Skip to content

fix(mac-certs): Support OpenSSL/LIbreSSL and immediate returns on failure #8246

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
enmande wants to merge 1 commit into
base: main
Choose a base branch
from
+15 −3
Open

fix(mac-certs): Support OpenSSL/LIbreSSL and immediate returns on failure #8246

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions dev/create_certificates_mac.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,23 @@
#!/usr/bin/env bash
set -euo pipefail

openssl req -x509 -newkey rsa:4096 -sha256 -nodes -keyout identity_server_dev.key -out identity_server_dev.crt \
-subj "/CN=Bitwarden Identity Server Dev" -days 3650
openssl pkcs12 -export -legacy -out identity_server_dev.pfx -inkey identity_server_dev.key -in identity_server_dev.crt \
-certfile identity_server_dev.crt

security import ./identity_server_dev.pfx -k ~/Library/Keychains/Login.keychain
# macOS ships with LibreSSL by default;
# it will often be replaced by users with OpenSSL v3.
# If OpenSSL v3, a -legacy flag is required.
# !NOTE: If on OpenSSL v3, you must use a non-empty password.
if [[ "$(openssl version)" == OpenSSL\ 3* ]]; then
openssl pkcs12 -export -legacy -out identity_server_dev.pfx -inkey identity_server_dev.key \
-in identity_server_dev.crt -certfile identity_server_dev.crt
else
openssl pkcs12 -export -out identity_server_dev.pfx -inkey identity_server_dev.key \
-in identity_server_dev.crt -certfile identity_server_dev.crt
fi

# Use default system keychain
security import ./identity_server_dev.pfx

identity=($(openssl x509 -in identity_server_dev.crt -outform der | shasum -a 1 | tr a-z A-Z));

Expand Down
Loading