From f909dd2f80e26fefb5f9f5e3a6bf34db7aeb446e Mon Sep 17 00:00:00 2001 From: Nate Brown Date: Thu, 12 Jan 2017 14:34:33 -0800 Subject: [PATCH] Add support for adding any SAN identifier --- bin/certified-csr | 16 ++++++++++++++-- lib/certified.sh | 5 +++++ share/html/certified-ca.1.html | 7 ++++--- share/html/certified-csr.1.html | 7 ++++--- share/html/certified.1.html | 7 ++++--- share/man/man1/certified-ca.1 | 8 ++++++-- share/man/man1/certified-ca.1.ronn | 4 +++- share/man/man1/certified-csr.1 | 8 ++++++-- share/man/man1/certified-csr.1.ronn | 4 +++- share/man/man1/certified.1 | 8 ++++++-- share/man/man1/certified.1.ronn | 4 +++- test.sh | 5 +++++ 12 files changed, 63 insertions(+), 20 deletions(-) diff --git a/bin/certified-csr b/bin/certified-csr index 3388e02..6c5f26b 100755 --- a/bin/certified-csr +++ b/bin/certified-csr @@ -20,6 +20,7 @@ #/ CN= certificate common name (usually a domain name) #/ + add a DNS name to the certificate's subject alternative names #/ + add an IP address to the certificate's subject alternative names +#/ +: add any x509 SAN property, useful for RID, URI, email, etc set -e @@ -27,6 +28,7 @@ set -e SAN_DNS="" SAN_IP="" +SAN_ID="" while [ "$#" -gt 0 ] do case "$1" in @@ -60,7 +62,9 @@ do ST=*) ST="$(echo "$1" | cut -d"=" -f"2-")" shift;; +*) SAN="$(echo "$1" | cut -c"2-")" shift - if is_ip "$SAN" + if is_san_id "$SAN" + then SAN_ID="$SAN_ID $SAN" + elif is_ip "$SAN" then SAN_IP="$SAN_IP $SAN" elif is_dns "$SAN" then SAN_DNS="$SAN_DNS $SAN" @@ -142,7 +146,7 @@ default_md = sha256 distinguished_name = dn prompt = no EOF - if [ "$SAN_DNS" -o "$SAN_IP" ] + if [ "$SAN_DNS" -o "$SAN_IP" -o "$SAN_ID" ] then cat <&2 diff --git a/share/html/certified-ca.1.html b/share/html/certified-ca.1.html index 1dbfb67..7ffdda5 100644 --- a/share/html/certified-ca.1.html +++ b/share/html/certified-ca.1.html @@ -81,7 +81,7 @@

NAME

SYNOPSIS

-

certified-ca [--bits=bits] [--crl-url=crl-url] [--days=days] [--db=db] [--encrypt-intermediate] [--intermediate-password=intermediate-password] [--ocsp-url=ocsp-url] [--revoke] [--root-crl-url=root-crl-url] [--root-password=root-password] [OU=org-unit] C=country ST=state L=locality O=organization CN=common-name

+

certified-ca [--bits=bits] [--crl-url=crl-url] [--days=days] [--db=db] [--encrypt-intermediate] [--intermediate-password=intermediate-password] [--ocsp-url=ocsp-url] [--revoke] [--root-crl-url=root-crl-url] [--root-password=root-password] [OU=org-unit] C=country ST=state L=locality O=organization CN=common-name [+dns[...]] [+ip[...]] [+id:value[...]]

DESCRIPTION

@@ -109,6 +109,7 @@

OPTIONS

OU=org-unit
Certificate organizational unit (usually a department or group).
CN=common-name
Certificate common name (usually a domain name or Company CA).
+dns, +ip
Add a DNS name or IP address to the certificate's subject alternative names.
+
+id:value
Add any SAN field to the certificate's subject alternative names, ie: URI:mailto:nobody@example.com.
@@ -118,7 +119,7 @@

THEME SONG

AUTHOR

-

Richard Crowley <r@rcrowley.org>

+

Richard Crowley <r@rcrowley.org>

SEE ALSO

@@ -133,7 +134,7 @@

SEE ALSO

  1. -
  2. October 2015
    3. +
  3. January 2017
  4. certified-ca(1)
diff --git a/share/html/certified-csr.1.html b/share/html/certified-csr.1.html index 20db186..78d9652 100644 --- a/share/html/certified-csr.1.html +++ b/share/html/certified-csr.1.html @@ -81,7 +81,7 @@

NAME

SYNOPSIS

-

certified-csr [--bits=bits] [--ca] [--crl-url=crl-url] [--days=days] [--db=db] [--encrypt] [--issuer=issuer] [--issuer-name=issuer-name] [--name=name] [--ocsp-url=ocsp-url] [--password=password] [C=country] [ST=state] [L=locality] [O=organization] [OU=org-unit] CN=common-name [+dns[...]] [+ip[...]]

