mirror of
https://github.com/Detanup01/gbe_fork.git
synced 2024-11-23 11:15:34 +08:00
update cert third-party windows
This commit is contained in:
Sak32009
parent
07336fafed
commit
ac049cec52
Binary file not shown.
390
cert/openssl.cnf
390
cert/openssl.cnf
@ -1,390 +0,0 @@
|
||||
#
|
||||
# OpenSSL example configuration file.
|
||||
# See doc/man5/config.pod for more info.
|
||||
#
|
||||
# This is mostly being used for generation of certificate requests,
|
||||
# but may be used for auto loading of providers
|
||||
|
||||
# Note that you can include other files from the main configuration
|
||||
# file using the .include directive.
|
||||
#.include filename
|
||||
|
||||
# This definition stops the following lines choking if HOME isn't
|
||||
# defined.
|
||||
HOME = .
|
||||
|
||||
# Use this in order to automatically load providers.
|
||||
openssl_conf = openssl_init
|
||||
|
||||
# Comment out the next line to ignore configuration errors
|
||||
config_diagnostics = 1
|
||||
|
||||
# Extra OBJECT IDENTIFIER info:
|
||||
# oid_file = $ENV::HOME/.oid
|
||||
oid_section = new_oids
|
||||
|
||||
# To use this configuration file with the "-extfile" option of the
|
||||
# "openssl x509" utility, name here the section containing the
|
||||
# X.509v3 extensions to use:
|
||||
# extensions =
|
||||
# (Alternatively, use a configuration file that has only
|
||||
# X.509v3 extensions in its main [= default] section.)
|
||||
|
||||
[ new_oids ]
|
||||
# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
|
||||
# Add a simple OID like this:
|
||||
# testoid1=1.2.3.4
|
||||
# Or use config file substitution like this:
|
||||
# testoid2=${testoid1}.5.6
|
||||
|
||||
# Policies used by the TSA examples.
|
||||
tsa_policy1 = 1.2.3.4.1
|
||||
tsa_policy2 = 1.2.3.4.5.6
|
||||
tsa_policy3 = 1.2.3.4.5.7
|
||||
|
||||
# For FIPS
|
||||
# Optionally include a file that is generated by the OpenSSL fipsinstall
|
||||
# application. This file contains configuration data required by the OpenSSL
|
||||
# fips provider. It contains a named section e.g. [fips_sect] which is
|
||||
# referenced from the [provider_sect] below.
|
||||
# Refer to the OpenSSL security policy for more information.
|
||||
# .include fipsmodule.cnf
|
||||
|
||||
[openssl_init]
|
||||
providers = provider_sect
|
||||
|
||||
# List of providers to load
|
||||
[provider_sect]
|
||||
default = default_sect
|
||||
# The fips section name should match the section name inside the
|
||||
# included fipsmodule.cnf.
|
||||
# fips = fips_sect
|
||||
|
||||
# If no providers are activated explicitly, the default one is activated implicitly.
|
||||
# See man 7 OSSL_PROVIDER-default for more details.
|
||||
#
|
||||
# If you add a section explicitly activating any other provider(s), you most
|
||||
# probably need to explicitly activate the default provider, otherwise it
|
||||
# becomes unavailable in openssl. As a consequence applications depending on
|
||||
# OpenSSL may not work correctly which could lead to significant system
|
||||
# problems including inability to remotely access the system.
|
||||
[default_sect]
|
||||
# activate = 1
|
||||
|
||||
|
||||
####################################################################
|
||||
[ ca ]
|
||||
default_ca = CA_default # The default ca section
|
||||
|
||||
####################################################################
|
||||
[ CA_default ]
|
||||
|
||||
dir = ./demoCA # Where everything is kept
|
||||
certs = $dir/certs # Where the issued certs are kept
|
||||
crl_dir = $dir/crl # Where the issued crl are kept
|
||||
database = $dir/index.txt # database index file.
|
||||
#unique_subject = no # Set to 'no' to allow creation of
|
||||
# several certs with same subject.
|
||||
new_certs_dir = $dir/newcerts # default place for new certs.
