-----BEGIN CERTIFICATE-----
MIIClTCCAf6gAwIBAgICEREwDQYJKoZIhvcNAQEFBQAwZzELMAkGA1UEBhMCR0Ix
EjAQBgNVBAgMCUJlcmtzaGlyZTEQMA4GA1UEBwwHTmV3YnVyeTERMA8GA1UECgwI
Vm9kYWZvbmUxDDAKBgNVBAsMA1ImRDERMA8GA1UEAwwIRE1TZXJ2ZXIwHhcNMTMw
OTAzMTQwNjA4WhcNMjMwNzEzMTQwNjA4WjBnMQswCQYDVQQGEwJHQjESMBAGA1UE
CAwJQmVya3NoaXJlMRAwDgYDVQQHDAdOZXdidXJ5MREwDwYDVQQKDAhWb2RhZm9u
ZTEMMAoGA1UECwwDUiZEMREwDwYDVQQDDAhETVNlcnZlcjCBnzANBgkqhkiG9w0B
AQEFAAOBjQAwgYkCgYEAupWZHm51RbMkEkvKAvglM96BcWVScxW7KaXFhm1Artt1
1Vm5KTC0rI+0kiG54kxhvY7euWeUcQqJKHxUTFjUWv8TcJrzmjIe5EthipLpdN+V
/PJCO/FiLXSiykQsC+VhyU8BKNYrpspyiQ109KPoybH8kK7W2IXf2d9AaLrzcgUC
AwEAAaNQME4wHQYDVR0OBBYEFKonGm+IcowtLcJaxXSCpUTRPaMVMB8GA1UdIwQY
MBaAFKonGm+IcowtLcJaxXSCpUTRPaMVMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcN
AQEFBQADgYEAfThlu2u73hm3quZJX57joMRn/N+l2KY4q16YI+gZIoJlLF/uIZw6
4OuxfKNfIvKvCL54LQ+/plh+8CzsmZdjdV9S/1+Jefe+RhEogjSvFjs2oyVaMCjZ
OxWujvZJ3XdhpXZJsdnEx4rgmHij3es3SzarTSjPVW8MpBU4H8NKlWI=
-----END CERTIFICATE-----

-----BEGIN PRIVATE KEY-----
MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBALqVmR5udUWzJBJL
ygL4JTPegXFlUnMVuymlxYZtQK7bddVZuSkwtKyPtJIhueJMYb2O3rlnlHEKiSh8
VExY1Fr/E3Ca85oyHuRLYYqS6XTflfzyQjvxYi10ospELAvlYclPASjWK6bKcokN
dPSj6Mmx/JCu1tiF39nfQGi683IFAgMBAAECgYEAuAFGQtud7YHQRfbWHv2G+tMp
BqJsoDBDJrxjwsFFs+ucFi5oyzVMSI1j/2UhQwoerekSvvdmTeCdCP8rxysnJ3MG
vepBkUXZ9kek7qZ561JC6qLZNcTeVc/R1rxMsFZSV/Zuzr7KFG47J/Di15GxGoui
x4fRE9ww0coC8PDWbaECQQDgKP48PD2gNaD2jjqd/xNki2kXP9PE1AAnevVaEidS
ceOKXgqx7qGYrN1+NFnRGwJhUSoicmUQeDKkC9CU/5UpAkEA1RZCT9M8lWpqx60d
oZlF9I3oOoQxXrx4RgoF+2y1tT+C7nUwmeYk2mEi/Gat9/NtKz/J9Tlwu3/Ef9eB
G7lVfQJAdvzLl2XSwIw3GSl+bAfOX3yxGCpFWyG9wzc9rcYdIWJbCkPJIZIuLUD1
gdyAIMNZjBbtasOWahujpfivi6fvoQJAHRIdV+CculG7YaR3j21mwtd9YEZaqe8S
hZOmf0e0fpa8mSW5zLU+P+DSshacE2DNewIH3oHIpHvo5fwTrCGbzQJAWaFq9L9C
lAgoPfuKjKQ0RJ8M+lDVOZo/Okl0VtrU/Z5fQm+yR4Lb+o1iogYjgjvdOmoMkPtb
Q/xu4c1qn2ksnA==
-----END PRIVATE KEY-----

openssl x509 -in cert.pem -outform DER | xxd -i

const static unsigned char deviceCertificate[] = {
   OUTPUT OF ABOVE
};
const static int deviceCertificateLength = sizeof(deviceCertificate);

openssl rsa -in key.pem -outform DER | xxd -i

./configure --enable-psk --enable-debug --enable-dtls

make

./server -u -b -f

#!/bin/sh
CA_KEY_FILE=ca_key.pem
CA_KEY_FORMAT=PEM
CA_KEY_ALGORITHM=rsa
CA_KEY_BITS=1024
# 1. Make a key for the CA (in this case the server)
echo Generating $CA_KEY_ALGORITHM key: $CA_KEY_FILE
openssl genpkey \
	-out $CA_KEY_FILE \
	-outform $CA_KEY_FORMAT \
	-algorithm $CA_KEY_ALGORITHM \
	-pkeyopt rsa_keygen_bits:$CA_KEY_BITS
echo DONE 
# extract public key (for vanity)
openssl pkey \
	-in $CA_KEY_FILE \
	-pubout \
	-out $CA_KEY_FILE.pub

