tests/test_swtpm_cert

#!/usr/bin/env bash

cd "$(dirname "$0")" || exit 1

TMPDIR=$(mktemp -d) || exit 1
function cleanup()
{
	rm -rf "${TMPDIR}"
}
trap "cleanup" SIGTERM EXIT

# CA:
CACERT=${TMPDIR}/swtpm-localca-rootca-cert.pem
CAKEY=${TMPDIR}/swtpm-localca-rootca-privkey.pem

# EK keys:
RSAPRIVKEY=${TMPDIR}/rsaprivkey.pem
RSAPUBKEY=${TMPDIR}/rsapubkey.pem

# RSA 3072 key used for signing
RSA3072ENCRYPTED_PRIVKEY=${TMPDIR}/rsa3072privkey.pem
RSA3072ENCRYPTED_PUBKEY=${TMPDIR}/rsa3072pubkey.pem
ISSUERCERT_RSA3072ENCRYPTED_PRIVKEY=${TMPDIR}/rsa3072privkeyissuercert.pem

if ! msg=$(openssl genrsa -out "${RSAPRIVKEY}" 2432 2>&1) ||
   ! msg=$(openssl rsa -in "${RSAPRIVKEY}" -pubout -out "${RSAPUBKEY}" 2>&1) ||
   ! msg=$(openssl req \
	-x509 \
	-new \
	-noenc \
	-keyout "${CAKEY}" \
	-newkey rsa:3072 \
	-sha256 \
	-days 365 \
	-out "${CACERT}" \
	-subj "/CN=swtpm-localca-rootca" 2>&1) || \
   ! msg=$(openssl genrsa -out "${RSA3072ENCRYPTED_PRIVKEY}" -aes256 -passout pass:password 3072 2>&1) || \
   ! msg=$(openssl rsa     -in "${RSA3072ENCRYPTED_PRIVKEY}" -pubout -passin  pass:password -out "${RSA3072ENCRYPTED_PUBKEY}" 2>&1) || \
   ! msg=$(openssl req \
	-x509 \
	-key "${RSA3072ENCRYPTED_PRIVKEY}" \
	-passin pass:password \
	-out "${ISSUERCERT_RSA3072ENCRYPTED_PRIVKEY}" \
	-days 1000 \
	-subj "/CN=swtpm-localca" \
	-CA "${CACERT}" \
	-CAkey "${CAKEY}" 2>&1);
then
	echo "Could not create the required keys"
	echo "${msg}"
	exit 1
fi

PARAM_RSAPUBKEY="${RSAPUBKEY}" \
PARAM_PASSWORD=password \
PARAM_SIGNKEY_ENCRYPTED="${RSA3072ENCRYPTED_PRIVKEY}" \
PARAM_ISSUERCERT="${ISSUERCERT_RSA3072ENCRYPTED_PRIVKEY}" \
	./_test_swtpm_cert
ret=$?
[ $ret -ne 0 ] && exit $ret

exit 0