From f74704c7d963ddcd1109843a5861c6bd76409c8d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Otto=20Kek=C3=A4l=C3=A4inen?= Date: Tue, 14 Apr 2020 20:38:44 +0300 Subject: [PATCH] MDEV-18019, MDEV-18135: Renew test OpenSSL certs at level 3 security Touch attribute file to fix errors like: Can't open ./demoCA/index.txt.attr for reading, No such file or directory 140553384993216:error:02001002:system library: fopen:No such file or directory:../crypto/bio/bss_file.c:72: fopen('./demoCA/index.txt.attr','r') 140553384993216:error:2006D080:BIO routines: BIO_new_file:no such file:../crypto/bio/bss_file.c:79: Check that the request matches the signature --- mysql-test/lib/generate-ssl-certs.sh | 15 +- mysql-test/main/ssl.result | 4 +- mysql-test/std_data/cacert.pem | 166 +++++++++------ mysql-test/std_data/cakey.pem | 76 ++++--- mysql-test/std_data/client-cert.crl | 23 +- mysql-test/std_data/client-cert.pem | 156 +++++++++----- mysql-test/std_data/client-certkey.pem | 230 ++++++++++++-------- mysql-test/std_data/client-key.pem | 74 ++++--- mysql-test/std_data/crldir/ed1f42db.r0 | 23 +- mysql-test/std_data/server-cert.crl | 23 +- mysql-test/std_data/server-cert.pem | 156 +++++++++----- mysql-test/std_data/server-key.pem | 74 ++++--- mysql-test/std_data/server-new-cert.pem | 156 +++++++++----- mysql-test/std_data/server-new-key.pem | 74 ++++--- mysql-test/std_data/server8k-cert.pem | 267 +++++++++++++----------- mysql-test/std_data/server8k-key.pem | 194 ++++++++--------- mysql-test/std_data/serversan-cert.pem | 148 ++++++++----- mysql-test/std_data/serversan-key.pem | 76 ++++--- 18 files changed, 1185 insertions(+), 750 deletions(-) diff --git a/mysql-test/lib/generate-ssl-certs.sh b/mysql-test/lib/generate-ssl-certs.sh index 3331b81b931..57caf3b7a4e 100755 --- a/mysql-test/lib/generate-ssl-certs.sh +++ b/mysql-test/lib/generate-ssl-certs.sh @@ -9,21 +9,26 @@ cd std_data/ rm -rf demoCA mkdir demoCA demoCA/newcerts touch demoCA/index.txt +touch demoCA/index.txt.attr echo 01 > demoCA/serial echo 01 > demoCA/crlnumber +# Use rsa:3072 at minimum for all keys to be future compatible with next OpenSSL releases +# See level 3 in https://www.openssl.org/docs/man1.1.0/man3/SSL_CTX_set_security_level.html +# Following industry practice, jump directly to rsa:4096 instead of just rsa:3072. + # CA certificate, self-signed -openssl req -x509 -newkey rsa:2048 -keyout cakey.pem -out cacert.pem -days 7300 -nodes -subj '/CN=cacert/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB' -text +openssl req -x509 -newkey rsa:4096 -keyout cakey.pem -out cacert.pem -days 7300 -nodes -subj '/CN=cacert/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB' -text # server certificate signing request and private key. Note the very long subject (for MDEV-7859) -openssl req -newkey rsa:2048 -keyout server-key.pem -out demoCA/server-req.pem -days 7300 -nodes -subj '/CN=localhost/C=FI/ST=state or province within country, in other certificates in this file it is the same as L/L=location, usually an address but often ambiguously used/OU=organizational unit name, a division name within an organization/O=organization name, typically a company name' +openssl req -newkey rsa:4096 -keyout server-key.pem -out demoCA/server-req.pem -days 7300 -nodes -subj '/CN=localhost/C=FI/ST=state or province within country, in other certificates in this file it is the same as L/L=location, usually an address but often ambiguously used/OU=organizational unit name, a division name within an organization/O=organization name, typically a company name' # convert the key to yassl compatible format openssl rsa -in server-key.pem -out server-key.pem # sign the server certificate with CA certificate openssl ca -keyfile cakey.pem -days 7300 -batch -cert cacert.pem -policy policy_anything -out server-cert.pem -in demoCA/server-req.pem # server certificate with different validity period (MDEV-7598) -openssl req -newkey rsa:2048 -keyout server-new-key.pem -out demoCA/server-new-req.pem -days 7301 -nodes -subj '/CN=server-new/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB' +openssl req -newkey rsa:4096 -keyout server-new-key.pem -out demoCA/server-new-req.pem -days 7301 -nodes -subj '/CN=server-new/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB' openssl rsa -in server-new-key.pem -out server-new-key.pem openssl ca -keyfile cakey.pem -days 7301 -batch -cert cacert.pem -policy policy_anything -out server-new-cert.pem -in demoCA/server-new-req.pem @@ -36,11 +41,11 @@ openssl ca -keyfile cakey.pem -days 7300 -batch -cert cacert.pem -policy policy_ cat > demoCA/sanext.conf <