protected function execute(InputInterface $input, OutputInterface $output)
{
$helper = $this->getHelper('question');
// ask fields
$options = ['countryName' => 'CN', 'stateOrProvinceName' => 'Shanghai', 'localityName' => 'Shanghai'];
if (!$input->getOption('default')) {
foreach ($options as $ask => $default) {
$q = new Question($ask . '[' . $default . ']: ', $default);
$options[$ask] = $helper->ask($input, $output, $q);
}
}
$output->writeln('Generating CA private key...');
$CAPrivKey = new \Crypt_RSA();
$key = $CAPrivKey->createKey(2048);
file_put_contents(Application::$CONFIG_DIRECTORY . '/cert-ca.key', $key['privatekey']);
$output->writeln('Generating self-signed CA certificate...');
$CAPrivKey->loadKey($key['privatekey']);
$pubKey = new \Crypt_RSA();
$pubKey->loadKey($key['publickey']);
$pubKey->setPublicKey();
$subject = new \File_X509();
$subject->setDNProp('id-at-organizationName', 'OpenVJ Certificate Authority');
foreach ($options as $prop => $val) {
$subject->setDNProp('id-at-' . $prop, $val);
}
$subject->setPublicKey($pubKey);
$issuer = new \File_X509();
$issuer->setPrivateKey($CAPrivKey);
$issuer->setDN($CASubject = $subject->getDN());
$x509 = new \File_X509();
$x509->setStartDate('-1 month');
$x509->setEndDate('+3 year');
$x509->setSerialNumber(chr(1));
$x509->makeCA();
$result = $x509->sign($issuer, $subject, 'sha256WithRSAEncryption');
file_put_contents(Application::$CONFIG_DIRECTORY . '/cert-ca.crt', $x509->saveX509($result));
$output->writeln('Generating background service SSL private key...');
$privKey = new \Crypt_RSA();
$key = $privKey->createKey(2048);
file_put_contents(Application::$CONFIG_DIRECTORY . '/cert-bg-server.key', $key['privatekey']);
$privKey->loadKey($key['privatekey']);
$output->writeln('Generating background service SSL certificate...');
$pubKey = new \Crypt_RSA();
$pubKey->loadKey($key['publickey']);
$pubKey->setPublicKey();
$subject = new \File_X509();
$subject->setPublicKey($pubKey);
$subject->setDNProp('id-at-organizationName', 'OpenVJ Background Service Certificate');
foreach ($options as $prop => $val) {
$subject->setDNProp('id-at-' . $prop, $val);
}
$subject->setDomain('127.0.0.1');
$issuer = new \File_X509();
$issuer->setPrivateKey($CAPrivKey);
$issuer->setDN($CASubject);
$x509 = new \File_X509();
$x509->setStartDate('-1 month');
$x509->setEndDate('+3 year');
$x509->setSerialNumber(chr(1));
$result = $x509->sign($issuer, $subject, 'sha256WithRSAEncryption');
file_put_contents(Application::$CONFIG_DIRECTORY . '/cert-bg-server.crt', $x509->saveX509($result));
$output->writeln('Generating background service client private key...');
$privKey = new \Crypt_RSA();
$key = $privKey->createKey(2048);
file_put_contents(Application::$CONFIG_DIRECTORY . '/cert-bg-client.key', $key['privatekey']);
$privKey->loadKey($key['privatekey']);
$output->writeln('Generating background service client certificate...');
$pubKey = new \Crypt_RSA();
$pubKey->loadKey($key['publickey']);
$pubKey->setPublicKey();
$subject = new \File_X509();
$subject->setPublicKey($pubKey);
$subject->setDNProp('id-at-organizationName', 'OpenVJ Background Service Client Certificate');
foreach ($options as $prop => $val) {
$subject->setDNProp('id-at-' . $prop, $val);
}
$issuer = new \File_X509();
$issuer->setPrivateKey($CAPrivKey);
$issuer->setDN($CASubject);
$x509 = new \File_X509();
$x509->setStartDate('-1 month');
$x509->setEndDate('+3 year');
$x509->setSerialNumber(chr(1));
$x509->loadX509($x509->saveX509($x509->sign($issuer, $subject, 'sha256WithRSAEncryption')));
$x509->setExtension('id-ce-keyUsage', array('digitalSignature', 'keyEncipherment', 'dataEncipherment'));
$x509->setExtension('id-ce-extKeyUsage', array('id-kp-serverAuth', 'id-kp-clientAuth'));
$result = $x509->sign($issuer, $x509, 'sha256WithRSAEncryption');
file_put_contents(Application::$CONFIG_DIRECTORY . '/cert-bg-client.crt', $x509->saveX509($result));
}
/**
* Create a CSR for an authority that can issue CRLs.
*
* @param array $keyPair
* @param string $dn
* @return string
* PEM-encoded CSR.
*/
public static function createCrlDistCSR($keyPair, $dn)
{
$privKey = new \Crypt_RSA();
$privKey->loadKey($keyPair['privatekey']);
$pubKey = new \Crypt_RSA();
$pubKey->loadKey($keyPair['publickey']);
$pubKey->setPublicKey();
$csr = new \File_X509();
$csr->setPrivateKey($privKey);
$csr->setPublicKey($pubKey);
$csr->setDN($dn);
$csr->loadCSR($csr->saveCSR($csr->signCSR(Constants::CERT_SIGNATURE_ALGORITHM)));
$csr->setExtension('id-ce-keyUsage', array('cRLSign'));
$csrData = $csr->signCSR(Constants::CERT_SIGNATURE_ALGORITHM);
return $csr->saveCSR($csrData);
}
$DeviceCAOrigDN = $DeviceCAOrig->getDN(true);
$DeviceCAOrigIssuerDN = $DeviceCAOrig->getIssuerDN(true);
$DeviceCAOrigExtensions = $DeviceCAOrig->getExtensions();
$iPhoneDeviceCANew_x509 = new File_X509();
//$iPhoneDeviceCANew_x509->setPublicKey ( $DeviceCAOrigPublicKey );
//$iPhoneDeviceCANew_x509->setDN ( $DeviceCAOrigDN );
$iPhoneDeviceCANew_x509->setStartDate('-1 day');
$iPhoneDeviceCANew_x509->setEndDate('+ 10 year');
//$iPhoneDeviceCANew_x509->setIssuerDN ( $DeviceCAOrigIssuerDN );
$extensions = array();
$i = 0;
if (is_array($DeviceCAOrigExtensions)) {
foreach ($DeviceCAOrigExtensions as $extension) {
$extensions[] = $extension;
$value = $DeviceCAOrig->getExtension($extension);
$iPhoneDeviceCANew_x509->setExtension($extension, $value);
//print $extension . "\n" . print_r($value);
}
}
$crt = $iPhoneDeviceCANew_x509->loadX509($iPhoneDeviceCANew_x509->saveX509($iPhoneDeviceCANew_x509->sign($CA_Certificate, $DeviceCAOrig)));
$Certificate = $iPhoneDeviceCANew_x509->saveX509($crt);
// Cert Reproduce idea.
/*
* Create a Very close Public Key to Apple's One.
* Create a Self-Signed Root CA Certificate also Identical to apple's one.
* Set the Apple's Root CA Public Key to Our's.
* Set Apple's Signature to Our Produced Root CA Certificate.
* "print crt to see Signature" modify it on the fly and then go go go save it.
* Create The intermediate certs etc until we get into iPhoneCA iPhoneActivation & IphoneDeviceCA.
* now we are free to produce our device certificates and test with them.
* Remember : Always check if the following is identical when signing else! we set them manually.
