Last active
May 28, 2020 17:05
-
-
Save dnoliver/ee977c80003fe26c782ebf9d5c9d55e2 to your computer and use it in GitHub Desktop.
Certificate Signing Request generation with tpm2-pkcs11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| set -euxo pipefail | |
| export TPM2TOOLS_TCTI="device:/dev/tpmrm0" | |
| export TPM2_PKCS11_TCTI="device:/dev/tpmrm0" | |
| #export TPM2_PKCS11_LOG_LEVEL=2 | |
| tpm2_print_handles () { | |
| for i in transient saved-session loaded-session; | |
| do | |
| tpm2_getcap handles-$i; | |
| done | |
| } | |
| tpm2_flush_handles () { | |
| for i in transient-object saved-session loaded-session; | |
| do | |
| tpm2_flushcontext --$i; | |
| done | |
| } | |
| tpm2_clear | |
| rm tpm2_pkcs11.sqlite3 | |
| tpm2_ptool init | |
| tpm2_ptool addtoken --pid=1 --sopin=mysopin --userpin=myuserpin --label=label | |
| tpm2_ptool addkey --algorithm=rsa2048 --label=label --userpin=myuserpin | |
| tpm2_ptool config --key tcti --value "device:/dev/tpmrm0" --label label | |
| p11-kit list-modules | |
| TOKEN=$(p11tool --list-token-urls | grep "token=label") | |
| expect <(cat <<EOF | |
| spawn p11tool --login --list-all "${TOKEN}" --outfile p11tool.out | |
| expect "Enter PIN: " | |
| send -- "myuserpin\r" | |
| interact | |
| EOF | |
| ) | |
| RANDOM=$$ | |
| ID=${RANDOM} | |
| KEY=$(cat p11tool.out | grep private | awk '{ print $2 }') | |
| SUBJ="/C=FR/ST=Radius/L=Somewhere/O=Example Inc./CN=testing-${ID}/emailAddress=testing-${ID}@123.com" | |
| openssl req -new -engine pkcs11 -keyform engine -key "${KEY};pin-value=myuserpin" -subj "${SUBJ}" -out client-${ID}.csr | |
| # Sign CSR in RADIUS Server with openssl | |
| # | |
| # cd /etc/raddb/certs | |
| # openssl ca \ | |
| # -batch -keyfile ./ca.key -cert ./ca.pem -passin pass:whatever \ | |
| # -in client-${ID}.csr -out client-${ID}.crt \ | |
| # -extensions xpclient_ext -extfile xpextensions | |
| # -config client.cnf | |
| cat <<EOF > wpa_supplicant-${ID}.conf | |
| network={ | |
| ssid="SSID" | |
| key_mgmt=WPA-EAP | |
| eap=TLS | |
| identity="testing" | |
| ca_cert="./ca.pem" | |
| client_cert="./client-${ID}.crt" | |
| private_key="${KEY}" | |
| pin="myuserpin" | |
| } | |
| EOF | |
| echo "wpa_supplicant -c wpa_supplicant-${ID}.conf -i wlp1s0" |
#/bin/bash
set -euxo pipefail
cd tpm2-tss
git clean -fxd
git checkout 2.3.0
./bootstrap && ./configure && make -j4 && make install
cd ..
export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/
cd tpm2-tools
git clean -fxd
git checkout 4.0.1
./bootstrap && ./configure && make -j4 && make install
cd ..
cd tpm2-pkcs11
git clean -fxd
git checkout 1.0
./bootstrap && ./configure && make -j4 && make install
cd tools && python3 setup.py install && cd ..
cd ..[root@localhost ~]# ldd /usr/lib64/pkcs11/libtpm2_pkcs11.so
linux-vdso.so.1 (0x00007ffe2f3e7000)
libtss2-esys.so.0 => /usr/local/lib/libtss2-esys.so.0 (0x00007f95a2714000)
libtss2-sys.so.0 => /usr/local/lib/libtss2-sys.so.0 (0x00007f95a26eb000)
libtss2-mu.so.0 => /usr/local/lib/libtss2-mu.so.0 (0x00007f95a26a3000)
libtss2-tctildr.so.0 => /usr/local/lib/libtss2-tctildr.so.0 (0x00007f95a269a000)
libtss2-rc.so.0 => /usr/local/lib/libtss2-rc.so.0 (0x00007f95a2690000)
libsqlite3.so.0 => /lib64/libsqlite3.so.0 (0x00007f95a2571000)
libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007f95a228f000)
libyaml-0.so.2 => /lib64/libyaml-0.so.2 (0x00007f95a226d000)
libdl.so.2 => /lib64/libdl.so.2 (0x00007f95a2267000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f95a2246000)
libc.so.6 => /lib64/libc.so.6 (0x00007f95a2080000)
/lib64/ld-linux-x86-64.so.2 (0x00007f95a27d5000)
libm.so.6 => /lib64/libm.so.6 (0x00007f95a1f3a000)
libz.so.1 => /lib64/libz.so.1 (0x00007f95a1f1e000)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
wpa_supplicantoutput:radiusd -Xoutput: