| #!/usr/bin/env bash |
| # |
| # Licensed to the Apache Software Foundation (ASF) under one |
| # or more contributor license agreements. See the NOTICE file |
| # distributed with this work for additional information |
| # regarding copyright ownership. The ASF licenses this file |
| # to you under the Apache License, Version 2.0 (the |
| # "License"); you may not use this file except in compliance |
| # with the License. You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, |
| # software distributed under the License is distributed on an |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| # KIND, either express or implied. See the License for the |
| # specific language governing permissions and limitations |
| # under the License. |
| # |
| |
| echo "Remove existing keystore for Apache Qpid Broker for Java " |
| rm java_broker_keystore.jks |
| echo "Re-create keystore for Apache Qpid Broker for Java by importing RootCA certificate" |
| keytool -import -v -keystore java_broker_keystore.jks -storepass password -alias RootCA -file CA_db/rootca.crt |
| echo "Generate certificate key 'java-broker'" |
| keytool -genkey -alias java-broker -keyalg RSA -sigalg SHA1withRSA -validity 720 -keystore java_broker_keystore.jks -storepass password -dname "CN=localhost, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown" |
| echo "Export certificate signing request" |
| keytool -certreq -alias java-broker -sigalg SHA1withRSA -keystore java_broker_keystore.jks -storepass password -v -file java-broker.req |
| echo "Sign certificate by entering:" |
| echo " n for 'Is this a CA certificate [y/N]?'" |
| echo " [Enter] for 'Enter the path length constraint, enter to skip [<0 for unlimited path]: >'" |
| echo " n for 'Is this a critical extension [y/N]?'" |
| echo " password which was specified on creation root CA database." |
| certutil -C -d CA_db -c "MyRootCA" -a -i java-broker.req -o java-broker.crt -2 -6 --extKeyUsage serverAuth -v 60 -Z SHA1 |
| echo "Import signed certificate" |
| keytool -import -v -alias java-broker -keystore java_broker_keystore.jks -storepass password -file java-broker.crt |
| echo "List keystore entries" |
| keytool --list --keystore java_broker_keystore.jks -storepass password |
| |
| read -p "Press [Enter] key to continue..." |
| echo "Remove existing client keystore" |
| rm java_client_keystore.jks |
| echo "Re-create client keystore by importing RootCA certificate" |
| keytool -import -v -keystore java_client_keystore.jks -storepass password -alias RootCA -file CA_db/rootca.crt |
| |
| echo "Generate key for certificate 'app2'" |
| keytool -genkey -alias app2 -keyalg RSA -sigalg SHA1withRSA -validity 720 -keystore java_client_keystore.jks -storepass password -dname "CN=app2@acme.org, OU=art, O=acme, L=Toronto, ST=ON, C=CA" |
| echo "Export certificate signing request for 'app2'" |
| keytool -certreq -alias app2 -sigalg SHA1withRSA -keystore java_client_keystore.jks -storepass password -v -file app2.req |
| echo "Sign certificate 'app2' by entering:" |
| echo " n for 'Is this a CA certificate [y/N]?'" |
| echo " '-1' for 'Enter the path length constraint, enter to skip [<0 for unlimited path]: >'" |
| echo " n for 'Is this a critical extension [y/N]?'" |
| echo " password which was specified on creation root CA database." |
| certutil -C -d CA_db -c "MyRootCA" -a -i app2.req -o app2.crt -2 -6 --extKeyUsage clientAuth -v 60 -Z SHA1 |
| echo "Import signed certificate 'app2'" |
| keytool -import -v -alias app2 -keystore java_client_keystore.jks -storepass password -file app2.crt |
| |
| echo "Generate key for certificate 'app1'" |
| keytool -genkey -alias app1 -keyalg RSA -sigalg SHA1withRSA -validity 720 -keystore java_client_keystore.jks -storepass password -dname "CN=app1@acme.org, OU=art, O=acme, L=Toronto, ST=ON, C=CA" |
| echo "Export certificate signing request for 'app1'" |
| keytool -certreq -alias app1 -sigalg SHA1withRSA -keystore java_client_keystore.jks -storepass password -v -file app1.req |
| echo "Sign certificate 'app1' by entering:" |
| echo " n for 'Is this a CA certificate [y/N]?'" |
| echo " '-1' for 'Enter the path length constraint, enter to skip [<0 for unlimited path]: >'" |
| echo " n for 'Is this a critical extension [y/N]?'" |
| echo " password which was specified on creation of root CA database." |
| certutil -C -d CA_db -c "MyRootCA" -a -i app1.req -o app1.crt -2 -6 --extKeyUsage clientAuth -v 60 -Z SHA1 |
| echo "Import signed certificate 'app1'" |
| keytool -import -v -alias app1 -keystore java_client_keystore.jks -storepass password -file app1.crt |
| echo "List entries in client keystore" |
| keytool --list --keystore java_client_keystore.jks -storepass password |
| |
| read -p "Press [Enter] key to continue..." |
| echo "Remove existing client truststore" |
| rm java_client_truststore.jks |
| echo "Re-create client truststore by importing RootCA certificate" |
| keytool -import -v -keystore java_client_truststore.jks -storepass password -alias RootCA -file CA_db/rootca.crt |
| echo "List entries in client trusttore" |
| keytool --list --keystore java_client_truststore.jks -storepass password |
| |
| read -p "Press [Enter] key to continue..." |
| echo "Remove existing broker truststore" |
| rm java_broker_truststore.jks |
| echo "Re-create broker truststore by importing RootCA certificate" |
| keytool -import -v -keystore java_broker_truststore.jks -storepass password -alias RootCA -file CA_db/rootca.crt |
| echo "List entries in broker truststore" |
| keytool --list --keystore java_broker_truststore.jks -storepass password |
| |
| read -p "Press [Enter] key to continue..." |
| echo "Remove existing broker peerstore" |
| rm java_broker_peerstore.jks |
| echo "Re-create broker peerstore by importing app1 certificate" |
| keytool -import -v -keystore java_broker_peerstore.jks -storepass password -alias app1 -file app1.crt |
| echo "List entries in broker peerstore" |
| keytool --list --keystore java_broker_peerstore.jks -storepass password |
| |