|
||||
|
||||
certificate = $dir/cacert.pem # The CA certificate
|
||||
serial = $dir/serial # The current serial number
|
||||
crlnumber = $dir/crlnumber # the current crl number
|
||||
# must be commented out to leave a V1 CRL
|
||||
crl = $dir/crl.pem # The current CRL
|
||||
private_key = $dir/private/cakey.pem # The private key
|
||||
|
||||
x509_extensions = usr_cert # The extensions to add to the cert
|
||||
|
||||
# Comment out the following two lines for the "traditional"
|
||||
# (and highly broken) format.
|
||||
name_opt = ca_default # Subject Name options
|
||||
cert_opt = ca_default # Certificate field options
|
||||
|
||||
# Extension copying option: use with caution.
|
||||
# copy_extensions = copy
|
||||
|
||||
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
|
||||
# so this is commented out by default to leave a V1 CRL.
|
||||
# crlnumber must also be commented out to leave a V1 CRL.
|
||||
# crl_extensions = crl_ext
|
||||
|
||||
default_days = 365 # how long to certify for
|
||||
default_crl_days= 30 # how long before next CRL
|
||||
default_md = default # use public key default MD
|
||||
preserve = no # keep passed DN ordering
|
||||
|
||||
# A few difference way of specifying how similar the request should look
|
||||
# For type CA, the listed attributes must be the same, and the optional
|
||||
# and supplied fields are just that :-)
|
||||
policy = policy_match
|
||||
|
||||
# For the CA policy
|
||||
[ policy_match ]
|
||||
countryName = match
|
||||
stateOrProvinceName = match
|
||||
organizationName = match
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
# For the 'anything' policy
|
||||
# At this point in time, you must list all acceptable 'object'
|
||||
# types.
|
||||
[ policy_anything ]
|
||||
countryName = optional
|
||||
stateOrProvinceName = optional
|
||||
localityName = optional
|
||||
organizationName = optional
|
||||
organizationalUnitName = optional
|
||||
commonName = supplied
|
||||
emailAddress = optional
|
||||
|
||||
####################################################################
|
||||
[ req ]
|
||||
default_bits = 2048
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
x509_extensions = v3_ca # The extensions to add to the self signed cert
|
||||
|
||||
# Passwords for private keys if not present they will be prompted for
|
||||
# input_password = secret
|
||||
# output_password = secret
|
||||
|
||||
# This sets a mask for permitted string types. There are several options.
|
||||
# default: PrintableString, T61String, BMPString.
|
||||
# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
|
||||
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
|
||||
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
|
||||
# MASK:XXXX a literal mask value.
|
||||
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
|
||||
string_mask = utf8only
|
||||
|
||||
# req_extensions = v3_req # The extensions to add to a certificate request
|
||||
|
||||
[ req_distinguished_name ]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = AU
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = Some-State
|
||||
|
||||
localityName = Locality Name (eg, city)
|
||||
|
||||
0.organizationName = Organization Name (eg, company)
|
||||
0.organizationName_default = Internet Widgits Pty Ltd
|
||||
|
||||
# we can do this but it is not needed normally :-)
|
||||
#1.organizationName = Second Organization Name (eg, company)
|
||||
#1.organizationName_default = World Wide Web Pty Ltd
|
||||
|
||||
organizationalUnitName = Organizational Unit Name (eg, section)
|
||||
#organizationalUnitName_default =
|
||||
|
||||
commonName = Common Name (e.g. server FQDN or YOUR name)
|
||||
commonName_max = 64
|
||||
|
||||
emailAddress = Email Address
|
||||
emailAddress_max = 64
|
||||
|
||||
# SET-ex3 = SET extension number 3
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = A challenge password
|
||||
challengePassword_min = 4
|
||||
challengePassword_max = 20
|
||||
|
||||
unstructuredName = An optional company name
|
||||
|
||||
[ usr_cert ]
|
||||
|
||||
# These extensions are added when 'ca' signs a request.
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
# This is required for TSA certificates.
|
||||
# extendedKeyUsage = critical,timeStamping
|
||||
|
||||
[ v3_req ]
|
||||
|
||||
# Extensions to add to a certificate request
|
||||
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
[ v3_ca ]