+

certified-csr [--bits=bits] [--ca] [--crl-url=crl-url] [--days=days] [--db=db] [--encrypt] [--issuer=issuer] [--issuer-name=issuer-name] [--name=name] [--ocsp-url=ocsp-url] [--password=password] [C=country] [ST=state] [L=locality] [O=organization] [OU=org-unit] CN=common-name [+dns[...]] [+ip[...]] [+id:value[...]]

DESCRIPTION

@@ -110,6 +110,7 @@

OPTIONS

OU=org-unit
Certificate organizational unit (usually a department or group; defaults to the CA organizational unit).
CN=common-name
Certificate common name (usually a domain name).
+dns, +ip
Add a DNS name or IP address to the certificate's subject alternative names.
+
+id:value
Add any SAN field to the certificate's subject alternative names, ie: URI:mailto:nobody@example.com.
@@ -119,7 +120,7 @@

THEME SONG

AUTHOR

-

Richard Crowley <r@rcrowley.org>

+

Richard Crowley <r@rcrowley.org>

SEE ALSO

@@ -134,7 +135,7 @@

SEE ALSO

  1. -
  2. October 2015
    3. +
  3. January 2017
  4. certified-csr(1)
diff --git a/share/html/certified.1.html b/share/html/certified.1.html index 4aef4ba..ca1365d 100644 --- a/share/html/certified.1.html +++ b/share/html/certified.1.html @@ -81,7 +81,7 @@

NAME

SYNOPSIS

-

certified [--bits=bits] [--ca] [--ca-password=ca-password] [--days=days] [--db=db] [--encrypt] [--issuer=issuer] [--issuer-name=issuer-name] [--name=name] [--no-sign] [--password=password] [--revoke] [--self-signed] [C=country] [ST=state] [L=locality] [O=organization] [OU=org-unit] CN=common-name [+dns[...]] [+ip[...]]

+

certified [--bits=bits] [--ca] [--ca-password=ca-password] [--days=days] [--db=db] [--encrypt] [--issuer=issuer] [--issuer-name=issuer-name] [--name=name] [--no-sign] [--password=password] [--revoke] [--self-signed] [C=country] [ST=state] [L=locality] [O=organization] [OU=org-unit] CN=common-name [+dns[...]] [+ip[...]] [+id:value[...]]

DESCRIPTION

@@ -112,6 +112,7 @@

OPTIONS

OU=org-unit
Certificate organizational unit (usually a department or group; defaults to the CA organizational unit).
CN=common-name
Certificate common name (usually a domain name).
+dns, +ip
Add a DNS name or IP address to the certificate's subject alternative names.
+
+id:value
Add any SAN field to the certificate's subject alternative names, ie: URI:mailto:nobody@example.com.
@@ -121,7 +122,7 @@

