nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for generating KDC server certificates

Browse Source
This commit is contained in:
Xavier Bachelot 2019-07-31 19:22:08 +02:00
parent 57ef07f133
commit 83962ca5c4
3 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
easyrsa3/easyrsa
View File

@ -1580,6 +1580,7 @@ Note: using Easy-RSA configuration from: $vars"
set_var EASYRSA_DIGEST sha256 set_var EASYRSA_DIGEST sha256
set_var EASYRSA_SSL_CONF "$EASYRSA_PKI/openssl-easyrsa.cnf" set_var EASYRSA_SSL_CONF "$EASYRSA_PKI/openssl-easyrsa.cnf"
set_var EASYRSA_SAFE_CONF "$EASYRSA_PKI/safessl-easyrsa.cnf" set_var EASYRSA_SAFE_CONF "$EASYRSA_PKI/safessl-easyrsa.cnf"
set_var EASYRSA_KDC_REALM "CHANGEME.EXAMPLE.COM"
# Same as above for the x509-types extensions dir # Same as above for the x509-types extensions dir
if [ -d "$EASYRSA_PKI/x509-types" ]; then if [ -d "$EASYRSA_PKI/x509-types" ]; then

3
easyrsa3/vars.example
View File

@ -190,6 +190,9 @@ fi
# #
#set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types" #set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types"
# If you want to generate KDC certificates, you need to set the realm here.
#set_var EASYRSA_KDC_REALM "CHANGEME.EXAMPLE.COM"
# OpenSSL config file: # OpenSSL config file:
# If you need to use a specific openssl config file, you can reference it here. # If you need to use a specific openssl config file, you can reference it here.
# Normally this file is auto-detected from a file named openssl-easyrsa.cnf from the # Normally this file is auto-detected from a file named openssl-easyrsa.cnf from the

21
easyrsa3/x509-types/kdc Normal file
View File

@ -0,0 +1,21 @@
# X509 extensions for a KDC server certificate
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
extendedKeyUsage = 1.3.6.1.5.2.3.5
keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
issuerAltName = issuer:copy
subjectAltName = otherName:1.3.6.1.5.2.2;SEQUENCE:kdc_princ_name
[kdc_princ_name]
realm = EXP:0,GeneralString:${ENV::EASYRSA_KDC_REALM}
principal_name = EXP:1,SEQUENCE:kdc_principal_seq
[kdc_principal_seq]
name_type = EXP:0,INTEGER:1
name_string = EXP:1,SEQUENCE:kdc_principals
[kdc_principals]
princ1 = GeneralString:krbtgt
princ2 = GeneralString:${ENV::EASYRSA_KDC_REALM}