|
||||
|
||||
|
||||
# Extensions for a typical CA
|
||||
|
||||
|
||||
# PKIX recommendation.
|
||||
|
||||
subjectKeyIdentifier=hash
|
||||
|
||||
authorityKeyIdentifier=keyid:always,issuer
|
||||
|
||||
basicConstraints = critical,CA:true
|
||||
|
||||
# Key usage: this is typical for a CA certificate. However since it will
|
||||
# prevent it being used as an test self-signed certificate it is best
|
||||
# left out by default.
|
||||
# keyUsage = cRLSign, keyCertSign
|
||||
|
||||
# Include email address in subject alt name: another PKIX recommendation
|
||||
# subjectAltName=email:copy
|
||||
# Copy issuer details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
# DER hex encoding of an extension: beware experts only!
|
||||
# obj=DER:02:03
|
||||
# Where 'obj' is a standard or added object
|
||||
# You can even override a supported extension:
|
||||
# basicConstraints= critical, DER:30:03:01:01:FF
|
||||
|
||||
[ crl_ext ]
|
||||
|
||||
# CRL extensions.
|
||||
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
|
||||
|
||||
# issuerAltName=issuer:copy
|
||||
authorityKeyIdentifier=keyid:always
|
||||
|
||||
[ proxy_cert_ext ]
|
||||
# These extensions should be added when creating a proxy certificate
|
||||
|
||||
# This goes against PKIX guidelines but some CAs do it and some software
|
||||
# requires this to avoid interpreting an end user certificate as a CA.
|
||||
|
||||
basicConstraints=CA:FALSE
|
||||
|
||||
# This is typical in keyUsage for a client certificate.
|
||||
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
|
||||
# PKIX recommendations harmless if included in all certificates.
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
|
||||
# This stuff is for subjectAltName and issuerAltname.
|
||||
# Import the email address.
|
||||
# subjectAltName=email:copy
|
||||
# An alternative to produce certificates that aren't
|
||||
# deprecated according to PKIX.
|
||||
# subjectAltName=email:move
|
||||
|
||||
# Copy subject details
|
||||
# issuerAltName=issuer:copy
|
||||
|
||||
# This really needs to be in place for it to be a proxy certificate.
|
||||
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
|
||||
|
||||
####################################################################
|
||||
[ tsa ]
|
||||
|
||||
default_tsa = tsa_config1 # the default TSA section
|
||||
|
||||
[ tsa_config1 ]
|
||||
|
||||
# These are used by the TSA reply generation only.
|
||||
dir = ./demoCA # TSA root directory
|
||||
serial = $dir/tsaserial # The current serial number (mandatory)
|
||||
crypto_device = builtin # OpenSSL engine to use for signing
|
||||
signer_cert = $dir/tsacert.pem # The TSA signing certificate
|
||||
# (optional)
|
||||
certs = $dir/cacert.pem # Certificate chain to include in reply
|
||||
# (optional)
|
||||
signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
|
||||
signer_digest = sha256 # Signing digest to use. (Optional)
|
||||
default_policy = tsa_policy1 # Policy if request did not specify it
|
||||
# (optional)
|
||||
other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
|
||||
digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory)
|
||||
accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
|
||||
clock_precision_digits = 0 # number of digits after dot. (optional)
|
||||
ordering = yes # Is ordering defined for timestamps?
|
||||
# (optional, default: no)
|
||||
tsa_name = yes # Must the TSA name be included in the reply?
|
||||
# (optional, default: no)
|
||||
ess_cert_id_chain = no # Must the ESS cert id chain be included?
|
||||
# (optional, default: no)
|
||||
ess_cert_id_alg = sha256 # algorithm to compute certificate
|
||||
# identifier (optional, default: sha256)
|
||||
|
||||
[insta] # CMP using Insta Demo CA
|
||||
# Message transfer
|
||||
server = pki.certificate.fi:8700
|
||||
# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080
|
||||
# tls_use = 0
|
||||
path = pkix/
|
||||
|
||||
# Server authentication
|
||||
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
|
||||
ignore_keyusage = 1 # potentially needed quirk
|
||||
unprotected_errors = 1 # potentially needed quirk
|
||||
extracertsout = insta.extracerts.pem
|
||||
|
||||
# Client authentication
|
||||
ref = 3078 # user identification
|
||||
secret = pass:insta # can be used for both client and server side
|
||||
|
||||
# Generic message options
|
||||
cmd = ir # default operation, can be overridden on cmd line with, e.g., kur
|
||||
|
||||
# Certificate enrollment
|
||||
subject = "/CN=openssl-cmp-test"
|
||||
newkey = insta.priv.pem
|
||||
out_trusted = apps/insta.ca.crt # does not include keyUsage digitalSignature
|
||||
certout = insta.cert.pem
|
||||
|
||||
[pbm] # Password-based protection for Insta CA
|
||||
# Server and client authentication
|
||||
ref = $insta::ref # 3078
|
||||
secret = $insta::secret # pass:insta
|
||||
|
||||
[signature] # Signature-based protection for Insta CA
|
||||
# Server authentication
|
||||
trusted = $insta::out_trusted # apps/insta.ca.crt
|
||||
|
||||
# Client authentication
|
||||
secret = # disable PBM
|
||||
key = $insta::newkey # insta.priv.pem
|
||||
cert = $insta::certout # insta.cert.pem
|
||||
|
||||
[ir]
|
||||
cmd = ir
|
||||
|
||||
[cr]
|
||||
cmd = cr
|
||||
|
||||
[kur]
|
||||
# Certificate update
|
||||
cmd = kur
|
||||
oldcert = $insta::certout # insta.cert.pem
|
||||
|
||||
[rr]
|
||||
# Certificate revocation
|
||||
cmd = rr
|
||||
oldcert = $insta::certout # insta.cert.pem
|
||||
BIN
cert/openssl.exe
BIN
cert/openssl.exe
Binary file not shown.
