tyler.durden
/
icinga2
mirror of https://github.com/Icinga/icinga2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Set CA flag for new CA certificates 

refs #7247
This commit is contained in:
Gunnar Beutner 2014-10-13 13:58:18 +02:00
parent a01fb6d6e6
commit fab9d7eedf
3 changed files with 19 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
lib/base/tlsutility.cpp
View File

@ -22,7 +22,6 @@
#include "base/logger_fwd.hpp" #include "base/logger_fwd.hpp"
#include "base/context.hpp" #include "base/context.hpp"
namespace icinga namespace icinga
{ {
@ -246,7 +245,7 @@ shared_ptr<X509> GetX509Certificate(const String& pemfile)
return shared_ptr<X509>(cert, X509_free); return shared_ptr<X509>(cert, X509_free);
} }
int MakeX509CSR(const String& cn, const String& keyfile, const String& csrfile, const String& certfile) int MakeX509CSR(const String& cn, const String& keyfile, const String& csrfile, const String& certfile, bool ca)
{ {
InitializeOpenSSL(); InitializeOpenSSL();
@ -281,6 +280,21 @@ int MakeX509CSR(const String& cn, const String& keyfile, const String& csrfile,
X509_NAME *name = X509_get_subject_name(cert); X509_NAME *name = X509_get_subject_name(cert);
X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned char *)cn.CStr(), -1, -1, 0); X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned char *)cn.CStr(), -1, -1, 0);
X509_set_issuer_name(cert, name); X509_set_issuer_name(cert, name);
if (ca) {
X509_EXTENSION *ext;
X509V3_CTX ctx;
X509V3_set_ctx_nodb(&ctx);
X509V3_set_ctx(&ctx, cert, cert, NULL, NULL, 0);
ext = X509V3_EXT_conf_nid(NULL, &ctx, NID_basic_constraints, const_cast<char *>("critical,CA:TRUE"));
if (ext)
X509_add_ext(cert, ext, -1);
X509_EXTENSION_free(ext);
}
X509_sign(cert, key, EVP_sha1()); X509_sign(cert, key, EVP_sha1());
Log(LogInformation, "base", "Writing X509 certificate to '" + certfile + "'."); Log(LogInformation, "base", "Writing X509 certificate to '" + certfile + "'.");

3
lib/base/tlsutility.hpp
View File

@ -29,6 +29,7 @@
#include <openssl/err.h> #include <openssl/err.h>
#include <openssl/comp.h> #include <openssl/comp.h>
#include <openssl/sha.h> #include <openssl/sha.h>
#include <openssl/x509v3.h>
namespace icinga namespace icinga
{ {
@ -37,7 +38,7 @@ shared_ptr<SSL_CTX> I2_BASE_API MakeSSLContext(const String& pubkey, const Strin
void I2_BASE_API AddCRLToSSLContext(const shared_ptr<SSL_CTX>& context, const String& crlPath); void I2_BASE_API AddCRLToSSLContext(const shared_ptr<SSL_CTX>& context, const String& crlPath);
String I2_BASE_API GetCertificateCN(const shared_ptr<X509>& certificate); String I2_BASE_API GetCertificateCN(const shared_ptr<X509>& certificate);
shared_ptr<X509> I2_BASE_API GetX509Certificate(const String& pemfile); shared_ptr<X509> I2_BASE_API GetX509Certificate(const String& pemfile);
int I2_BASE_API MakeX509CSR(const String& cn, const String& keyfile, const String& csrfile = String(), const String& certfile = String()); int I2_BASE_API MakeX509CSR(const String& cn, const String& keyfile, const String& csrfile = String(), const String& certfile = String(), bool ca = false);
String I2_BASE_API SHA256(const String& s); String I2_BASE_API SHA256(const String& s);
class I2_BASE_API openssl_error : virtual public std::exception, virtual public boost::exception { }; class I2_BASE_API openssl_error : virtual public std::exception, virtual public boost::exception { };

2
lib/cli/pkinewcacommand.cpp
View File

@ -63,7 +63,7 @@ int PKINewCACommand::Run(const boost::program_options::variables_map& vm) const
return 1; return 1;
} }
MakeX509CSR("Icinga CA", cadir + "/ca.key", String(), cadir + "/ca.crt"); MakeX509CSR("Icinga CA", cadir + "/ca.key", String(), cadir + "/ca.crt", true);
String serialpath = cadir + "/serial.txt"; String serialpath = cadir + "/serial.txt";