Initial commit, basic SSL server with its own CA and localhost certificates

diff --git a/amazon_cert_server.py b/amazon_cert_server.py
new file mode 100755 (executable)
index 0000000..56d406d
--- /dev/null
+++ b/amazon_cert_server.py
@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+
+import http.server
+import ssl
+
+httpd = http.server.HTTPServer(
+  ('localhost', 8443),
+  http.server.SimpleHTTPRequestHandler
+)
+httpd.socket = ssl.wrap_socket(
+  httpd.socket, 
+  keyfile = 'ssl/localhost_key.pem', 
+  certfile = 'ssl/localhost_cert_bundle.pem',
+  server_side = True
+)
+httpd.serve_forever()

diff --git a/index.html b/index.html
new file mode 100644 (file)
index 0000000..cc258ba
--- /dev/null
+++ b/index.html
@@ -0,0 +1 @@
+<html><body>Hello, world</body></html>

diff --git a/ssl/ca.conf b/ssl/ca.conf
new file mode 100644 (file)
index 0000000..d0d9a5f
--- /dev/null
+++ b/ssl/ca.conf
@@ -0,0 +1,25 @@
+[ ca ]
+default_ca      = CA_default            # The default ca section
+
+[ CA_default ]
+
+#dir            = ./demoCA              # top dir
+#database       = $dir/index.txt        # index file.
+#new_certs_dir  = $dir/newcerts         # new certs dir
+#
+#certificate    = $dir/cacert.pem       # The CA cert
+#serial         = $dir/serial           # serial no file
+#private_key    = $dir/private/cakey.pem# CA private key
+#RANDFILE       = $dir/private/.rand    # random number file
+#
+default_days   = 365                   # how long to certify for
+#default_crl_days= 30                   # how long before next CRL
+#default_md     = md5                   # md to use
+#
+#policy         = policy_any            # default policy
+#email_in_dn    = no                    # Don't add the email into cert DN
+#
+#name_opt       = ca_default            # Subject name display option
+#cert_opt       = ca_default            # Certificate display option
+#copy_extensions = none
+copy_extensions = copyall

diff --git a/ssl/ca_cert.pem b/ssl/ca_cert.pem
new file mode 100644 (file)
index 0000000..c4db8d8
--- /dev/null
+++ b/ssl/ca_cert.pem
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDazCCAlOgAwIBAgIUHS0UI6UJ6pE2o2FaPgcnjxikMW0wDQYJKoZIhvcNAQEL
+BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMDAzMTYwMjM0NDVaFw0yMDA0
+MTUwMjM0NDVaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
+HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDLY+eBF29tRNWwNb4uDdWUAs+7jDybeos94E8tgPKO
+JEc2flBwolka9GU357x9J5v2KCnOuCkKArhL2tmkms5f2F4Eezb/l9DnryUdckqC
+MI2bwAz/a/T+3HLjqI4l5mawE21JXNggqAccixRUY/gK3+V7M+zOdpwRc4v7Ca0R
+sBwwfve8Ws8xqKryVFvzJM0QXiAjZvxMpLygdbnmjCKKVCY00Mfh20KqHYBMIMHa
+M0RhdRrvi8/2oPfRcMByjZdjn8BQ+yUwQXbzP2MC+iq87lLuxUxEYGaQU4nzIMH1
+7Ga05t6zhF41jqDnrbjKgbgxPGNNxvau/rrpCnr++NQ/AgMBAAGjUzBRMB0GA1Ud
+DgQWBBRBtnDR6bDQjBctACDXe2FTsASBEzAfBgNVHSMEGDAWgBRBtnDR6bDQjBct
+ACDXe2FTsASBEzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB+
+P04SITLD9M6QNRkVagJ2N1Fp5GPmwX/cNj/kFDvyW/5Wt7mloG7DBmz1G749kpIX
+Zcb7cjuSLEyxQGeF1fujq+yHtVGdx8fS9b50s+2oDlpIoCOkXqIG8ktIbRv6FtzC
+UfYGzBmqybw2byVOQ+FoJT7pGJwKWgTrGXlTkmjk39j/Qyv+V3NXjWH5CDIAnj7V
++xTmySLHI68NVnIL2rBcgS/6eOS8nuuVIjSG+gZv8aHGl2btxZQCg/iDx1anRwpj
+Fy6o9yNoeWfEY5qFWVYKoNi5tC6JBsOYwgdN7VMGGeqadAzG0FnLKLxuvMqUHsSa
+1ywzBVq0Ab07rkaL0HKW
+-----END CERTIFICATE-----

