Polishing.

Adopt changed relative paths. Move setup scripts back to src/test/bash.

Original pull request: #8.

src/test/bash/create_certificates.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+CA_DIR=work/ca
+JKS_FILE=work/keystore.jks
+if [[ -d work/ca ]] ; then
+    rm -Rf ${CA_DIR}
+fi
+
+if [[ -f ${JKS_FILE} ]] ; then
+    rm -Rf ${JKS_FILE}
+fi
+
+mkdir -p ${CA_DIR}/private ${CA_DIR}/certs ${CA_DIR}/crl ${CA_DIR}/csr ${CA_DIR}/newcerts ${CA_DIR}/intermediate
+
+echo "[INFO] Generating CA private key"
+# Less bits = less secure = faster to generate
+openssl genrsa -passout pass:changeit -aes256 -out ${CA_DIR}/private/ca.key.pem 2048
+
+chmod 400 ${CA_DIR}/private/ca.key.pem
+
+echo "[INFO] Generating CA certificate"
+openssl req -config ${DIR}/openssl.cnf \
+      -key ${CA_DIR}/private/ca.key.pem \
+      -new -x509 -days 7300 -sha256 -extensions v3_ca \
+      -out ${CA_DIR}/certs/ca.cert.pem \
+      -passin pass:changeit \
+      -subj "/C=NN/ST=Unknown/L=Unknown/O=spring-cloud-vault-config/CN=CA Certificate"
+
+echo "[INFO] Prepare CA database"
+echo 1000 > ${CA_DIR}/serial
+touch ${CA_DIR}/index.txt
+
+echo "[INFO] Generating server private key"
+openssl genrsa -aes256 \
+      -passout pass:changeit \
+      -out ${CA_DIR}/private/localhost.key.pem 2048
+
+openssl rsa -in ${CA_DIR}/private/localhost.key.pem \
+      -out ${CA_DIR}/private/localhost.decrypted.key.pem \
+      -passin pass:changeit
+
+chmod 400 ${CA_DIR}/private/localhost.key.pem
+
+echo "[INFO] Generating server certificate request"
+openssl req -config ${DIR}/openssl.cnf \
+      -key ${CA_DIR}/private/localhost.key.pem \
+      -passin pass:changeit \
+      -new -sha256 -out ${CA_DIR}/csr/localhost.csr.pem \
+      -subj "/C=NN/ST=Unknown/L=Unknown/O=spring-cloud-vault-config/CN=localhost"
+
+echo "[INFO] Signing certificate request"
+openssl ca -config ${DIR}/openssl.cnf \
+      -extensions server_cert -days 375 -notext -md sha256 \
+      -passin pass:changeit \
+      -batch \
+      -in ${CA_DIR}/csr/localhost.csr.pem \
+      -out ${CA_DIR}/certs/localhost.cert.pem
+
+${JAVA_HOME}/bin/keytool -importcert -keystore ${JKS_FILE} -file ${CA_DIR}/certs/ca.cert.pem -noprompt -storepass changeit

src/test/bash/env.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+###########################################################################
+# Vault environment settings. Source this file.                           #
+###########################################################################
+
+export VAULT_TOKEN=00000000-0000-0000-0000-000000000000
+export VAULT_ADDR=https://localhost:8200
+export VAULT_SKIP_VERIFY=false
+export VAULT_CAPATH=${DIR}/work/ca/certs/ca.cert.pem

src/test/bash/install_vault.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+
+###########################################################################
+# Download and Install Vault                                              #
+# This script is prepared for caching of the vault/download directory     #
+###########################################################################
+
+
+VAULT_VER="0.5.2"
+UNAME=$(uname -s |  tr '[:upper:]' '[:lower:]')
+VAULT_ZIP="vault_${VAULT_VER}_${UNAME}_amd64.zip"
+IGNORE_CERTS="${IGNORE_CERTS:-no}"
+
+
+# cleanup
+mkdir -p vault/download
+cd vault
+
+if [[ ! -f "download/${VAULT_ZIP}" ]] ; then
+    cd download
+    # install Vault
+    if [[ "${IGNORE_CERTS}" == "no" ]] ; then
+      echo "Downloading consul with certs verification"
+      wget "https://releases.hashicorp.com/vault/${VAULT_VER}/${VAULT_ZIP}"
+    else
+      echo "WARNING... Downloading consul WITHOUT certs verification"
+      wget "https://releases.hashicorp.com/vault/${VAULT_VER}/${VAULT_ZIP}" --no-check-certificate
+    fi
+
+    if [[ $? != 0 ]] ; then
+      echo "Cannot download vault"
+      exit 1
+    fi
+    cd ..
+fi
+
+if [[ -f vault ]] ; then
+  rm vault
+fi
+
+unzip download/${VAULT_ZIP}
+chmod a+x vault
+
+# check
+./vault --version