184
cert/openssl/SOURCE.txt
Normal file
184
cert/openssl/SOURCE.txt
Normal file
@ -0,0 +1,184 @@
|
||||
============================================================================ INFO
|
||||
https://github.com/openssl/openssl
|
||||
|
||||
VERSION: https://github.com/openssl/openssl/tree/openssl-3.3.1
|
||||
|
||||
Pre-compiled binaries provided by Shining Light Productions (https://slproweb.com/products/Win32OpenSSL.html)
|
||||
|
||||
============================================================================ LICENSE
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
https://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
Binary file not shown.
BIN
cert/openssl/libssl-3-x64.dll
Normal file
BIN
cert/openssl/libssl-3-x64.dll
Normal file
Binary file not shown.
BIN
cert/openssl/openssl.exe
Normal file
BIN
cert/openssl/openssl.exe
Normal file
Binary file not shown.
@ -1,53 +1,46 @@
|
||||
@echo off
|
||||
setlocal EnableDelayedExpansion
|
||||
cd /d "%~dp0"
|
||||
|
||||
setlocal
|
||||
set "ROOT=%cd%"
|
||||
set "OPENSSL_EXE=%ROOT%\openssl\openssl.exe"
|
||||
set "SIGNTOOL_EXE=%ROOT%\signtool\signtool.exe"
|
||||
|
||||
set /a exit=0
|
||||
|
||||
set "file=%~1"
|
||||
if not defined file (
|
||||
set /a exit=1
|
||||
goto :end_script
|
||||
set "FILE=%~1"
|
||||
if not defined FILE (
|
||||
goto :end_script_with_err
|
||||
)
|
||||
|
||||
pushd "%~dp0"
|
||||
set "OPENSSL_CONF=%cd%\openssl.cnf"
|
||||
|
||||
set "filename=%random%"
|
||||
for %%A in ("%file%") do (
|
||||
set "filename=%random%-%%~nxA"
|
||||
set "FILENAME=%random%"
|
||||
for %%A in ("%FILE%") do (
|
||||
set "FILENAME=%random%-%%~nxA"
|
||||
)
|
||||
|
||||
:re_pvt
|
||||
call :gen_rnd rr
|
||||
set "pvt_file=%cd%\prvt-%rr%-%filename%.pem"
|
||||
set "PVT_FILE=%ROOT%\prvt-%rr%-%FILENAME%.pem"
|
||||
:: parallel build can generate same rand number
|
||||
if exist "%pvt_file%" (
|
||||
if exist "%PVT_FILE%" (
|
||||
goto :re_pvt
|
||||
)
|
||||
|
||||
:re_cer
|
||||
call :gen_rnd rr
|
||||
set "cer_file=%cd%\cert-%rr%-%filename%.pem"
|
||||
set "CER_FILE=%ROOT%\cert-%rr%-%FILENAME%.pem"
|
||||
:: parallel build can generate same rand number
|
||||
if exist "%cer_file%" (
|
||||
if exist "%CER_FILE%" (
|
||||
goto :re_cer
|
||||
)
|
||||
|
||||
:re_pfx
|
||||
call :gen_rnd rr
|
||||
set "pfx_file=%cd%\cfx-%rr%-%filename%.pfx"
|
||||
set "PFX_FILE=%ROOT%\cfx-%rr%-%FILENAME%.pfx"
|
||||
:: parallel build can generate same rand number
|
||||
if exist "%pfx_file%" (
|
||||
if exist "%PFX_FILE%" (
|
||||
goto :re_pfx
|
||||
)
|
||||
|
||||
set "openssl_exe=%cd%\openssl.exe"
|
||||
set "signtool_exe=%cd%\signtool.exe"
|
||||
|
||||
popd
|
||||
|
||||
call "%openssl_exe%" req -newkey rsa:2048 -nodes -keyout "%pvt_file%" -x509 -days 5525 -out "%cer_file%" ^
|
||||
call "%OPENSSL_EXE%" req -newkey rsa:2048 -nodes -keyout "%PVT_FILE%" -x509 -days 5525 -out "%CER_FILE%" ^
|
||||
-subj "/O=GSE/CN=GSE" ^
|
||||
-addext "extendedKeyUsage=codeSigning" ^
|
||||
-addext "basicConstraints=critical,CA:true" ^
|
||||
@ -59,44 +52,46 @@ call "%openssl_exe%" req -newkey rsa:2048 -nodes -keyout "%pvt_file%" -x509 -day
|
||||
-addext "issuerAltName=issuer:copy" ^
|
||||
-addext "nsComment=GSE" ^
|
||||
-extensions v3_req
|
||||
set /a exit+=%errorlevel%
|
||||
if %exit% neq 0 (
|
||||
goto :end_script
|
||||
if %errorlevel% neq 0 (
|
||||
goto :end_script_with_err
|
||||
)
|
||||
|
||||
call "%openssl_exe%" pkcs12 -export -out "%pfx_file%" -inkey "%pvt_file%" -in "%cer_file%" -passout pass:
|
||||
set /a exit+=%errorlevel%
|
||||
call "%OPENSSL_EXE%" pkcs12 -export -out "%PFX_FILE%" -inkey "%PVT_FILE%" -in "%CER_FILE%" -passout pass:
|
||||
|
||||
del /f /q "%cer_file%"
|
||||
del /f /q "%pvt_file%"
|
||||
del /f /q "%CER_FILE%"
|
||||
del /f /q "%PVT_FILE%"
|
||||
|
||||
if %exit% neq 0 (
|
||||
goto :end_script
|
||||
if %errorlevel% neq 0 (
|
||||
goto :end_script_with_err
|
||||
)
|
||||
|
||||
call "%signtool_exe%" sign /d "GSE" /fd sha256 /f "%pfx_file%" /p "" "%~1"
|
||||
set /a exit+=%errorlevel%
|
||||
if %exit% neq 0 (
|
||||
goto :end_script
|
||||
call "%SIGNTOOL_EXE%" sign /d "GSE" /fd sha256 /f "%PFX_FILE%" /p "" "%FILE%"
|
||||
|
||||
del /f /q "%PFX_FILE%"
|
||||
|
||||
if %errorlevel% neq 0 (
|
||||
goto :end_script_with_err
|
||||
)
|
||||
|
||||
del /f /q "%pfx_file%"
|
||||
|
||||
:: exit without error
|
||||
:end_script
|
||||
endlocal
|
||||
exit /b %exit%
|
||||
endlocal
|
||||
exit /b 0
|
||||
|
||||
:: exit with error
|
||||
:end_script_with_err
|
||||
endlocal
|
||||
exit /b 1
|
||||
|
||||
:: when every project is built in parallel '/MP' with Visual Studio,
|
||||
:: the regular random variable might be the same, causing racing
|
||||
:: this will waste some time and hopefully generate a different number
|
||||
:: 1: (ref) out random number
|
||||
:gen_rnd
|
||||
setlocal enabledelayedexpansion
|
||||
setlocal EnableDelayedExpansion
|
||||
for /l %%A in (1, 1, 10) do (
|
||||
set "_r=!random!"
|
||||
)
|
||||
endlocal & (
|
||||
endlocal
|
||||
set "%~1=%random%"
|
||||
exit /b
|
||||
)
|
||||
|
||||
Binary file not shown.
4
cert/signtool/SOURCE.txt
Normal file
4
cert/signtool/SOURCE.txt
Normal file
@ -0,0 +1,4 @@
|
||||
============================================================================ INFO
|
||||
https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool
|
||||
|
||||
VERSION: Windows SDK 10.0.22621.0
|
||||
BIN
cert/signtool/signtool.exe
Normal file
BIN
cert/signtool/signtool.exe
Normal file
Binary file not shown.
Binary file not shown.
Loading…
Reference in New Issue
Block a user