
186 ./mkcert.sh genee -p critical,timeStamping -k digitalSignature server.example ee-key ee-timestampsign-rfc3161-digsig ca-key ca-cert
189 ./mkcert.sh genee -p codeSigning -k critical,digitalSignature server.example ee-key ee-codesign ca-key ca-cert
190 ./mkcert.sh genee -p codeSigning,serverAuth -k critical,digitalSignature server.example ee-key ee-codesign-serverauth ca-key ca-cert
191 ./mkcert.sh genee -p codeSigning,2.5.29.37.0 -k critical,digitalSignature server.example ee-key ee-codesign-anyextkeyusage ca-key ca-cert
192 ./mkcert.sh genee -p codeSigning -k critical,digitalSignature,cRLSign server.example ee-key ee-codesign-crlsign ca-key ca-cert
193 ./mkcert.sh genee -p codeSigning -k critical,digitalSignature,keyCertSign server.example ee-key ee-codesign-keycertsign ca-key ca-cert
194 ./mkcert.sh genee -p codeSigning -k digitalSignature server.example ee-key ee-codesign-noncritical ca-key ca-cert
196 # Leaf cert security level variants
199 ./mkcert.sh genee server.example ee-key ee-cert-md5 ca-key ca-cert
201 ./mkcert.sh genee server.example ee-key ee-cert-768i ca-key-768 ca-cert-768
204 ./mkcert.sh genee server.example ee-key-768 ee-cert-768 ca-key ca-cert
205 # EC cert with explicit curve signed by named curve ca
206 ./mkcert.sh genee server.example ee-key-ec-explicit ee-cert-ec-explicit ca-key-ec-named ca-cert-ec-named
207 # EC cert with named curve signed by explicit curve ca
209 ee-cert-ec-named-explicit ca-key-ec-explicit ca-cert-ec-explicit
210 # EC cert with named curve signed by named curve ca
212 ee-cert-ec-named-named ca-key-ec-named ca-cert-ec-named
215 ./mkcert.sh genee server.example ee-key-1024 ee-cert-1024 ca-key ca-cert
218 ./mkcert.sh genee server.example ee-key-3072 ee-cert-3072 ca-key ca-cert
221 ./mkcert.sh genee server.example ee-key-4096 ee-cert-4096 ca-key ca-cert
224 ./mkcert.sh genee server.example ee-key-8192 ee-cert-8192 ca-key ca-cert
226 # self-signed end-entity cert with explicit keyUsage not including KeyCertSign
229 # self-signed end-entity cert signed with RSA-PSS
236 ./mkcert.sh genpc pc1-key pc1-cert ee-key ee-client \
239 ./mkcert.sh genpc pc2-key pc2-cert pc1-key pc1-cert \
244 ./mkcert.sh genpc bad-pc3-key bad-pc3-cert pc1-key pc1-cert \
248 ./mkcert.sh genpc bad-pc4-key bad-pc4-cert pc1-key pc1-cert \
252 ./mkcert.sh genpc pc5-key pc5-cert pc1-key pc1-cert \
256 ./mkcert.sh genpc bad-pc6-key bad-pc6-cert pc1-key pc1-cert \
269 NC=$NC ./mkcert.sh genca "Test NC CA 1" ncca1-key ncca1-cert root-key root-cert
278 NC=$NC ./mkcert.sh genca "Test NC CA 2" ncca2-key ncca2-cert root-key root-cert
288 NC=$NC ./mkcert.sh genca "Test NC sub CA" ncca3-key ncca3-cert \
289 ncca1-key ncca1-cert
295 ./mkcert.sh geneealt alt1-key alt1-cert ncca1-key ncca1-cert \
305 ./mkcert.sh geneealt goodcn1-key goodcn1-cert ncca1-key ncca1-cert \
312 ./mkcert.sh geneeconfig goodcn2-key goodcn2-cert ncca1-key ncca1-cert
318 ./mkcert.sh geneealt badcn1-key badcn1-cert ncca1-key ncca1-cert \
324 ./mkcert.sh geneealt alt2-key alt2-cert ncca2-key ncca2-cert \
331 ./mkcert.sh geneealt badalt1-key badalt1-cert ncca1-key ncca1-cert \
338 ./mkcert.sh geneealt badalt2-key badalt2-cert ncca2-key ncca2-cert \
345 ./mkcert.sh geneealt badalt3-key badalt1-cert ncca1-key ncca1-cert \
353 ./mkcert.sh geneealt badalt4-key badalt4-cert ncca1-key ncca1-cert \
359 ./mkcert.sh geneealt badalt5-key badalt5-cert ncca1-key ncca1-cert \
367 ./mkcert.sh geneealt badalt6-key badalt6-cert ncca1-key ncca1-cert \
374 ./mkcert.sh geneealt badalt7-key badalt7-cert ncca1-key ncca1-cert \
382 ./mkcert.sh geneealt alt3-key alt3-cert ncca3-key ncca3-cert \
391 ./mkcert.sh geneealt badalt8-key badalt8-cert ncca3-key ncca3-cert \
400 ./mkcert.sh geneealt badalt9-key badalt9-cert ncca3-key ncca3-cert \
409 ./mkcert.sh geneealt badalt10-key badalt10-cert ncca3-key ncca3-cert \
417 NC=$NC ./mkcert.sh genca "Test NC CA 4" ncca4-key ncca4-cert root-key root-cert
422 ./mkcert.sh geneealt nc-uri-key nc-uri-cert ncca4-key ncca4-cert \
429 "Test NC CA othername" nccaothername-key nccaothername-cert \
430 root-key root-cert
433 ./mkcert.sh geneealt bad-othername-key bad-othername-cert \
434 nccaothername-key nccaothername-cert \
439 ./mkcert.sh genee PSS-SHA1 ee-key ee-pss-sha1-cert ca-key ca-cert \
442 ./mkcert.sh genee PSS-SHA256 ee-key ee-pss-sha256-cert ca-key ca-cert \
445 ./mkcert.sh genca "CA-PSS" ca-pss-key ca-pss-cert root-key root-cert \
447 ./mkcert.sh genee "EE-PSS" ee-key ee-pss-cert ca-pss-key ca-pss-cert \
450 #./mkcert.sh genee "EE-PSS-wrong1.5" ee-key ee-pss-wrong1.5-cert ca-pss-key ca-pss-cert -sha256
453 "Server ECDSA brainpoolP256r1 cert" server-ecdsa-brainpoolP256r1-key \
454 server-ecdsa-brainpoolP256r1-cert rootkey rootcert
459 ./mkcert.sh geneenocsr "Server RSA-PSS restricted cert" \
460 server-pss-restrict-cert rootkey rootcert
465 ./mkcert.sh geneenocsr -p clientAuth "Client RSA-PSS restricted cert" \
466 client-pss-restrict-cert rootkey rootcert
472 root-ed448-key root-ed448-cert
474 server-ed448-key server-ed448-cert root-ed448-key root-ed448-cert
477 ./mkcert.sh geneeextra server.example ee-key ee-cert-noncrit-unknown-ext ca-key ca-cert "1.2.3.4=DER:05:00"
480 ./mkcert.sh geneeextra server.example ee-key ee-cert-crit-unknown-ext ca-key ca-cert "1.2.3.4=critical,DER:05:00"
483 ./mkcert.sh geneeextra server.example ee-key ee-cert-ocsp-nocheck ca-key ca-cert "1.3.6.1.5.5.7.48.1.5=critical,DER:05:00"
486 ./mkcert.sh genca -c "1.3.6.1.4.1.16604.998855.1" "CA" ca-key ca-pol-cert root-key root-cert
487 ./mkcert.sh geneeextra server.example ee-key ee-cert-policies ca-key ca-cert "certificatePolicies=1.3.6.1.4.1.16604.998855.1"
488 # We can create a cert with a duplicate policy oid - but its actually invalid!
489 ./mkcert.sh geneeextra server.example ee-key ee-cert-policies-bad ca-key ca-cert "certificatePolicies=1.3.6.1.4.1.16604.998855.1,1.3.6.1.4.1.16604.998855.1"
491 # EC cert signed by curve ca with SHA3-224, SHA3-256, SHA3-384, SHA3-512
492 OPENSSL_SIGALG="sha3-224" ./mkcert.sh genee server.example ee-key-ec-named-named ee-cert-ec-sha3-224 ca-key-ec-named ca-cert-ec-named
493 OPENSSL_SIGALG="sha3-256" ./mkcert.sh genee server.example ee-key-ec-named-named ee-cert-ec-sha3-256 ca-key-ec-named ca-cert-ec-named
494 OPENSSL_SIGALG="sha3-384" ./mkcert.sh genee server.example ee-key-ec-named-named ee-cert-ec-sha3-384 ca-key-ec-named ca-cert-ec-named
495 OPENSSL_SIGALG="sha3-512" ./mkcert.sh genee server.example ee-key-ec-named-named ee-cert-ec-sha3-512 ca-key-ec-named ca-cert-ec-named
497 # EC cert seigned RSA intermediate CA
499 "P-256 cert EE issuer" p256-ee-rsa-ca-key \
500 p256-ee-rsa-ca-cert ca-key ca-cert
Indexes created Sun Mar 01 05:31:48 UTC 2026