src/test/bash/local_run_vault.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+###########################################################################
+# Start Vault on localhost:8200                                           #
+###########################################################################
+
+BASEDIR=`dirname $0`/../../..
+./vault/vault server -config=${BASEDIR}/spring-cloud-vault-config/src/test/resources/vault.conf
+exit $?

src/test/bash/openssl.cnf

@@ -0,0 +1,106 @@
+[ ca ]
+# `man ca`
+default_ca = CA_default
+
+[ CA_default ]
+# Directory and file locations.
+dir               = work/ca
+certs             = $dir/certs
+crl_dir           = $dir/crl
+new_certs_dir     = $dir/newcerts
+database          = $dir/index.txt
+serial            = $dir/serial
+RANDFILE          = $dir/private/.rand
+
+# The root key and root certificate.
+private_key       = $dir/private/ca.key.pem
+certificate       = $dir/certs/ca.cert.pem
+
+# For certificate revocation lists.
+crlnumber         = $dir/crlnumber
+crl               = $dir/crl/ca.crl.pem
+crl_extensions    = crl_ext
+default_crl_days  = 30
+
+# SHA-1 is deprecated, so use SHA-2 instead.
+default_md        = sha256
+
+name_opt          = ca_default
+cert_opt          = ca_default
+default_days      = 375
+preserve          = no
+policy            = policy_strict
+
+[ policy_strict ]
+# The root CA should only sign intermediate certificates that match.
+# See the POLICY FORMAT section of `man ca`.
+countryName             = match
+stateOrProvinceName     = match
+organizationName        = match
+organizationalUnitName  = optional
+commonName              = supplied
+emailAddress            = optional
+
+[ req ]
+# Options for the `req` tool (`man req`).
+default_bits        = 2048
+distinguished_name  = req_distinguished_name
+string_mask         = utf8only
+
+# SHA-1 is deprecated, so use SHA-2 instead.
+default_md          = sha256
+
+# Extension to add when the -x509 option is used.
+x509_extensions     = v3_ca
+
+[ req_distinguished_name ]
+# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
+countryName                     = Country Name (2 letter code)
+stateOrProvinceName             = State or Province Name
+localityName                    = Locality Name
+0.organizationName              = Organization Name
+organizationalUnitName          = Organizational Unit Name
+commonName                      = Common Name
+emailAddress                    = Email Address
+
+# Optionally, specify some defaults.
+countryName_default             = NN
+stateOrProvinceName_default     = Vault Test
+localityName_default            =
+0.organizationName_default      = spring-cloud-vault-config
+#organizationalUnitName_default =
+#emailAddress_default           = info@spring-cloud-vault-config.dummy
+
+[ v3_ca ]
+# Extensions for a typical CA (`man x509v3_config`).
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer
+basicConstraints = critical, CA:true
+keyUsage = critical, digitalSignature, cRLSign, keyCertSign
+
+[ v3_intermediate_ca ]
+# Extensions for a typical intermediate CA (`man x509v3_config`).
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer
+basicConstraints = critical, CA:true, pathlen:0
+keyUsage = critical, digitalSignature, cRLSign, keyCertSign
+
+[ usr_cert ]
+# Extensions for client certificates (`man x509v3_config`).
+basicConstraints = CA:FALSE
+nsCertType = client, email
+nsComment = "OpenSSL Generated Client Certificate"
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer
+keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
+extendedKeyUsage = clientAuth, emailProtection
+
+[ server_cert ]
+# Extensions for server certificates (`man x509v3_config`).
+basicConstraints = CA:FALSE
+nsCertType = server
+nsComment = "OpenSSL Generated Server Certificate"
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer:always
+keyUsage = critical, digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth