OpenSearch/qa/smoke-test-plugins-ssl/ssl-setup.xml

<?xml version="1.0"?>
<project name="smoke-test-plugins"
         xmlns:ac="antlib:net.sf.antcontrib">

  <target name="create-certificate-authority">
    <ac:for list="private,certs,conf" param="dir">
      <sequential>
        <mkdir dir="${integ.scratch}/ca/@{dir}"/>
      </sequential>
    </ac:for>
    <echo file="${integ.scratch}/ca/serial">01</echo>
    <touch file="${integ.scratch}/ca/index.txt"/>
    <echo file="${integ.scratch}/ca/conf/caconfig.cnf">[ ca ]
default_ca = CA_default
[ CA_default ]
copy_extensions = copy
dir = ${integ.scratch}/ca
serial = $dir/serial
database = $dir/index.txt
new_certs_dir = $dir/certs
certificate = $dir/certs/cacert.pem
private_key = $dir/private/cakey.pem
default_days = 712
default_md = sha256
preserve = no
email_in_dn = no
x509_extensions = v3_ca
name_opt = ca_default
cert_opt = ca_default
policy = policy_anything
[ policy_anything ]
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional
[ req ]
default_bits = 2048 # Size of keys
default_keyfile = key.pem # name of generated keys
default_md = sha256 # message digest algorithm
string_mask = nombstr # permitted characters
distinguished_name = req_distinguished_name
req_extensions = v3_req
[ req_distinguished_name ]
# Variable name Prompt string
#------------------------- ----------------------------------
0.organizationName = Organization Name (company)
organizationalUnitName = Organizational Unit Name (department, division)
emailAddress = Email Address
emailAddress_max = 40
localityName = Locality Name (city, district)
stateOrProvinceName = State or Province Name (full name)
countryName = Country Name (2 letter code)
countryName_min = 2
countryName_max = 2
commonName = Common Name (hostname, IP, or your name)
commonName_max = 64
# Default values for the above, for consistency and less typing.
# Variable name Value
#------------------------ ------------------------------
0.organizationName_default = Elasticsearch Test Org
localityName_default = Amsterdam
stateOrProvinceName_default = Amsterdam
countryName_default = NL
emailAddress_default = cacerttest@YOUR.COMPANY.TLD
[ v3_ca ]
basicConstraints = CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
[ v3_req ]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash</echo>
    <exec executable="openssl" failonerror="true">
      <arg value="req"/>
      <arg value="-new"/>
      <arg value="-x509"/>
      <arg value="-extensions"/>
      <arg value="v3_ca"/>
      <arg value="-keyout"/>
      <arg value="${integ.scratch}/ca/private/cakey.pem"/>
      <arg value="-out"/>
      <arg value="${integ.scratch}/ca/certs/cacert.pem"/>
      <arg value="-days"/>
      <arg value="1460"/>
      <arg value="-config"/>
      <arg value="${integ.scratch}/ca/conf/caconfig.cnf"/>
      <arg value="-subj"/>
      <arg value="/OU=XPlugins QA"/>
      <arg value="-passout"/>
      <arg value="pass:capass"/>
    </exec>
  </target>

  <target name="create-key">
    <local name="parent.dir"/>
    <dirname file="${keystore.path}" property="parent.dir" />
    <mkdir dir="${parent.dir}"/>
    <exec executable="keytool" failonerror="true"
        inputstring="FirstName LastName&#x0A;Unit&#x0A;Organization&#x0A;City&#x0A;State&#x0A;NL&#x0A;yes&#x0A;&#x0A;">
      <arg value="-genkey"/>
      <arg value="-alias"/>
      <arg value="test-node"/>
      <arg value="-keystore"/>
      <arg value="${keystore.path}"/>
      <arg value="-keyalg"/>
      <arg value="RSA"/>
      <arg value="-keysize"/>
      <arg value="2048"/>
      <arg value="-validity"/>
      <arg value="712"/>
      <arg value="-ext"/>
      <arg value="san=dns:localhost,ip:127.0.0.1"/>
      <arg value="-storepass"/>
      <arg value="keypass"/>
    </exec>
  </target>

  <target name="create-certificate" depends="create-key">
    <mkdir dir="${integ.scratch}/cert"/>
    <exec executable="keytool" failonerror="true"
        inputstring="keypass&#x0A;">
      <arg value="-certreq"/>
      <arg value="-alias"/>
      <arg value="test-node"/>
      <arg value="-keystore"/>
      <arg value="${keystore.path}"/>
      <arg value="-file"/>
      <arg value="${integ.scratch}/cert/test-node.csr"/>
      <arg value="-keyalg"/>
      <arg value="RSA"/>
      <arg value="-ext"/>
      <arg value="san=dns:localhost,ip:127.0.0.1"/>
    </exec>
  </target>

  <target name="sign-certificate" depends="create-certificate,create-certificate-authority">
    <exec executable="openssl" failonerror="true"
        inputstring="y&#x0A;y&#x0A;">
      <arg value="ca"/>
      <arg value="-in"/>
      <arg value="${integ.scratch}/cert/test-node.csr"/>
      <arg value="-notext"/>
      <arg value="-out"/>
      <arg value="${integ.scratch}/cert/test-node-signed.csr"/>
      <arg value="-config"/>
      <arg value="${integ.scratch}/ca/conf/caconfig.cnf"/>
      <arg value="-extensions"/>
      <arg value="v3_req"/>
      <arg value="-passin"/>
      <arg value="pass:capass"/>
    </exec>
  </target>

  <target name="import-certificate" depends="sign-certificate">
    <exec executable="keytool" failonerror="true"
        inputstring="keypass&#x0A;yes&#x0A;">
      <arg value="-importcert"/>
      <arg value="-keystore"/>
      <arg value="${keystore.path}"/>
      <arg value="-file"/>
      <arg value="${integ.scratch}/cert/test-node-signed.csr"/>
      <arg value="-trustcacerts"/>
    </exec>
  </target>

  <target name="generate-keystore" depends="import-certificate"/>

</project>