Title: Demo BASH Scripts
Course: Introduction to SSL/PKI > Section: Demos

Demo BASH Scripts

Introduction

Bash shell scripts are provided that run an initial set of examples for the class. They assume the demo directory structure documented elsewhere but can be modified as required.

Special Note: The serial.txt and class_openssl.conf files are included in the scripts tar file. They are in linux/unix text format and ready to be used, and requre no additional processing or modification.

Extract the Scripts

Extract the scripts, etc. from the tar file into the root directory for the demonstration. For example:

$ cd <demoroot>
$ cp <somewhere>/linux_unix_scrips.tar .
$ tar xvf linux_unix_scripts.tar

Note: See the demonstration directory structure documented elsewhere.

scripts

Type | Description
Create
These scripts create PKI certificates in two steps.

The first step:
- creates the public and private keys
- creates a Certificate Signing Request (CSR) for the public key

The second step:
- creates a PKI certificate containing the public key and other information
- Signs the PKI certificate using the CA's provate key
View | These scripts display the information in certificates, keys, and Certificate Signng Requests (CSRs). This is usefull when explaning how PKI works.
Run | These scripts run the OpenSSL demonstration client and server. They also run the server as a web server.
Help | These scripts display OpenSSL demonstration client and server command line options. They informational and are good for debugging typos, etc.

Note: the "create_tar.bsh" scripts created the tar file containing the scripts.

How To Execute Scripts

$ cd <demoroot>
$ ./<scriptname>

For example: ./view_client_cert.bsh

Note: don't forget the "./" at the beginning of the command.

Special Instructions When Running "Create PKI Cert Step 1"

PKI certificates are tied to a specific identity. When creating a PKI certificate, you must enter a name for the subject of the certificate. This is be done in the the step 1 of the creation process.

Note: Not entirely true, but close enough for government work.

Enter nothing for the first question. (press return).
Enter a name for your server, client, etc. for the second question. For example, MyServer, Joe's Client, etc.

The following is a sample:

$ ./create_client_step1.bsh
Generating a 1024 bit RSA private key
.....++++++
..............................................++++++
writing new private key to 'keys/client.key'
-----
You are about to be asked to enter information that will
be incorporated into your certificate request.
What you are about to enter is what is called a Distinguished
Name or a DN. There are quite a few fields but you can leave
some blank For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Organization Name (eg, company) [ClassCA]:
Common Name (eg, YOUR name) []:MyClient
$

Node: Step 2 of the creation process is automatic and requires no input.