diff --git a/ssl/ca_cert.srl b/ssl/ca_cert.srl
new file mode 100644 (file)
index 0000000..b882cea
--- /dev/null
+++ b/ssl/ca_cert.srl
@@ -0,0 +1 @@
+D29D1C6A226490AD

diff --git a/ssl/ca_key.pem b/ssl/ca_key.pem
new file mode 100644 (file)
index 0000000..e65d8ce
--- /dev/null
+++ b/ssl/ca_key.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAy2PngRdvbUTVsDW+Lg3VlALPu4w8m3qLPeBPLYDyjiRHNn5Q
+cKJZGvRlN+e8fSeb9igpzrgpCgK4S9rZpJrOX9heBHs2/5fQ568lHXJKgjCNm8AM
+/2v0/txy46iOJeZmsBNtSVzYIKgHHIsUVGP4Ct/lezPsznacEXOL+wmtEbAcMH73
+vFrPMaiq8lRb8yTNEF4gI2b8TKS8oHW55owiilQmNNDH4dtCqh2ATCDB2jNEYXUa
+74vP9qD30XDAco2XY5/AUPslMEF28z9jAvoqvO5S7sVMRGBmkFOJ8yDB9exmtObe
+s4ReNY6g5624yoG4MTxjTcb2rv666Qp6/vjUPwIDAQABAoIBAA3vOEsl2eJ4ltNN
+u0vYcsuDLcxBnV1hleyVU5dggD2wypg3KzesR8KK/+xGmilQ72R79/FLuLQQ36OC
+yOp4GK+EWVyhPHFia1OUMkzEKcqlnO4QyFMviEd1vwFN6P87u8lQa2pdTAlguawA
+81Gcz7+e+0/njM/QXHztl6eJUCwn7zEbG8+we0g8GkLILOBA3Tuy5Vu+ox1LQZQp
+WPqIMhm0GXPOVRKBr0mPVWtJvyAYvTX13GqNM1YFbElkbnkbsTaJhg/L3J9UJNsm
+BbOg0oUdq1yWoy7cjOXiq3aG9rNws9PBXbbDB/G67aae/1SJ7eBTV/kCEuYh0YDx
+MSn5xYECgYEA/uZueW4dFTKMBebNFvJreQei1ecaGwEFckUYD5u02VugtYc9inQ2
+sK7ENq/CsA10WKBxV84lIdiG5yXjG1RwCLvTV6YBP5uL9dVMln25x6ZDUxOlYzuZ
+OZUcabR3Y3Ar349vDV+vFle47J0YW8H89O5YlVxvLfZ+CFFFSBSMRCECgYEAzESS
+5IvNH1RUCR0tqRkHA0SXMiNxF85lFbUrbS2yMI60LCaTE2q/uK5008f5laD3LYKU
+Gq7SVP1U4z0+g9jGa0rvYd1h3o6fJMrFBiBN1ZRRzMFaiQxxNbyjCV7LR86m6aSo
+pz4f7k8EmzrsmZw7MF/l9Dy3AWHpg1cwYdR6DF8CgYB17kS0d6aK9Rzlahf/At+I
+WmkTD937Gmjbqm3sYry0R3k+IzjswsG+0szDBGRNsZvfmTN3TU/OrfAUJ2pAbbt7
+vvKTvaEcPanubeYGRlrarOi/GfrNw3grtPo1SaJm5jHWN/VIObm225UaG8B2S3Tu
+GQvw5pglqsI6tOcZ5y/SIQKBgBVJuD1VTIVNVoy0m8OZth9jEJbLFsgyXFqMzP/N
+2VoyJRjM1FsbrutiUw6XMq2jXt9BUooNWiI9XJFqGo/HEbaw0o3ScpatKmy9LRdc
+WoA9uuCp7fOGdm3xQNSDKpBLOx3yaRk04kMFvScoVuwTWh/Kfr6bbT8Zoypq9cHc
+UPPlAoGBAIEtVPhH6R51/HREPMWXWgwZujkeD0VQX+hNP8VOgSlts9L4bDn7res5
+DXHDXU3Q+vY+86qDvJgJaOdmt7IoNXgRlU9tUZP4MD8YG32Xjn3dnB5e/3SmBJwD
+NV4mVx+7X6me5rb4NdpMcSzulVXy3SfnQTaDsNghpcTqOXLFI0ti
+-----END RSA PRIVATE KEY-----

diff --git a/ssl/localhost.conf b/ssl/localhost.conf
new file mode 100644 (file)
index 0000000..fa3ef54
--- /dev/null
+++ b/ssl/localhost.conf
@@ -0,0 +1,66 @@
+# The main section is named req because the command we are using is req
+# (openssl req ...)
+[ req ]
+## This specifies the default key size in bits. If not specified then 512 is
+## used. It is used if the -new option is used. It can be overridden by using
+## the -newkey option. 
+#default_bits = 2048
+#
+## This is the default filename to write a private key to. If not specified the
+## key is written to standard output. This can be overridden by the -keyout
+## option.
+#default_keyfile = oats.key
+#
+## If this is set to no then if a private key is generated it is not encrypted.
+## This is equivalent to the -nodes command line option. For compatibility
+## encrypt_rsa_key is an equivalent option. 
+#encrypt_key = no
+
+# This option specifies the digest algorithm to use. Possible values include
+# md5 sha1 mdc2. If not present then MD5 is used. This option can be overridden
+# on the command line.
+default_md = sha1
+
+# if set to the value no this disables prompting of certificate fields and just
+# takes values from the config file directly. It also changes the expected
+# format of the distinguished_name and attributes sections.
+prompt = no
+
+# if set to the value yes then field values to be interpreted as UTF8 strings,
+# by default they are interpreted as ASCII. This means that the field values,
+# whether prompted from a terminal or obtained from a configuration file, must
+# be valid UTF8 strings.
+utf8 = yes
+
+# This specifies the section containing the distinguished name fields to
+# prompt for when generating a certificate or certificate request.
+distinguished_name = my_req_distinguished_name
+
+# this specifies the configuration file section containing a list of extensions
+# to add to the certificate request. It can be overridden by the -reqexts
+# command line switch. See the x509v3_config(5) manual page for details of the
+# extension section format.
+req_extensions = my_extensions
+
+[ my_req_distinguished_name ]
+C = PT
+ST = Lisboa
+L = Lisboa
+O  = Oats In The Water
+#CN = *.oats.org
+CN = localhost
+
+[ my_extensions ]
+basicConstraints=CA:FALSE
+subjectAltName=@my_subject_alt_names
+subjectKeyIdentifier = hash
+
+[ my_subject_alt_names ]
+#DNS.1 = *.oats.org
+#DNS.2 = *.oats.net
+#DNS.3 = *.oats.in
+#DNS.4 = oats.org
+#DNS.5 = oats.net
+#DNS.6 = oats.in
+DNS.1 = localhost
+DNS.2 = localhost.localdomain

diff --git a/ssl/localhost_cert.pem b/ssl/localhost_cert.pem
new file mode 100644 (file)
index 0000000..1b3206f
--- /dev/null
+++ b/ssl/localhost_cert.pem
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDgDCCAmigAwIBAgIJANKdHGoiZJCtMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
+BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
+aWRnaXRzIFB0eSBMdGQwHhcNMjAwMzE2MDIzNDQ1WhcNMjAwNDE1MDIzNDQ1WjBf
+MQswCQYDVQQGEwJQVDEPMA0GA1UECAwGTGlzYm9hMQ8wDQYDVQQHDAZMaXNib2Ex
+GjAYBgNVBAoMEU9hdHMgSW4gVGhlIFdhdGVyMRIwEAYDVQQDDAlsb2NhbGhvc3Qw
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDJLav5I1Dxx9Lzv7DyHig
+ApIkm9U8tcRKuM3Q4q3xj8P2VmSHVHZ0FfjKs/NZ8hLi3go+EzGolmiRKPA7V9UQ
+Zgm5MmC6tewiol76lsjehUKuG+DmT3n79xSHsj5PC6wkE/IkifcQIeGVJWgQbRR4
+JSGaX4tmmpxNrDDgpVnaXEO8I5KR/jvniAn2DoTKlY5XSIUXlbZQPHdlLdLUU7in
+5M19b9qnIdJRxa4mcOWNtsUHU16SJZAmQBmg4vAhMc4XyJ23YE8cNxUxusKrhoUB
+sWmvjGgbbaYgtwBmCFQNSFiJhyzgg6sdUot7wVXDkXBTJPQRQO82CJyw6YoDnTCL
+AgMBAAGjWTBXMAkGA1UdEwQCMAAwKwYDVR0RBCQwIoIJbG9jYWxob3N0ghVsb2Nh
+bGhvc3QubG9jYWxkb21haW4wHQYDVR0OBBYEFPKfGhTkosDI90l245Si/Ce/CLr/
+MA0GCSqGSIb3DQEBCwUAA4IBAQBHSHgAnIC3GKeoQDr7b/dReXuhHCl/+OUZFHsI
+Bn2rIF7YBPzBEaREpZnNt9MB0g6XvMHMHN2r7j0LWTfXe7/pDrVmwnh2OlHMy8UQ
+6QEs9QE7kPF0RhnQ8ImIBISCMf5kPDveAB3WCZKRb8OB3LSJ7kWWpS0PEax/wdD1
+MPd7cqVT5JafyZNU1DsKxdSok+a6q7a5tooD5Ha72Z5azsXFE+xSu72fMpXZcq8g
+uPuE4f6EW0xRn6/wMN1dgz4+wNkVDztgo2WdTA5pNI8dy3A7fDMXT9ukUWyazlr8
+53Fdb9zti7pMicA8kfVRExtQPRX9VCy7NH4UETkRBPr/VmS3
+-----END CERTIFICATE-----

diff --git a/ssl/localhost_cert_bundle.pem b/ssl/localhost_cert_bundle.pem
new file mode 100644 (file)
index 0000000..0c1c9db
--- /dev/null
+++ b/ssl/localhost_cert_bundle.pem
@@ -0,0 +1,42 @@
+-----BEGIN CERTIFICATE-----
+MIIDgDCCAmigAwIBAgIJANKdHGoiZJCtMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
+BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
+aWRnaXRzIFB0eSBMdGQwHhcNMjAwMzE2MDIzNDQ1WhcNMjAwNDE1MDIzNDQ1WjBf
+MQswCQYDVQQGEwJQVDEPMA0GA1UECAwGTGlzYm9hMQ8wDQYDVQQHDAZMaXNib2Ex
+GjAYBgNVBAoMEU9hdHMgSW4gVGhlIFdhdGVyMRIwEAYDVQQDDAlsb2NhbGhvc3Qw
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDJLav5I1Dxx9Lzv7DyHig
+ApIkm9U8tcRKuM3Q4q3xj8P2VmSHVHZ0FfjKs/NZ8hLi3go+EzGolmiRKPA7V9UQ
+Zgm5MmC6tewiol76lsjehUKuG+DmT3n79xSHsj5PC6wkE/IkifcQIeGVJWgQbRR4
+JSGaX4tmmpxNrDDgpVnaXEO8I5KR/jvniAn2DoTKlY5XSIUXlbZQPHdlLdLUU7in
+5M19b9qnIdJRxa4mcOWNtsUHU16SJZAmQBmg4vAhMc4XyJ23YE8cNxUxusKrhoUB
+sWmvjGgbbaYgtwBmCFQNSFiJhyzgg6sdUot7wVXDkXBTJPQRQO82CJyw6YoDnTCL
+AgMBAAGjWTBXMAkGA1UdEwQCMAAwKwYDVR0RBCQwIoIJbG9jYWxob3N0ghVsb2Nh
+bGhvc3QubG9jYWxkb21haW4wHQYDVR0OBBYEFPKfGhTkosDI90l245Si/Ce/CLr/
+MA0GCSqGSIb3DQEBCwUAA4IBAQBHSHgAnIC3GKeoQDr7b/dReXuhHCl/+OUZFHsI
+Bn2rIF7YBPzBEaREpZnNt9MB0g6XvMHMHN2r7j0LWTfXe7/pDrVmwnh2OlHMy8UQ
+6QEs9QE7kPF0RhnQ8ImIBISCMf5kPDveAB3WCZKRb8OB3LSJ7kWWpS0PEax/wdD1
+MPd7cqVT5JafyZNU1DsKxdSok+a6q7a5tooD5Ha72Z5azsXFE+xSu72fMpXZcq8g
+uPuE4f6EW0xRn6/wMN1dgz4+wNkVDztgo2WdTA5pNI8dy3A7fDMXT9ukUWyazlr8
+53Fdb9zti7pMicA8kfVRExtQPRX9VCy7NH4UETkRBPr/VmS3
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDazCCAlOgAwIBAgIUHS0UI6UJ6pE2o2FaPgcnjxikMW0wDQYJKoZIhvcNAQEL
+BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMDAzMTYwMjM0NDVaFw0yMDA0
+MTUwMjM0NDVaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
+HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDLY+eBF29tRNWwNb4uDdWUAs+7jDybeos94E8tgPKO
+JEc2flBwolka9GU357x9J5v2KCnOuCkKArhL2tmkms5f2F4Eezb/l9DnryUdckqC
+MI2bwAz/a/T+3HLjqI4l5mawE21JXNggqAccixRUY/gK3+V7M+zOdpwRc4v7Ca0R
+sBwwfve8Ws8xqKryVFvzJM0QXiAjZvxMpLygdbnmjCKKVCY00Mfh20KqHYBMIMHa
+M0RhdRrvi8/2oPfRcMByjZdjn8BQ+yUwQXbzP2MC+iq87lLuxUxEYGaQU4nzIMH1
+7Ga05t6zhF41jqDnrbjKgbgxPGNNxvau/rrpCnr++NQ/AgMBAAGjUzBRMB0GA1Ud
+DgQWBBRBtnDR6bDQjBctACDXe2FTsASBEzAfBgNVHSMEGDAWgBRBtnDR6bDQjBct
+ACDXe2FTsASBEzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB+
+P04SITLD9M6QNRkVagJ2N1Fp5GPmwX/cNj/kFDvyW/5Wt7mloG7DBmz1G749kpIX
+Zcb7cjuSLEyxQGeF1fujq+yHtVGdx8fS9b50s+2oDlpIoCOkXqIG8ktIbRv6FtzC
+UfYGzBmqybw2byVOQ+FoJT7pGJwKWgTrGXlTkmjk39j/Qyv+V3NXjWH5CDIAnj7V
++xTmySLHI68NVnIL2rBcgS/6eOS8nuuVIjSG+gZv8aHGl2btxZQCg/iDx1anRwpj
+Fy6o9yNoeWfEY5qFWVYKoNi5tC6JBsOYwgdN7VMGGeqadAzG0FnLKLxuvMqUHsSa
+1ywzBVq0Ab07rkaL0HKW
+-----END CERTIFICATE-----

