765f599753
The certificate generation is based on work by Lars Karlitski in our osbuild
CA. The server and client certs now contains Subject Alternative Name making
Python's request module and Go 1.15 happy (they deprecated certificates
without SAN).
Several reasons why we want to switch to the certificate generation:
1) The pre-generated certificates are not documented. If someone wants
to inspect them, he must know the right openssl incantation. This way,
you are able to see what's inside the certificates in a plain text.
2) The pre-generated certificates are going to expire at one point and
someone will be surprised.
3) Shipping private keys in RPMs is iffy. I know, it's just for testing but
still...
4) Auth tests are generating their own certificates. To achieve consistency,
we have two options:
a) Ship also all certificates for auth tests. That's extra 8 ones or
something like that.
b) Generate all certificates on fly. This commit does that.
5) The setup introduced by this commit is very similar to the one in our CA
making the test environment very similar to what's running in production.
tl;dr: I think this is a good step forward.
85 lines
1.7 KiB
INI
85 lines
1.7 KiB
INI
#
|
|
# ca options
|
|
#
|
|
|
|
[ca]
|
|
default_ca = osbuild_ca
|
|
|
|
[osbuild_ca]
|
|
database = ./index.txt
|
|
new_certs_dir = ./certs
|
|
rand_serial = yes
|
|
|
|
certificate = ca.cert.pem
|
|
private_key = private/ca.key.pem
|
|
|
|
default_days = 3650
|
|
default_md = sha256
|
|
|
|
x509_extensions = osbuild_ca_ext
|
|
|
|
# See WARNINGS in `man openssl ca`. This is ok, becasue it only copies
|
|
# extensions that are not already specified in `osbuild_ca_ext`.
|
|
copy_extensions = copy
|
|
|
|
preserve = no
|
|
policy = osbuild_ca_policy
|
|
|
|
# We want to issue multiple certificates with the same subject in the
|
|
# testing environment.
|
|
unique_subject = no
|
|
|
|
|
|
[osbuild_ca_ext]
|
|
basicConstraints = critical, CA:TRUE
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid:always, issuer:always
|
|
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
|
|
|
|
|
|
[osbuild_ca_policy]
|
|
commonName = supplied
|
|
emailAddress = supplied
|
|
|
|
|
|
#
|
|
# Extensions for server certificates
|
|
#
|
|
|
|
[osbuild_server_ext]
|
|
basicConstraints = critical, CA:FALSE
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid, issuer:always
|
|
keyUsage = critical, digitalSignature, keyEncipherment
|
|
extendedKeyUsage = serverAuth
|
|
|
|
|
|
#
|
|
# Extensions for client certificates
|
|
#
|
|
|
|
[osbuild_client_ext]
|
|
basicConstraints = CA:FALSE
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid,issuer
|
|
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
|
|
extendedKeyUsage = clientAuth
|
|
|
|
|
|
#
|
|
# req options
|
|
#
|
|
|
|
[req]
|
|
default_md = sha256
|
|
default_bits = 2048
|
|
distinguished_name = osbuild_distinguished_name
|
|
|
|
|
|
#
|
|
# Only prompt for CN
|
|
#
|
|
|
|
[osbuild_distinguished_name]
|
|
CN = Common Name
|
|
emailAddress = E-Mail Address
|