@@ -5,6 +5,7 @@ This directory contains all certificates and keys used in testing.
55To recreate the certificates follow the steps outlined below.
66
77## Setup CA
8+
891 . Create a new key to use for the CA:
910 ```
1011 openssl genrsa -out ca.key 4096
@@ -13,10 +14,11 @@ To recreate the certificates follow the steps outlined below.
1314 ```
1415 openssl req -new -x509 -key ca.key -out ca.crt -days 99999
1516 ```
16- * Organization Name: ` MongoDB `
17- * Organizational Unit Name: ` DevTools `
18- * Common Name: ` DevTools CA `
17+ - Organization Name: ` MongoDB `
18+ - Organizational Unit Name: ` DevTools `
19+ - Common Name: ` DevTools CA `
19203 . To sign and revoke certificates, an openssl config files is required. Create ` ca.cnf ` with the following content:
21+
2022 ```
2123 [ca]
2224 default_ca=CA_default
@@ -43,12 +45,14 @@ To recreate the certificates follow the steps outlined below.
4345 commonName=supplied
4446 emailAddress=optional
4547 ```
48+
46494 . Ensure the ` ca.db ` file exists:
4750 ```
4851 touch ca.db
4952 ```
5053
5154## Setup Server Certificate
55+
52561 . Create a new key to use for the server:
5357 ```
5458 openssl genrsa -out server.key 4096
@@ -57,9 +61,9 @@ To recreate the certificates follow the steps outlined below.
5761 ```
5862 openssl req -new -key server.key -out server.csr -days 99999
5963 ```
60- * Organization Name: ` MongoDB `
61- * Organizational Unit Name: ` DevTools `
62- * Common Name: ` localhost `
64+ - Organization Name: ` MongoDB `
65+ - Organizational Unit Name: ` DevTools `
66+ - Common Name: ` localhost `
63673 . Sign the CSR to generate server certificate:
6468 ```
6569 openssl ca -create_serial -config ca.cnf -in server.csr -out server.pem -days 99999
@@ -71,6 +75,7 @@ To recreate the certificates follow the steps outlined below.
7175 ```
7276
7377## Setup Server Certificate with invalid hostname
78+
74791 . Create a new key to use for the server:
7580 ```
7681 openssl genrsa -out server-invalidhost.key 4096
@@ -79,9 +84,9 @@ To recreate the certificates follow the steps outlined below.
7984 ```
8085 openssl req -new -key server-invalidhost.key -out server-invalidhost.csr -days 99999
8186 ```
82- * Organization Name: ` MongoDB `
83- * Organizational Unit Name: ` DevTools `
84- * Common Name: ` invalidhost `
87+ - Organization Name: ` MongoDB `
88+ - Organizational Unit Name: ` DevTools `
89+ - Common Name: ` invalidhost `
85903 . Sign the CSR to generate server certificate:
8691 ```
8792 openssl ca -create_serial -config ca.cnf -in server-invalidhost.csr -out server-invalidhost.pem -days 99999
@@ -93,6 +98,7 @@ To recreate the certificates follow the steps outlined below.
9398 ```
9499
95100## Setup "Non-CA" for testing invalid CA cert
101+
961021 . Create a new key to use for the Non CA:
97103 ```
98104 openssl genrsa -out non-ca.key 4096
@@ -101,11 +107,12 @@ To recreate the certificates follow the steps outlined below.
101107 ```
102108 openssl req -new -x509 -key non-ca.key -out non-ca.crt -days 99999
103109 ```
104- * Organization Name: ` MongoDB `
105- * Organizational Unit Name: ` DevTools `
106- * Common Name: ` NOT DevTools CA `
110+ - Organization Name: ` MongoDB `
111+ - Organizational Unit Name: ` DevTools `
112+ - Common Name: ` NOT DevTools CA `
107113
108114## Revoke Server Certificate and generate CRL
115+
1091161 . Revoke the server's certificate:
110117 ```
111118 openssl ca -config ca.cnf -revoke server.pem
@@ -116,6 +123,7 @@ To recreate the certificates follow the steps outlined below.
116123 ```
117124
118125## Create Client Certificate from CA
126+
1191271 . Create a new key to use for the client:
120128 ```
121129 openssl genrsa -out client.key 4096
@@ -124,10 +132,10 @@ To recreate the certificates follow the steps outlined below.
124132 ```
125133 openssl req -new -key client.key -out client.csr -days 99999
126134 ```
127- * Organization Name: ` MongoDB `
128- * Organizational Unit Name: ` DevTools Testers `
129- * Common Name: ` Wonderwoman `
130- 135+ - Organization Name: ` MongoDB `
136+ - Organizational Unit Name: ` DevTools Testers `
137+ - Common Name: ` Wonderwoman `
138+ 1311393 . Sign the CSR to generate server certificate:
132140 ```
133141 openssl ca -create_serial -config ca.cnf -in client.csr -out client.pem -days 99999
@@ -146,9 +154,10 @@ To recreate the certificates follow the steps outlined below.
146154 ```
147155 openssl pkcs12 -inkey client.bundle.pem -in client.bundle.pem -export -out client.bundle.pfx
148156 ```
149- * Password: ` passw0rd `
157+ - Password: ` passw0rd `
150158
151159## Create Client Certificate not from CA
160+
1521611 . Create a new key to use for the Non CA:
153162 ```
154163 openssl genrsa -out invalid-client.key 4096
@@ -157,10 +166,10 @@ To recreate the certificates follow the steps outlined below.
157166 ```
158167 openssl req -new -x509 -key invalid-client.key -out invalid-client.crt -days 99999
159168 ```
160- * Organization Name: ` MongoDB `
161- * Organizational Unit Name: ` DevTools Testers `
162- * Common Name: ` Wonderwoman `
163- 169+ - Organization Name: ` MongoDB `
170+ - Organizational Unit Name: ` DevTools Testers `
171+ - Common Name: ` Wonderwoman `
172+ 1641733 . Create a bundle with client key and certificate to use for connecting:
165174 ```
166175 cat invalid-client.crt invalid-client.key > invalid-client.bundle.pem
0 commit comments