diff --git a/ssl/localhost_csr.pem b/ssl/localhost_csr.pem
new file mode 100644 (file)
index 0000000..b28c691
--- /dev/null
+++ b/ssl/localhost_csr.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIDDDCCAfQCAQAwXzELMAkGA1UEBhMCUFQxDzANBgNVBAgMBkxpc2JvYTEPMA0G
+A1UEBwwGTGlzYm9hMRowGAYDVQQKDBFPYXRzIEluIFRoZSBXYXRlcjESMBAGA1UE
+AwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwyS2
+r+SNQ8cfS87+w8h4oAKSJJvVPLXESrjN0OKt8Y/D9lZkh1R2dBX4yrPzWfIS4t4K
+PhMxqJZokSjwO1fVEGYJuTJgurXsIqJe+pbI3oVCrhvg5k95+/cUh7I+TwusJBPy
+JIn3ECHhlSVoEG0UeCUhml+LZpqcTaww4KVZ2lxDvCOSkf4754gJ9g6EypWOV0iF
+F5W2UDx3ZS3S1FO4p+TNfW/apyHSUcWuJnDljbbFB1NekiWQJkAZoOLwITHOF8id
+t2BPHDcVMbrCq4aFAbFpr4xoG22mILcAZghUDUhYiYcs4IOrHVKLe8FVw5FwUyT0
+EUDvNgicsOmKA50wiwIDAQABoGgwZgYJKoZIhvcNAQkOMVkwVzAJBgNVHRMEAjAA
+MCsGA1UdEQQkMCKCCWxvY2FsaG9zdIIVbG9jYWxob3N0LmxvY2FsZG9tYWluMB0G
+A1UdDgQWBBTynxoU5KLAyPdJduOUovwnvwi6/zANBgkqhkiG9w0BAQUFAAOCAQEA
+L4XofNRjzahIDCj/pHVnsaXtioidv5Hp0vE+9LPhzZz/bH/e7s8lJnTalEkPNUxD
+FPwiRar6MILQwn5N1b+kToSoiYDsCL77Y5WSlhcwe7gLwgDTlNwu2H030BZEr0ve
+AEAems45TJk8o3kC5s3dt0KaGbRikub1HMTpFrlQUBLbO848t6qXcZCVjoAWYKlp
+jaYn7r3bWVyZ2W2oIlQ19Tbxz+kG81Vxrg1FtAo7aBHTaOvEskgnEQ2Emc0mbLoe
+YoT0Gg7Vrurl+T5gazmV1WMKszSjP8NKhTUcMESiRIUsmQczWiDBONiH9PGmGKHI
+7aEBzQIK7m3goyS3I4q6nw==
+-----END CERTIFICATE REQUEST-----

diff --git a/ssl/localhost_ext.conf b/ssl/localhost_ext.conf
new file mode 100644 (file)
index 0000000..d5005dc
--- /dev/null
+++ b/ssl/localhost_ext.conf
@@ -0,0 +1,13 @@
+basicConstraints=CA:FALSE
+subjectAltName=@my_subject_alt_names
+subjectKeyIdentifier = hash
+
+[ my_subject_alt_names ]
+#DNS.1 = *.oats.org
+#DNS.2 = *.oats.net
+#DNS.3 = *.oats.in
+#DNS.4 = oats.org
+#DNS.5 = oats.net
+#DNS.6 = oats.in
+DNS.1 = localhost
+DNS.2 = localhost.localdomain

