ci: rework ssl cert generation (SAN usage)

Rework the generation of certificates, in order to make use of
the SubjectAltName (SAN) extension, that is required for modern
usage of TLS (see RFC 2818, or [1]) and now enforced by default
for go version 1.15[2] (Fedora 33). For this a different config
file is used, originally written by Lars, and assign SANs to
the server and client certificates. Additionally, the correct
extensions are used for each of those, so that their usage is
limited to the server or client use case. The client certificate
is renamed from "worker" to "client".
The lifetime of the certificates is increased, as a side effect of
the new config file.

[1] https://github.com/urllib3/urllib3/issues/497
[2] https://golang.org/doc/go1.15#commonname

Co-authored-by: Lars Karlitski <lars@karlitski.net>

test/make-certs.sh

@@ -13,41 +13,47 @@ CA_DIR="/etc/osbuild-composer"
 echo "Generating certificates"
 mkdir -p ${CA_DIR}
 
+CONFIG="${TEST_DATA}/openssl.conf"
+
 # The CA
-openssl req -new -nodes -x509 -days 365 \
+echo "-=[ CA"
+touch "${CA_DIR}/index.txt"
+openssl req -new -nodes -x509 \
+        -config "${CONFIG}" \
+        -extensions osbuild_ca_ext \
         -keyout "${CA_DIR}/ca-key.pem" \
         -out "${CA_DIR}/ca-crt.pem" \
         -subj "/CN=osbuild.org"
-openssl genrsa -out "${CA_DIR}/key.pem" 2048
 
 # composer
+echo "-=[ composer"
 openssl genrsa -out ${CA_DIR}/composer-key.pem 2048
 openssl req -new -sha256 \
+        -config "${CONFIG}" \
         -key ${CA_DIR}/composer-key.pem	\
         -out ${CA_DIR}/composer-csr.pem \
-        -config ${TEST_DATA}/composer.ssl.conf
-openssl x509 -req \
-        -in ${CA_DIR}/composer-csr.pem \
-        -CA ${CA_DIR}/ca-crt.pem \
-        -CAkey ${CA_DIR}/ca-key.pem \
-        -CAcreateserial \
-        -out ${CA_DIR}/composer-crt.pem \
-        -extfile ${TEST_DATA}/composer.ssl.conf \
-        -extensions v3_req
+        -subj "/CN=composer" \
+        -addext "subjectAltName=DNS.1:localhost,DNS.2:composer"
 
-# worker
-openssl genrsa -out ${CA_DIR}/worker-key.pem 2048
+openssl ca -config "$CONFIG" -batch \
+        -extensions osbuild_server_ext \
+        -in "${CA_DIR}/composer-csr.pem" \
+        -out "${CA_DIR}/composer-crt.pem"
+
+# client
+echo "-=[ client"
+openssl genrsa -out ${CA_DIR}/client-key.pem 2048
 openssl req -new -sha256 \
-        -key ${CA_DIR}/worker-key.pem	\
-        -out ${CA_DIR}/worker-csr.pem \
-        -subj "/CN=localhost"
+        -config "${CONFIG}" \
+        -key ${CA_DIR}/client-key.pem	\
+        -out ${CA_DIR}/client-csr.pem \
+        -subj "/CN=client.osbuild.local" \
+        -addext "subjectAltName=DNS:client.osbuild.local"
 
-openssl x509 -req \
-        -in ${CA_DIR}/worker-csr.pem \
-        -CA ${CA_DIR}/ca-crt.pem \
-        -CAkey ${CA_DIR}/ca-key.pem \
-        -CAcreateserial \
-        -out ${CA_DIR}/worker-crt.pem
+openssl ca -config "$CONFIG" -batch \
+        -extensions osbuild_client_ext \
+        -in "${CA_DIR}/client-csr.pem" \
+        -out "${CA_DIR}/client-crt.pem"
 
 # fix permissions for composer
 chown _osbuild-composer:_osbuild-composer ${CA_DIR}/composer-*