
mkdir ca

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out ca/ca.key

openssl req -new -x509 -days 3600 -key ca/ca.key -subj "/O=MyServer/CN=localhost" -out ca/ca.crt
# Convert cert to der format
openssl x509 -in ca/ca.crt -inform pem -out ca/ca.crt.der -outform der
# Create cert revocation list CRL file
mkdir demoCA
touch ./demoCA/index.txt
echo "1000">./demoCA/crlnumber
openssl ca -crldays 3600 -keyfile ca/ca.key -cert ca/ca.crt -gencrl -out ca/ca.crl
# Convert CRL to der format
openssl crl -in ca/ca.crl -inform pem -out ca/ca.der.crl -outform der

# Create directory to store server's file
mkdir server

echo "[v3_ca]
subjectAltName=DNS:localhost,DNS:DESKTOP-SMA29NK,IP:127.0.0.1,IP:192.168.10.36,URI:urn:unconfigurated:application
basicConstraints=CA:TRUE
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
keyUsage=digitalSignature,keyEncipherment
extendedKeyUsage=serverAuth,clientAuth,codeSigning" > ./server/exts.txt
# Create server key
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out server/server.key
# Convert server key to der format
openssl rsa -in server/server.key -inform pem -out server/server.key.der -outform der
# Create server cert sign request
openssl req -new -sha256 -key server/server.key -subj "/O=MyServer/CN=localhost" -out server/server.csr
#Sign cert sign request (NOTE: must provide exts.txt)
openssl x509 -days 3600 -req -in server/server.csr -extensions v3_ca -extfile server/exts.txt -CAcreateserial -CA ca/ca.crt -CAkey ca/ca.key -out server/server.crt
# Convert cert to der format
openssl x509 -in server/server.crt -inform pem -out server/server.crt.der -outform der
