From 19fcec84d8d7d21e796c7624e521b60d28ee21ed Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 20:45:59 +0200 Subject: Adding upstream version 16.2.11+ds. Signed-off-by: Daniel Baumann --- src/jaegertracing/thrift/test/keys/README.md | 102 +++++++++++++++++++++++++++ 1 file changed, 102 insertions(+) create mode 100755 src/jaegertracing/thrift/test/keys/README.md (limited to 'src/jaegertracing/thrift/test/keys/README.md') diff --git a/src/jaegertracing/thrift/test/keys/README.md b/src/jaegertracing/thrift/test/keys/README.md new file mode 100755 index 000000000..010835d35 --- /dev/null +++ b/src/jaegertracing/thrift/test/keys/README.md @@ -0,0 +1,102 @@ +# Test Keys and Certificates +This folder is dedicated to test keys and certificates provided in multiple formats. +Primary use are unit test suites and cross language tests. + + test/keys + +**The files in this directory must never be used on production systems.** + +## SSL Keys and Certificates + + +## create certificates + +we use the following parameters for test key and certificate creation + + C=US, + ST=Maryland, + L=Forest Hill, + O=The Apache Software Foundation, + OU=Apache Thrift, + CN=localhost/emailAddress=dev@thrift.apache.org + +### create self-signed server key and certificate + + openssl req -new -x509 -nodes -days 3000 -out server.crt -keyout server.key + openssl x509 -in server.crt -text > CA.pem + cat server.crt server.key > server.pem + +Export password is "thrift" without the quotes + + openssl pkcs12 -export -clcerts -in server.crt -inkey server.key -out server.p12 + +### create client key and certificate + + openssl genrsa -out client.key + +create a signing request: + + openssl req -new -key client.key -out client.csr + +sign the client certificate with the server.key + + openssl x509 -req -days 3000 -in client.csr -CA CA.pem -CAkey server.key -set_serial 01 -out client.crt + +export certificate in PKCS12 format (Export password is "thrift" without the quotes) + + openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12 + +export certificate in PEM format for OpenSSL usage + + openssl pkcs12 -in client.p12 -out client.pem -clcerts + +### create client key and certificate with altnames + +copy openssl.cnf from your system e.g. /etc/ssl/openssl.cnf and append following to the end of [ v3_req ] + + subjectAltName=@alternate_names + + [ alternate_names ] + IP.1=127.0.0.1 + IP.2=::1 + IP.3=::ffff:127.0.0.1 + +create a signing request: + + openssl req -new -key client_v3.key -out client_v3.csr -config openssl.cnf \ + -subj "/C=US/ST=Maryland/L=Forest Hill/O=The Apache Software Foundation/OU=Apache Thrift/CN=localhost" -extensions v3_req + +sign the client certificate with the server.key + + openssl x509 -req -days 3000 -in client_v3.csr -CA CA.pem -CAkey server.key -set_serial 01 -out client_v3.crt -extensions v3_req -extfile openssl.cnf + +## Java key and certificate import +Java Test Environment uses key and trust store password "thrift" without the quotes + +list keystore entries + + keytool -list -storepass thrift -keystore ../../lib/java/test/.keystore + +list truststore entries + + keytool -list -storepass thrift -keystore ../../lib/java/test/.truststore + + +delete an entry + + keytool -delete -storepass thrift -keystore ../../lib/java/test/.truststore -alias ssltest + + +import certificate into truststore + + keytool -importcert -storepass thrift -keystore ../../lib/java/test/.truststore -alias localhost --file server.crt + +import key into keystore + + keytool -importkeystore -storepass thrift -keystore ../../lib/java/test/.keystore -srcstoretype pkcs12 -srckeystore server.p12 + +# Test SSL server and clients + + openssl s_client -connect localhost:9090 + openssl s_server -accept 9090 -www + -- cgit v1.2.3