THEME SONG

AUTHOR

-

Richard Crowley <r@rcrowley.org>

+

Richard Crowley <r@rcrowley.org>

SEE ALSO

@@ -136,7 +137,7 @@

SEE ALSO

  1. -
  2. October 2015
    3. +
  3. January 2017
  4. certified(1)
diff --git a/share/man/man1/certified-ca.1 b/share/man/man1/certified-ca.1 index 993952e..fde60fa 100644 --- a/share/man/man1/certified-ca.1 +++ b/share/man/man1/certified-ca.1 @@ -1,13 +1,13 @@ .\" generated with Ronn/v0.7.3 .\" http://github.com/rtomayko/ronn/tree/0.7.3 . -.TH "CERTIFIED\-CA" "1" "October 2015" "" "Certified" +.TH "CERTIFIED\-CA" "1" "January 2017" "" "Certified" . .SH "NAME" \fBcertified\-ca\fR \- generate a CA . .SH "SYNOPSIS" -\fBcertified\-ca\fR [\fB\-\-bits\fR=\fIbits\fR] [\fB\-\-crl\-url\fR=\fIcrl\-url\fR] [\fB\-\-days\fR=\fIdays\fR] [\fB\-\-db\fR=\fIdb\fR] [\fB\-\-encrypt\-intermediate\fR] [\fB\-\-intermediate\-password\fR=\fIintermediate\-password\fR] [\fB\-\-ocsp\-url\fR=\fIocsp\-url\fR] [\fB\-\-revoke\fR] [\fB\-\-root\-crl\-url\fR=\fIroot\-crl\-url\fR] [\fB\-\-root\-password\fR=\fIroot\-password\fR] [\fBOU\fR=\fIorg\-unit\fR] \fBC\fR=\fIcountry\fR \fBST\fR=\fIstate\fR \fBL\fR=\fIlocality\fR \fBO\fR=\fIorganization\fR \fBCN\fR=\fIcommon\-name\fR +\fBcertified\-ca\fR [\fB\-\-bits\fR=\fIbits\fR] [\fB\-\-crl\-url\fR=\fIcrl\-url\fR] [\fB\-\-days\fR=\fIdays\fR] [\fB\-\-db\fR=\fIdb\fR] [\fB\-\-encrypt\-intermediate\fR] [\fB\-\-intermediate\-password\fR=\fIintermediate\-password\fR] [\fB\-\-ocsp\-url\fR=\fIocsp\-url\fR] [\fB\-\-revoke\fR] [\fB\-\-root\-crl\-url\fR=\fIroot\-crl\-url\fR] [\fB\-\-root\-password\fR=\fIroot\-password\fR] [\fBOU\fR=\fIorg\-unit\fR] \fBC\fR=\fIcountry\fR \fBST\fR=\fIstate\fR \fBL\fR=\fIlocality\fR \fBO\fR=\fIorganization\fR \fBCN\fR=\fIcommon\-name\fR [\fB+\fR\fIdns\fR[\fI\.\.\.\fR]] [\fB+\fR\fIip\fR[\fI\.\.\.\fR]] [\fB+\fR\fIid\fR:\fIvalue\fR[\fI\.\.\.\fR]] . .SH "DESCRIPTION" Generate two private keys\. The first is self\-signed to generate the root CA certificate\. It is then used to sign the second to generate the intermediate CA certificate\. The root CA certificate should be installed on laptops and servers\. The intermediate CA signs subsequent certificates and may itself be revoked in the event its private key is compromised\. @@ -85,6 +85,10 @@ Certificate common name (usually a domain name or \fICompany CA\fR)\. \fB+\fR\fIdns\fR, \fB+\fR\fIip\fR Add a DNS name or IP address to the certificate\'s subject alternative names\. . +.TP +\fB+\fR\fIid\fR:\fIvalue\fR +Add any SAN field to the certificate\'s subject alternative names, ie: URI:mailto:nobody@example\.com\. +. .SH "THEME SONG" Led Zeppelin \- "Fool in the Rain" . diff --git a/share/man/man1/certified-ca.1.ronn b/share/man/man1/certified-ca.1.ronn index 6057f25..7ec7b5c 100644 --- a/share/man/man1/certified-ca.1.ronn +++ b/share/man/man1/certified-ca.1.ronn @@ -2,7 +2,7 @@ ## SYNOPSIS -`certified-ca` [`--bits`=_bits_] [`--crl-url`=_crl-url_] [`--days`=_days_] [`--db`=_db_] [`--encrypt-intermediate`] [`--intermediate-password`=_intermediate-password_] [`--ocsp-url`=_ocsp-url_] [`--revoke`] [`--root-crl-url`=_root-crl-url_] [`--root-password`=_root-password_] [`OU`=_org-unit_] `C`=_country_ `ST`=_state_ `L`=_locality_ `O`=_organization_ `CN`=_common-name_ +`certified-ca` [`--bits`=_bits_] [`--crl-url`=_crl-url_] [`--days`=_days_] [`--db`=_db_] [`--encrypt-intermediate`] [`--intermediate-password`=_intermediate-password_] [`--ocsp-url`=_ocsp-url_] [`--revoke`] [`--root-crl-url`=_root-crl-url_] [`--root-password`=_root-password_] [`OU`=_org-unit_] `C`=_country_ `ST`=_state_ `L`=_locality_ `O`=_organization_ `CN`=_common-name_ [`+`_dns_[_..._]] [`+`_ip_[_..._]] [`+`_id_:_value_[_..._]] ## DESCRIPTION @@ -46,6 +46,8 @@ _db_ is an OpenSSL database that `certified`(1) uses to issue and revoke certifi Certificate common name (usually a domain name or _Company CA_). * `+`_dns_, `+`_ip_: Add a DNS name or IP address to the certificate's subject alternative names. +* `+`_id_:_value_: + Add any SAN field to the certificate's subject alternative names, ie: URI:mailto:nobody@example.com. ## THEME SONG diff --git a/share/man/man1/certified-csr.1 b/share/man/man1/certified-csr.1 index 35863b7..8e2c470 100644 --- a/share/man/man1/certified-csr.1 +++ b/share/man/man1/certified-csr.1 @@ -1,13 +1,13 @@ .\" generated with Ronn/v0.7.3 .\" http://github.com/rtomayko/ronn/tree/0.7.3 . -.TH "CERTIFIED\-CSR" "1" "October 2015" "" "Certified" +.TH "CERTIFIED\-CSR" "1" "January 2017" "" "Certified" . .SH "NAME" \fBcertified\-csr\fR \- generate certificate signing requests . .SH "SYNOPSIS" -\fBcertified\-csr\fR [\fB\-\-bits\fR=\fIbits\fR] [\fB\-\-ca\fR] [\fB\-\-crl\-url\fR=\fIcrl\-url\fR] [\fB\-\-days\fR=\fIdays\fR] [\fB\-\-db\fR=\fIdb\fR] [\fB\-\-encrypt\fR] [\fB\-\-issuer\fR=\fIissuer\fR] [\fB\-\-issuer\-name\fR=\fIissuer\-name\fR] [\fB\-\-name\fR=\fIname\fR] [\fB\-\-ocsp\-url\fR=\fIocsp\-url\fR] [\fB\-\-password\fR=\fIpassword\fR] [\fBC\fR=\fIcountry\fR] [\fBST\fR=\fIstate\fR] [\fBL\fR=\fIlocality\fR] [\fBO\fR=\fIorganization\fR] [\fBOU\fR=\fIorg\-unit\fR] \fBCN\fR=\fIcommon\-name\fR [\fB+\fR\fIdns\fR[\fI\.\.\.\fR]] [\fB+\fR\fIip\fR[\fI\.\.\.\fR]] +\fBcertified\-csr\fR [\fB\-\-bits\fR=\fIbits\fR] [\fB\-\-ca\fR] [\fB\-\-crl\-url\fR=\fIcrl\-url\fR] [\fB\-\-days\fR=\fIdays\fR] [\fB\-\-db\fR=\fIdb\fR] [\fB\-\-encrypt\fR] [\fB\-\-issuer\fR=\fIissuer\fR] [\fB\-\-issuer\-name\fR=\fIissuer\-name\fR] [\fB\-\-name\fR=\fIname\fR] [\fB\-\-ocsp\-url\fR=\fIocsp\-url\fR] [\fB\-\-password\fR=\fIpassword\fR] [\fBC\fR=\fIcountry\fR] [\fBST\fR=\fIstate\fR] [\fBL\fR=\fIlocality\fR] [\fBO\fR=\fIorganization\fR] [\fBOU\fR=\fIorg\-unit\fR] \fBCN\fR=\fIcommon\-name\fR [\fB+\fR\fIdns\fR[\fI\.\.\.\fR]] [\fB+\fR\fIip\fR[\fI\.\.\.\fR]] [\fB+\fR\fIid\fR:\fIvalue\fR[\fI\.\.\.\fR]] . .SH "DESCRIPTION" Generate a certificate signing request\. @@ -89,6 +89,10 @@ Certificate common name (usually a domain name)\. \fB+\fR\fIdns\fR, \fB+\fR\fIip\fR Add a DNS name or IP address to the certificate\'s subject alternative names\. . +.TP +\fB+\fR\fIid\fR:\fIvalue\fR +Add any SAN field to the certificate\'s subject alternative names, ie: URI:mailto:nobody@example\.com\. +. .SH "THEME SONG" Led Zeppelin \- "Fool in the Rain" . diff --git a/share/man/man1/certified-csr.1.ronn b/share/man/man1/certified-csr.1.ronn index 9e5144c..4302378 100644 --- a/share/man/man1/certified-csr.1.ronn +++ b/share/man/man1/certified-csr.1.ronn @@ -2,7 +2,7 @@ ## SYNOPSIS -`certified-csr` [`--bits`=_bits_] [`--ca`] [`--crl-url`=_crl-url_] [`--days`=_days_] [`--db`=_db_] [`--encrypt`] [`--issuer`=_issuer_] [`--issuer-name`=_issuer-name_] [`--name`=_name_] [`--ocsp-url`=_ocsp-url_] [`--password`=_password_] [`C`=_country_] [`ST`=_state_] [`L`=_locality_] [`O`=_organization_] [`OU`=_org-unit_] `CN`=_common-name_ [`+`_dns_[_..._]] [`+`_ip_[_..._]] +`certified-csr` [`--bits`=_bits_] [`--ca`] [`--crl-url`=_crl-url_] [`--days`=_days_] [`--db`=_db_] [`--encrypt`] [`--issuer`=_issuer_] [`--issuer-name`=_issuer-name_] [`--name`=_name_] [`--ocsp-url`=_ocsp-url_] [`--password`=_password_] [`C`=_country_] [`ST`=_state_] [`L`=_locality_] [`O`=_organization_] [`OU`=_org-unit_] `CN`=_common-name_ [`+`_dns_[_..._]] [`+`_ip_[_..._]] [`+`_id_:_value_[_..._]] ## DESCRIPTION @@ -48,6 +48,8 @@ Additional DNS names, including wildcards, and IP addresses can be added to the Certificate common name (usually a domain name). * `+`_dns_, `+`_ip_: Add a DNS name or IP address to the certificate's subject alternative names. +* `+`_id_:_value_: + Add any SAN field to the certificate's subject alternative names, ie: URI:mailto:nobody@example.com. ## THEME SONG diff --git a/share/man/man1/certified.1 b/share/man/man1/certified.1 index 6c9049b..64b0467 100644 --- a/share/man/man1/certified.1 +++ b/share/man/man1/certified.1 @@ -1,13 +1,13 @@ .\" generated with Ronn/v0.7.3 .\" http://github.com/rtomayko/ronn/tree/0.7.3 . -.TH "CERTIFIED" "1" "October 2015" "" "Certified" +.TH "CERTIFIED" "1" "January 2017" "" "Certified" . .SH "NAME" \fBcertified\fR \- generate and sign certificates . .SH "SYNOPSIS" -\fBcertified\fR [\fB\-\-bits\fR=\fIbits\fR] [\fB\-\-ca\fR] [\fB\-\-ca\-password\fR=\fIca\-password\fR] [\fB\-\-days\fR=\fIdays\fR] [\fB\-\-db\fR=\fIdb\fR] [\fB\-\-encrypt\fR] [\fB\-\-issuer\fR=\fIissuer\fR] [\fB\-\-issuer\-name\fR=\fIissuer\-name\fR] [\fB\-\-name\fR=\fIname\fR] [\fB\-\-no\-sign\fR] [\fB\-\-password\fR=\fIpassword\fR] [\fB\-\-revoke\fR] [\fB\-\-self\-signed\fR] [\fBC\fR=\fIcountry\fR] [\fBST\fR=\fIstate\fR] [\fBL\fR=\fIlocality\fR] [\fBO\fR=\fIorganization\fR] [\fBOU\fR=\fIorg\-unit\fR] \fBCN\fR=\fIcommon\-name\fR [\fB+\fR\fIdns\fR[\fI\.\.\.\fR]] [\fB+\fR\fIip\fR[\fI\.\.\.\fR]] +\fBcertified\fR [\fB\-\-bits\fR=\fIbits\fR] [\fB\-\-ca\fR] [\fB\-\-ca\-password\fR=\fIca\-password\fR] [\fB\-\-days\fR=\fIdays\fR] [\fB\-\-db\fR=\fIdb\fR] [\fB\-\-encrypt\fR] [\fB\-\-issuer\fR=\fIissuer\fR] [\fB\-\-issuer\-name\fR=\fIissuer\-name\fR] [\fB\-\-name\fR=\fIname\fR] [\fB\-\-no\-sign\fR] [\fB\-\-password\fR=\fIpassword\fR] [\fB\-\-revoke\fR] [\fB\-\-self\-signed\fR] [\fBC\fR=\fIcountry\fR] [\fBST\fR=\fIstate\fR] [\fBL\fR=\fIlocality\fR] [\fBO\fR=\fIorganization\fR] [\fBOU\fR=\fIorg\-unit\fR] \fBCN\fR=\fIcommon\-name\fR [\fB+\fR\fIdns\fR[\fI\.\.\.\fR]] [\fB+\fR\fIip\fR[\fI\.\.\.\fR]] [\fB+\fR\fIid\fR:\fIvalue\fR[\fI\.\.\.\fR]] . .SH "DESCRIPTION" Generate and sign a certificate with the CA in \fIdb\fR unless \fB\-\-revoke\fR is given, in which case the certificate is revoked instead\. @@ -97,6 +97,10 @@ Certificate common name (usually a domain name)\. \fB+\fR\fIdns\fR, \fB+\fR\fIip\fR Add a DNS name or IP address to the certificate\'s subject alternative names\. . +.TP +\fB+\fR\fIid\fR:\fIvalue\fR +Add any SAN field to the certificate\'s subject alternative names, ie: URI:mailto:nobody@example\.com\. +. .SH "THEME SONG" Led Zeppelin \- "Fool in the Rain" . diff --git a/share/man/man1/certified.1.ronn b/share/man/man1/certified.1.ronn index a3ee3e2..93fc30c 100644 --- a/share/man/man1/certified.1.ronn +++ b/share/man/man1/certified.1.ronn @@ -2,7 +2,7 @@ ## SYNOPSIS -`certified` [`--bits`=_bits_] [`--ca`] [`--ca-password`=_ca-password_] [`--days`=_days_] [`--db`=_db_] [`--encrypt`] [`--issuer`=_issuer_] [`--issuer-name`=_issuer-name_] [`--name`=_name_] [`--no-sign`] [`--password`=_password_] [`--revoke`] [`--self-signed`] [`C`=_country_] [`ST`=_state_] [`L`=_locality_] [`O`=_organization_] [`OU`=_org-unit_] `CN`=_common-name_ [`+`_dns_[_..._]] [`+`_ip_[_..._]] +`certified` [`--bits`=_bits_] [`--ca`] [`--ca-password`=_ca-password_] [`--days`=_days_] [`--db`=_db_] [`--encrypt`] [`--issuer`=_issuer_] [`--issuer-name`=_issuer-name_] [`--name`=_name_] [`--no-sign`] [`--password`=_password_] [`--revoke`] [`--self-signed`] [`C`=_country_] [`ST`=_state_] [`L`=_locality_] [`O`=_organization_] [`OU`=_org-unit_] `CN`=_common-name_ [`+`_dns_[_..._]] [`+`_ip_[_..._]] [`+`_id_:_value_[_..._]] ## DESCRIPTION @@ -52,6 +52,8 @@ Additional DNS names, including wildcards, and IP addresses can be added to the Certificate common name (usually a domain name). * `+`_dns_, `+`_ip_: Add a DNS name or IP address to the certificate's subject alternative names. +* `+`_id_:_value_: + Add any SAN field to the certificate's subject alternative names, ie: URI:mailto:nobody@example.com. ## THEME SONG diff --git a/test.sh b/test.sh index 68baa66..6d3c521 100644 --- a/test.sh +++ b/test.sh @@ -150,6 +150,11 @@ certified CN="Wildcard" +"*.example.com" openssl x509 -in "etc/ssl/certs/wildcard.crt" -noout -text | grep -F -q "DNS:*.example.com" +# Test that we can add generic SAN IDs to a certificate. +certified CN="AnySAN" +"URI:hello:world" +openssl x509 -in "etc/ssl/certs/anysan.crt" -noout -text | +grep -F -q "URI:hello:world" + # Test that we can't add double DNS wildcards to a certificate. certified CN="Double Wildcard" +"*.*.example.com" && false