nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #133 from mschmitt/no-smime

Browse Source 
Default SAN in server certs, serial randomization
This commit is contained in:
Eric Crist 2017-06-30 18:09:53 -05:00 committed by GitHub
commit f480de2b77
1 changed files with 37 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
easyrsa3/easyrsa
View File

@ -569,6 +569,18 @@ sign_req() {
local req_in="$EASYRSA_PKI/reqs/$2.req"
local crt_out="$EASYRSA_PKI/issued/$2.crt"
# Randomize Serial number
local i= serial= check_serial=
for i in 1 2 3 4 5; do
"$EASYRSA_OPENSSL" rand -hex 16 -out "$EASYRSA_PKI/serial"
serial="$(cat "$EASYRSA_PKI/serial")"
check_serial="$("$EASYRSA_OPENSSL" ca -config "$EASYRSA_SSL_CONF" -status "$serial" 2>&1)"
case "$check_serial" in
*"not present in db"*) break ;;
*) continue ;;
esac
done
# Support batch by internal caller:
[ "$3" = "batch" ] && local EASYRSA_BATCH=1
@ -627,6 +639,15 @@ $(display_dn req "$req_in")
esac
fi
# If type is server and no subjectAltName was requested,
# add one to the extensions file
if [[ "$crt_type" == 'server' ]]
then
echo "$EASYRSA_EXTRA_EXTS" |
grep -q subjectAltName ||
print $(default_server_san "$req_in")
fi
# Add any advanced extensions supplied by env-var:
[ -n "$EASYRSA_EXTRA_EXTS" ] && print "$EASYRSA_EXTRA_EXTS"
@ -652,17 +673,6 @@ Certificate created at: $crt_out
build_full() {
verify_ca_init
local i= serial= check_serial=
for i in 1 2 3 4 5; do
"$EASYRSA_OPENSSL" rand -hex 16 -out "$EASYRSA_PKI/serial"
serial="$(cat "$EASYRSA_PKI/serial")"
check_serial="$("$EASYRSA_OPENSSL" ca -config "$EASYRSA_SSL_CONF" -status "$serial" 2>&1)"
case "$check_serial" in
*"not present in db"*) break ;;
*) continue ;;
esac
done
# pull filename base:
[ -n "$2" ] || die "\
Error: didn't find a file base name as the first argument.
@ -923,6 +933,22 @@ display_dn() {
print "$("$EASYRSA_OPENSSL" $format -in "$path" -noout -subject -nameopt multiline)"
} # => display_dn()
# generate default SAN from req/X509, passed by full pathname
default_server_san() {
local path="$1"
local cn=$(
"$EASYRSA_OPENSSL" req -in "$path" -noout -subject -nameopt sep_multiline |
awk -F'=' '/^ *CN=/{print $2}'
)
echo "$cn" | egrep -q '^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$'
if [[ $? -eq 0 ]]
then
print "subjectAltName = IP:$cn"
else
print "subjectAltName = DNS:$cn"
fi
} # => default_server_san()
# verify a file seems to be a valid req/X509
verify_file() {
local format="$1" path="$2"