# 2. Make a self signed certificate for the CA (trusted certificate)
# req - PKCS#10 certificate request and certificate generating utility.
CA_CERT_EXPIRY=3600
CA_CERT_SERIAL=0x1111
CA_CERT_FILE=ca_cert.pem
CA_CERT_REQ=ca_cert_req.pem
CA_ID=DMServer
echo Generating self signed root CA certificate: $CA_CERT_FILE
openssl req \
	-new \
	-key $CA_KEY_FILE \
	-days $CA_CERT_EXPIRY \
	-set_serial $CA_CERT_SERIAL \
	-subj "/C=GB/ST=Berkshire/L=Newbury/O=Vodafone/OU=R&D/CN=$CA_ID" \
	-out $CA_CERT_FILE \
	-x509 \
	-verbose 
echo DONE.

# 3. Make a key for the device
DEV_KEY_FILE=dev_key.pem
DEV_KEY_FORMAT=PEM
DEV_KEY_ALGORITHM=rsa
DEV_KEY_BITS=1024
echo Generating $DEV_KEY_ALGORITHM key: $DEV_KEY_FILE
openssl genpkey \
	-out $DEV_KEY_FILE \
	-outform $DEV_KEY_FORMAT \
	-algorithm $DEV_KEY_ALGORITHM \
	-pkeyopt rsa_keygen_bits:$DEV_KEY_BITS
echo DONE 
# extract public key (for vanity)
openssl pkey \
	-in $DEV_KEY_FILE \
	-pubout \
	-out $DEV_KEY_FILE.pub

# 4. Make a certificate request for the device
DEV_CERT_EXPIRY=3600
DEV_CERT_SERIAL=2222
DEV_CERT_REQ_FILE=dev_cert_req.pem
DEV_CERT_FILE=dev_cert.pem
DEV_ID=Device1
echo Generating certificate request for device: $DEV_CERT_REQ_FILE
openssl req \
	-new \
	-key $DEV_KEY_FILE \
	-days $DEV_CERT_EXPIRY \
	-set_serial $DEV_CERT_SERIAL \
	-subj "/C=GB/ST=Berkshire/L=Newbury/O=Vodafone/OU=R&D/CN=$DEV_ID" \
	-out $DEV_CERT_REQ_FILE \
	-verbose 

echo DONE.

# 5. Sign the device certificate using the root CA certificate
echo Creating directories and other stuff I really wish was not needed
mkdir -p demoCA/newcerts
touch demoCA/index.txt
echo $DEV_CERT_SERIAL > demoCA/serial
echo DONE.
# do the actual signing
echo Signing certificate request $DEV_CERT_REQ_FILE with certificate $CA_CERT_FILE
openssl ca \
	-in $DEV_CERT_REQ_FILE \
	-out $DEV_CERT_FILE \
	-days $DEV_CERT_EXPIRY \
	-keyfile $CA_KEY_FILE \
	-cert $CA_CERT_FILE \
	-batch \
	-verbose

echo DONE.

# 6 convert this stuff into a format suitable for mbed
echo Creating mbed include files
MBED_DIR=mbed/certs
mkdir -p $MBED_DIR
# private key
OUT=$MBED_DIR/device_private_key.h
echo "#pragma once" > $OUT
echo "const static unsigned char devicePrivateKey[] = {" >> $OUT
openssl $DEV_KEY_ALGORITHM -in $DEV_KEY_FILE -outform DER | xxd -i >> $OUT
echo "};" >> $OUT
echo "const static int devicePrivateKeyLength = sizeof(devicePrivateKey);" >> $OUT

# device cert
OUT=$MBED_DIR/device_certificate.h
echo "#pragma once" > $OUT
echo "const static unsigned char deviceCertificate[] = {" >> $OUT
openssl x509 -in $DEV_CERT_FILE -outform DER | xxd -i >> $OUT
echo "};" >> $OUT
echo "const static int deviceCertificateLength = sizeof(deviceCertificate);" >> $OUT

# CA cert
OUT=$MBED_DIR/root_certificate.h
echo "#pragma once" > $OUT
echo "const static unsigned char rootCertificate[] = {" >> $OUT
openssl x509 -in $CA_CERT_FILE -outform DER | xxd -i >> $OUT
echo "};" >> $OUT
echo "const static int rootCertificateLength = sizeof(rootCertificate);" >> $OUT
echo DONE.

# create (copy) the server files for CyaSSL
echo Creating PEM file structure of CyaSSL server
OUT=server/certs
mkdir -p $OUT
cp $CA_CERT_FILE $OUT/client_cert.pem
cp $CA_CERT_FILE $OUT/server_cert.pem
cp $CA_KEY_FILE $OUT/server_key.pem
echo DONE.