diff --git a/ssl/localhost_key.pem b/ssl/localhost_key.pem
new file mode 100644 (file)
index 0000000..6c94353
--- /dev/null
+++ b/ssl/localhost_key.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAwyS2r+SNQ8cfS87+w8h4oAKSJJvVPLXESrjN0OKt8Y/D9lZk
+h1R2dBX4yrPzWfIS4t4KPhMxqJZokSjwO1fVEGYJuTJgurXsIqJe+pbI3oVCrhvg
+5k95+/cUh7I+TwusJBPyJIn3ECHhlSVoEG0UeCUhml+LZpqcTaww4KVZ2lxDvCOS
+kf4754gJ9g6EypWOV0iFF5W2UDx3ZS3S1FO4p+TNfW/apyHSUcWuJnDljbbFB1Ne
+kiWQJkAZoOLwITHOF8idt2BPHDcVMbrCq4aFAbFpr4xoG22mILcAZghUDUhYiYcs
+4IOrHVKLe8FVw5FwUyT0EUDvNgicsOmKA50wiwIDAQABAoIBAEuOiImcJbIrhAuX
+Lv9hPIs/05QHHk4uVr1TxqTtT8orDwXvN2dKpb6Wz0i02jFmUDe1HyQfzGdpLT2f
+Kzze6ik6SOODBP7l93MFiV7fSREXadT+CFtERIfxh+pucj+q1lD1xBivrpB5fd2A
+qUVK5tUKE3OxMMlebcyJMjeY7ixkRVgjROFeXs0t50xitzn/wPN0dVPZ6JFCPgRD
+fc72E1K+DmfrzFZ2+rzqoVzAE7OSYQns3r2jNXlCEVw2jXsmnIRIi9wejbRthjbx
+gA1IdenZcf4FkOMTTFuWGynT5tfF3cVzy5QtYemGZWSK4LNuWaTSzZCk3/sCxWk5
+Vbz/AdkCgYEA8gc2WEfbk5kVhU7UV5SRDRFtGuS8fmZ0RnqFdx6qy2EWYnwYXgzT
+cZc6TiEuJ5getmEVsqzxFm3gWMyD0bEhY0jqoMVKMM70QQOQOZOB4lykXmpRDKny
+/DU7/0bp7sBzFCKCWISCjGKWc98KWy24ZdKl8ZAr3zjDxE5UYvquKIcCgYEAzmie
+r+1Y7DUtniogqpDLr6NnuvH52d1s4DEsHZQ6KRWE82d/X+2YU2R7/0QwfLBvcbT7
+OxlQP5rRoL6pX+ViZBmky0CSc/HYZZ+8uGwFc1X46zGfuvTSWaAStdIFPOX2O0JF
+LLyF5/0/CK56agL3YxGREx2iQdauqTsOyr2LLN0CgYEAzYEgPN9u6ymd415m4KKO
+c1krmh1Ei9M0wa9A6j9I6H3cgu05x4n+c8HjyPlVdlstINDYmqlL4C6VwvCMsR1E
+60e7qZ07fKwNK7L54FmGfI0LJ/wAK8+WOV5+PiiZc5dHX35ZzQ1eyBLiCysEYR02
+KIcvTiiLh/NsDqAv+Qc/n7sCgYAup0z+3LnVoeturXz2sIWpbFi804ayrK64OcUL
+5n4C3T9QuNr8drqQVs0EFIiVFlgKLmr+n6kYx0iMeavU5gcIMxehbTXtCQPtbF5+
+nMPantsFZhEBc+a7pUe1WwQeEKhIGqGCDBaEKiR+NNmsboE2HjlZRcBv+zM9QwED
+6DW17QKBgQCRZfGUWasWXW6s9aZ1FgLPAXz/M9BLZjnx627KvbF4C+ZwfszntJxn
+1A74mhHWJyKbt8YzfOTsTj40lp/npSpgjRQmUoqThx8d2cA41ALo0ktk6E9Zpp1j
+phi0woa+TdEpqE2Jb8hJcyRKGCOVOKL/bnZL/QVgMebhg02n//wa9w==
+-----END RSA PRIVATE KEY-----

diff --git a/ssl/n.sh b/ssl/n.sh
new file mode 100755 (executable)
index 0000000..9fbf379
--- /dev/null
+++ b/ssl/n.sh
@@ -0,0 +1,30 @@
+#!/bin/sh
+
+# see https://gist.github.com/Soarez/9688998
+
+# note that the CSR contains X509 extensions, particularly the SAN which
+# is mandatory for getting Google Chrome to accept the certificate, but
+# unfortunately "openssl x509" will strip extensions -- this can be fixed
+# by using the "openssl ca" command with "extensions = copyall" (or in
+# the normal case filters would be specified on what extensions to copy),
+# but the "openssl ca" command is very complicated and requires a directory
+# structure to be set up, so we fake it with the "localhost_ext.conf" file
+
+# generate a key for the subject
+#openssl genrsa -out localhost_key.pem 2048
+
+# generate a CSR
+openssl req -new -key localhost_key.pem -out localhost_csr.pem -config localhost.conf
+
+# generate a key for the CA
+#openssl genrsa -out ca_key.pem 2048
+
+# generate a self signed certificate for the CA
+openssl req -new -x509 -key ca_key.pem -out ca_cert.pem
+
+# sign the certificate
+#openssl x509 -req -in localhost_csr.pem -extfile localhost_ext.conf -CA ca_cert.pem -CAkey ca_key.pem -CAcreateserial -out localhost_cert.pem
+openssl x509 -req -in localhost_csr.pem -extfile localhost_ext.conf -CA ca_cert.pem -CAkey ca_key.pem -CAserial ca_cert.srl -out localhost_cert.pem
+
+# resolve problems with not including the signing chain (can improve this?)
+cat localhost_cert.pem ca_cert.pem > localhost_cert_bundle.pem