1+ #! /bin/bash
2+
3+ # Create test certificates for jose-swift
4+ ORG_NAME=" Beatt83"
5+ ROOT_CN=" Jose Swift Root CA"
6+ INT_CN=" Jose Swift Intermediate CA"
7+ LEAF_CN=" Jose Swift Leaf Certificate"
8+ EXPIRY_DAYS=3650
9+
10+ # --- The Cleanup Function ---
11+ # This runs automatically on exit, even if the script fails.
12+ cleanup () {
13+ echo -e " \n🧹 Cleaning up temporary artifacts..."
14+ rm -f * .key * .crt * .csr * .conf * .der * .txt * .raw * .srl
15+ echo " Done."
16+ }
17+ trap cleanup EXIT
18+
19+ echo " 🔨 Generating Certificate Chain for $ORG_NAME ..."
20+
21+ # 1. Root CA
22+ openssl ecparam -name prime256v1 -genkey -noout -out root.key
23+ openssl req -new -x509 -sha256 -key root.key -out root.crt -subj " /O=$ORG_NAME /CN=$ROOT_CN " $EXPIRY_DAYS 2> /dev/null
24+
25+ # 2. Intermediate CA
26+ openssl ecparam -name prime256v1 -genkey -noout -out intermediate.key
27+ openssl req -new -key intermediate.key -out intermediate.csr -subj " /O=$ORG_NAME /CN=$INT_CN " 2> /dev/null
28+ echo " basicConstraints=critical,CA:TRUE" > ca.conf
29+ openssl x509 -req -in intermediate.csr -CA root.crt -CAkey root.key -CAcreateserial -out intermediate.crt -days $EXPIRY_DAYS -extfile ca.conf 2> /dev/null
30+
31+ # 3. Leaf Certificate
32+ openssl ecparam -name prime256v1 -genkey -noout -out leaf.key
33+ openssl req -new -key leaf.key -out leaf.csr -subj " /O=$ORG_NAME /CN=$LEAF_CN " 2> /dev/null
34+ openssl x509 -req -in leaf.csr -CA intermediate.crt -CAkey intermediate.key -CAcreateserial -out leaf.crt -days $EXPIRY_DAYS 2> /dev/null
35+
36+ echo " 🖋️ Signing JWT..."
37+
38+ # 4. Python packaging (Handles Base64URL and ES256 Raw Signature)
39+ python3 - << EOF
40+ import base64, json, subprocess
41+
42+ def b64url(data):
43+ return base64.urlsafe_b64encode(data).decode('utf-8').replace('=', '')
44+
45+ def get_cert_b64(filename):
46+ with open(filename, 'r') as f:
47+ lines = f.readlines()
48+ return "".join([line.strip() for line in lines if "CERTIFICATE" not in line])
49+
50+ header = {
51+ "alg": "ES256",
52+ "typ": "JWT",
53+ "x5c": [get_cert_b64("leaf.crt"), get_cert_b64("intermediate.crt"), get_cert_b64("root.crt")]
54+ }
55+ payload = {"cool": True}
56+
57+ header_b64 = b64url(json.dumps(header).encode())
58+ payload_b64 = b64url(json.dumps(payload).encode())
59+ signing_input = f"{header_b64}.{payload_b64}".encode()
60+
61+ with open("signing_input.txt", "wb") as f: f.write(signing_input)
62+ subprocess.run("openssl dgst -sha256 -sign leaf.key -out sig.der signing_input.txt", shell=True, capture_output=True)
63+
64+ with open("sig.der", "rb") as f:
65+ der = f.read()
66+ r_len = der[3]
67+ r = der[4:4+r_len][-32:]
68+ s_len = der[4+r_len+1]
69+ s = der[4+r_len+2:4+r_len+2+s_len][-32:]
70+ signature = b64url(r + s)
71+
72+ token = f"{header_b64}.{payload_b64}.{signature}"
73+
74+ print("\n" + "="*60)
75+ print(" COPY THE BLOCK BELOW INTO YOUR SWIFT TEST")
76+ print("="*60 + "\n")
77+
78+ print('let trusted = """')
79+ with open("root.crt", "r") as f: print(f.read().strip())
80+ print('"""\n')
81+
82+ print(f'let validToken = "{token}"')
83+ EOF
0 commit comments