Commit ef6b34be authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

make EC test certificates usable for ECDH

parent becfdb99

demos/certs/apps/apps.cnf

+11 −0
Original line number Diff line number Diff line
@@ -39,6 +39,17 @@ keyUsage=critical, nonRepudiation, digitalSignature, keyEncipherment 
# This will be displayed in Netscape's comment listbox.

nsComment			= "OpenSSL Generated Certificate"



[ ec_cert ]



# These extensions are added when 'ca' signs a request for an end entity

# certificate



basicConstraints=critical, CA:FALSE

keyUsage=critical, nonRepudiation, digitalSignature, keyAgreement



# This will be displayed in Netscape's comment listbox.

nsComment			= "OpenSSL Generated Certificate"



# PKIX recommendations harmless if included in all certificates.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid

demos/certs/apps/mkxcerts.sh

+2 −2
Original line number Diff line number Diff line
@@ -19,11 +19,11 @@ $OPENSSL ecparam -name P-256 -out ecp256.pem 
$OPENSSL ecparam -name P-384 -out ecp384.pem



CN="OpenSSL Test P-256 SHA-256 cert" $OPENSSL req \

	-config apps.cnf -extensions usr_cert -x509 -nodes \

	-config apps.cnf -extensions ec_cert -x509 -nodes \

	-nodes -keyout tecp256.pem -out tecp256.pem -newkey ec:ecp256.pem \

	-days 3650 -sha256



CN="OpenSSL Test P-384 SHA-384 cert" $OPENSSL req \

	-config apps.cnf -extensions usr_cert -x509 -nodes \

	-config apps.cnf -extensions ec_cert -x509 -nodes \

	-nodes -keyout tecp384.pem -out tecp384.pem -newkey ec:ecp384.pem \

	-days 3650 -sha384