adminandClaude Opus 5
79843aa2ae
Erster Stand der Hintergrundprozesse, die auf der Synology unter /volume1/homes/wagner/SolarManager laufen: der Manager selbst, die Sammler je Geraet, die MQTT-Bruecke, der Wecker und - neu hinzugezogen - der AutoAction-Runner, der als Hintergrundprozess hierher gehoert und nicht ins Web-Verzeichnis. Zugangsdaten stehen nicht mehr im Quelltext, sondern in config.ini, die nicht mit eingecheckt wird. Vorlage ist config.ini.example, gelesen wird sie von konfig.py. Betroffen waren solarManager.py (Datenbank und Wattpilot), zeit.py, gatherWaterData.py, wecker.py und skoda_testdaten.py, das sich das Passwort bisher aus dem Quelltext eines anderen Moduls herausgesucht hat. Die Kia-Anbindung ist mit dem Fahrzeug entfallen: kiaTest.py, gatherCarData.py und hyundai_kia_connect_api sind nicht mehr dabei, ebenso gatherInverterData.py, auf das nur noch eine auskommentierte Zeile zeigte. Die mitgelieferten Bibliotheken bleiben im Repository - die NAS hat kein pip, sie muessen neben den Skripten liegen. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
83 lines
4.4 KiB
Bash
83 lines
4.4 KiB
Bash
#!/bin/sh
|
|
# This file generates the keys and certificates used for testing mosquitto.
|
|
# None of the keys are encrypted, so do not just use this script to generate
|
|
# files for your own use.
|
|
|
|
set -e
|
|
|
|
rm -f *.crt *.key *.csr
|
|
for a in root signing; do
|
|
rm -rf ${a}CA/
|
|
mkdir -p ${a}CA/newcerts
|
|
touch ${a}CA/index.txt
|
|
echo 01 > ${a}CA/serial
|
|
echo 01 > ${a}CA/crlnumber
|
|
done
|
|
rm -rf certs
|
|
|
|
BASESUBJ="/C=GB/ST=Derbyshire/L=Derby/O=Paho Project/OU=Testing"
|
|
SBASESUBJ="/C=GB/ST=Nottinghamshire/L=Nottingham/O=Server/OU=Production"
|
|
BBASESUBJ="/C=GB/ST=Nottinghamshire/L=Nottingham/O=Server/OU=Bridge"
|
|
|
|
# The root CA
|
|
openssl genrsa -out test-root-ca.key 2048
|
|
openssl req -new -x509 -days 3650 -key test-root-ca.key -out test-root-ca.crt -config openssl.cnf -subj "${BASESUBJ}/CN=Root CA/"
|
|
|
|
# Another root CA that doesn't sign anything
|
|
openssl genrsa -out test-bad-root-ca.key 2048
|
|
openssl req -new -x509 -days 3650 -key test-bad-root-ca.key -out test-bad-root-ca.crt -config openssl.cnf -subj "${BASESUBJ}/CN=Bad Root CA/"
|
|
|
|
# This is a root CA that has the exact same details as the real root CA, but is a different key and certificate. Effectively a "fake" CA.
|
|
openssl genrsa -out test-fake-root-ca.key 2048
|
|
openssl req -new -x509 -days 3650 -key test-fake-root-ca.key -out test-fake-root-ca.crt -config openssl.cnf -subj "${BASESUBJ}/CN=Root CA/"
|
|
|
|
# An intermediate CA, signed by the root CA, used to sign server/client csrs.
|
|
openssl genrsa -out test-signing-ca.key 2048
|
|
openssl req -out test-signing-ca.csr -key test-signing-ca.key -new -config openssl.cnf -subj "${BASESUBJ}/CN=Signing CA/"
|
|
openssl ca -batch -config openssl.cnf -name CA_root -extensions v3_ca -out test-signing-ca.crt -infiles test-signing-ca.csr
|
|
|
|
# An alternative intermediate CA, signed by the root CA, not used to sign anything.
|
|
openssl genrsa -out test-alt-ca.key 2048
|
|
openssl req -out test-alt-ca.csr -key test-alt-ca.key -new -config openssl.cnf -subj "${BASESUBJ}/CN=Alternative Signing CA/"
|
|
openssl ca -batch -config openssl.cnf -name CA_root -extensions v3_ca -out test-alt-ca.crt -infiles test-alt-ca.csr
|
|
|
|
# Valid server key and certificate.
|
|
openssl genrsa -out server.key 2048
|
|
openssl req -new -key server.key -out server.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=localhost/"
|
|
openssl ca -batch -config openssl.cnf -name CA_signing -out server.crt -infiles server.csr
|
|
|
|
# Expired server certificate, based on the above server key.
|
|
openssl req -new -days 1 -key server.key -out server-expired.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=localhost/"
|
|
echo -n > signingCA/index.txt
|
|
echo 01 > signingCA/serial
|
|
openssl ca -batch -config openssl.cnf -name CA_signing -days 1 -startdate 120820000000Z -enddate 120821000000Z -out server-expired.crt -infiles server-expired.csr
|
|
|
|
# Valid client key and certificate.
|
|
openssl genrsa -out client.key 2048
|
|
openssl req -new -key client.key -out client.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client/"
|
|
openssl ca -batch -config openssl.cnf -name CA_signing -out client.crt -infiles client.csr
|
|
|
|
# Expired client certificate, based on the above client key.
|
|
openssl req -new -days 1 -key client.key -out client-expired.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client expired/"
|
|
openssl ca -batch -config openssl.cnf -name CA_signing -days 1 -startdate 120820000000Z -enddate 120821000000Z -out client-expired.crt -infiles client-expired.csr
|
|
|
|
# Valid client key and certificate, key is encrypted with a password.
|
|
openssl genrsa -aes128 -passout pass:password -out client-pw.key 2048
|
|
openssl req -new -key client-pw.key -passin pass:password -out client-pw.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client with password/"
|
|
openssl ca -batch -config openssl.cnf -name CA_signing -out client-pw.crt -infiles client-pw.csr
|
|
|
|
# Revoked client certificate, based on a new client key.
|
|
openssl genrsa -out client-revoked.key 2048
|
|
openssl req -new -days 1 -key client-revoked.key -out client-revoked.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client revoked/"
|
|
openssl ca -batch -config openssl.cnf -name CA_signing -out client-revoked.crt -infiles client-revoked.csr
|
|
openssl ca -batch -config openssl.cnf -name CA_signing -revoke client-revoked.crt
|
|
openssl ca -batch -config openssl.cnf -name CA_signing -gencrl -out crl.pem
|
|
|
|
cat test-signing-ca.crt test-root-ca.crt > all-ca.crt
|
|
#mkdir certs
|
|
#cp test-signing-ca.crt certs/test-signing-ca.pem
|
|
#cp test-root-ca.crt certs/test-root.ca.pem
|
|
c_rehash certs
|
|
|
|
rm -f client-expired.csr client-revoked.csr server-expired.csr server.csr test-alt-ca.csr
|