coreos/etcd-ca

etcd-ca

A simple certificate manager written in Go. Easy to use with limited capability.

DEPRECATED

etcd now uses cfssl as the official tool to generate certificates. cfssl provides more features and is well maintained. We provide an example using the tool here.

Common Uses

etcd-ca allows you to build your own certificate system:

1. Create certificate authority
2. Create, issue and export host certificates
3. Manage host identities
4. Deploy a Public Key Infrastructure

Primarly used for coreos/etcd SSL/TLS testing.

Certificate architecture

etcd-ca inits a certificate authority, and issues certificates using the authority only. It indicates the length of authorization path is at most 2.

Examples

Create a new certificate authority:

$ ./etcd-ca init
Created ca/key
Created ca/crt

Create a new host identity, including keypair and certificate request:

$ ./etcd-ca new-cert alice
Created alice/key
Created alice/csr

etcd-ca uses 127.0.0.1 for IP SAN in default. If etcd has peer address $etcd_ip other than 127.0.0.1, run ./etcd-ca new-cert -ip $etcd_ip alice instead.

If your server has mutiple ip addresses or domains, use comma seperated ip/domain list with -ip/-domain. eg: ./etcd-ca new-cert -ip $etcd_ip1,$etcd_ip2 -domain $etcd_domain1,$etcd_domain2

Sign certificate request of host and generate the certificate:

$ ./etcd-ca sign alice
Created alice/crt from alice/csr signed by ca.key

Export the certificate chain for host:

$ ./etcd-ca chain alice
----BEGIN CERTIFICATE-----
CA certificate body
-----END CERTIFICATE-----
----BEGIN CERTIFICATE-----
alice certificate body
-----END CERTIFICATE-----

Package up the certificate and key of host:

$ ./etcd-ca export alice > alice.tar

Because etcd takes unencrypted key for -key-file and -peer-key-file, you should use ./etcd-ca export --insecure alice > alice.tar to export private key.

List the status of all certificates:

$ ./etcd-ca status
ca: WARN (60 days until expiration)
alice: OK (120 days until expiration)
bob: Unsigned

Getting Started

Building

etcd-ca must be built with Go 1.3+. You can build etcd-ca from source:

$ git clone https://github.com/coreos/etcd-ca
$ cd etcd-ca
$ ./build

This will generate a binary called ./bin/etcd-ca

Examples

generate certificates for etcd

Project Details

Contributing

See CONTRIBUTING for details on submitting patches and contacting developers via IRC and mailing lists.

License

etcd-ca is under the Apache 2.0 license. See the LICENSE file for details.

etcd-ca's Issues

Exits with "success" status on unknown argument

$ ./bin/etcd-ca init --some-option
Incorrect Usage.

NAME:
   init - Create Certificate Authority

USAGE:
   command init [command options] [arguments...]

DESCRIPTION:
   Create Certificate Authority, including certificate, key and extra information file.

OPTIONS:
   --passphrase ''  Passphrase to encrypt private-key PEM block
   --key-bits '4096'    Bit size of RSA keypair to generate

$ echo $?
0

Build Fails: undefined: x509.CertificateRequest

Hey,

Im trying to build etcd-ca on Ubuntu Utopic with go 1.2.1:

go version go1.2.1 linux/amd64

and I get this error:

~/Development/workspace/etcd-ca$ ./build 
Building etcd-ca
# github.com/coreos/etcd-ca/pkix
src/github.com/coreos/etcd-ca/pkix/csr.go:89: undefined: x509.CertificateRequest

I am using golang from Ubuntu Repository. I found this issue (another repo) cloudflare/cfssl#36 where it says

Unfortunately, certificate requests were introduced in Go 1.3;

https://github.com/coreos/etcd-ca/blob/master/README.md#building the go Version should be changed from 1.2+ to 1.3+?

After update to go 1.4.1 and a new git clone everything works perfectly.

add document about how to integrate with etcd

Improvements: managing dependencies with godep

Do you accept PR if I refactor the build system to use godep?

Support IP SANs in CSRs

Hej!

As discussed in etcd-io/etcd#971 certificates without IP SANs can fail SSL verifications when IPs are used as etcd peer addresses.

An easy way to work around this would be to let etcd-ca generate CSRs with IP SANs - that's not fun to do in OpenSSL directly (like most things, which I guess is why this project exists), so it would be nice to have it as a feature here instead.

//V

bug-report: etcd-ca status doesn't show unsigned certificate

> ./etcd-ca init
> ./etcd-ca new-cert bob
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Created bob/key
Created bob/crt

####
# Issue: doesn't show Unsigned bob
####
> ./etcd-ca status
CA: OK (3652.95 days until expiration)

> ./etcd-ca sign bob
Enter passphrase for CA key (empty for no passphrase): 
Created bob/crt from bob/csr signed by ca/key

> ./etcd-ca status
CA: OK (3652.95 days until expiration)
bob: OK (3653.00 days until expiration)

Add ability to revoke certificates

It would be handy to have the ability to invalidate/revoke a client certificate.

test failed on both Go 1.2.x and Go 1.3.1 on mac OSX 10.9.4

--- FAIL: TestWorkflow (9.44 seconds)
workflow_test.go:44: Received unexpected error: Outputting CA certificate body:
,

cloned the repository
ran build (which succeeded)
ran test (which failed)
bin/etcd-ca init (succeeded with empty passphrase)
bin/etcd-ca new-cert alice (succeeded with empty passphrase)
bin/etcd-ca sign alice (succeeded with empty passphrase)
bin/etcd-ca chain alice (succeeded)
bin/etcd-ca export alice (succeeded)

missing terminal third_party

$ go get github.com/coreos/etcd-ca
package github.com/coreos/etcd-ca/third_party/code.google.com/p/go.crypto/ssh/terminal
imports github.com/coreos/etcd-ca/third_party/code.google.com/p/go.crypto/ssh/terminal
imports github.com/coreos/etcd-ca/third_party/code.google.com/p/go.crypto/ssh/terminal: cannot find package "github.com/coreos/etcd-ca/third_party/code.google.com/p/go.crypto/ssh/terminal" in any of:
/usr/local/Cellar/go/1.2/libexec/src/pkg/github.com/coreos/etcd-ca/third_party/code.google.com/p/go.crypto/ssh/terminal (from $GOROOT)
/Users/philips/coreos/etcd-go/src/github.com/coreos/etcd-ca/third_party/code.google.com/p/go.crypto/ssh/terminal (from $GOPATH)

Windows build: undefined terminal.ReadPassword

I'm not sure if the upstream package for ssh/terminal needs to be updated, I was able to replace the lines in question with bufio.NewReader(os.Stdin).ReadLine() and build ...

> CD ./github.com/coreos/etcd-ca
> SET GOPATH=\USERS\Me\
> go build -o "C:\Users\Me\bin\etcd-ca.exe"
# github.com/coreos/etcd-ca/cmd
\Users\Michael Ryan\src\github.com\coreos\etcd-ca\cmd\util.go:32: undefined: terminal.ReadPassword
\Users\Michael Ryan\src\github.com\coreos\etcd-ca\cmd\util.go:37: undefined: terminal.ReadPassword
\Users\Michael Ryan\src\github.com\coreos\etcd-ca\cmd\util.go:51: undefined: terminal.ReadPassword

add notes for installing curl from brew on OSX

Brew has an update to date version of curl that can be used with TLS 1.2

set DNSNames in SubjectAlternativeNames

It might make sense to just have a generic --san option to add more IPs / FQDNs to a CSR.

follow up #29

ecdsa

ECDSA support in a CA would be nice. :)

Missing dependency

I tried building etcd-ca with the latest golang Docker images and got the following error: gopath/src/github.com/coreos/etcd-ca/cmd/util.go:11:2: code in directory /go/etcd-ca/gopath/src/github.com/coreos/etcd-ca/Godeps/_workspace/src/golang.org/x/crypto/ssh/terminal expects import "golang.org/x/crypto/ssh/terminal"

Document Required Go Version

I'm using Ubuntu 12.04 on my laptop and building this kept failing because the Go version was go1

After I manually compiled the current Go version from googles mercurial repository it worked without problems.

I think it would make sense to document the minimum required go version to build this application as I spend a few hours figuring out what the problem is.

Specifying a blank password upon `new-cert` still encrypts the `.key` file

I'd expect a blank passphrase to not encrypt the .key file. Is that a bug or a feature ?

misleading output

Created ca/key
Created ca/crt

It actually created:

$ ls -l .etcd-ca/
total 24
-r--r--r--  1 polvi  staff  1866 Mar 22 10:50 ca.crt
-r--------  1 polvi  staff     1 Mar 22 10:50 ca.crt.info
-r--------  1 polvi  staff  3311 Mar 22 10:50 ca.priv.key

Document Certificate Requirements

I'm getting bad certificate errors when I try to enable peer SSL. Can you guys please document the certificate requirements for peer ssl?

Currently I have certs that have CN=10.10.10.1 I don't know if it's failing because the CN doesn't match the ETCD_NAME=test.example.com or if its because the X509v3 Extended Key Usage: TLS Web Server Authentication rather than TLS Web Server Authentication, TLS Web Client Authentication as created by etcd-ca.

Note: I'm not using etcd-ca to create the certs as I have existing CA creation scripts/tools.

accept hostname as validation in cert

Add more info to output of `chain`

It would be great if there was a header or title that told you what was being output of the chain command:

Outputting CA certificate body:
----BEGIN CERTIFICATE-----
MIIFNDCCAx6gAwIBAgIBATALBgkqhkiG9w0BAQUwLTEMMAoGA1UEBhMDVVNBMRAw
...

fails to be build because undefined: elliptic.P224

telmo@dcavm-ch2-052p ❯ git clone https://github.com/coreos/etcd-ca
Cloning into 'etcd-ca'...
remote: Reusing existing pack: 730, done.
remote: Total 730 (delta 0), reused 0 (delta 0)
Receiving objects: 100% (730/730), 1.01 MiB | 1.49 MiB/s, done.
Resolving deltas: 100% (151/151), done.
⋯᚜ ~ ᚛⋯
telmo@dcavm-ch2-052p ❯ cd etcd-ca/
/opt/home/rmoral00/etcd-ca
⋯᚜ ~/etcd-ca ᚛⋯ ⋯᚜ master  ᚛⋯
telmo@dcavm-ch2-052p ❯ ./build
Building etcd-ca
# github.com/coreos/etcd-ca/third_party/github.com/jstemmer/pkcs10
src/github.com/coreos/etcd-ca/third_party/github.com/jstemmer/pkcs10/pkcs10.go:172: undefined: elliptic.P224
src/github.com/coreos/etcd-ca/third_party/github.com/jstemmer/pkcs10/x509.go:184: undefined: elliptic.P224
src/github.com/coreos/etcd-ca/third_party/github.com/jstemmer/pkcs10/x509.go:197: undefined: elliptic.P224
⋯᚜ ~/etcd-ca ᚛⋯ ⋯᚜ master  ✭ ᚛⋯
telmo@dcavm-ch2-052p ❯

 rmoral00@dcavm-ch2-052p ❯ go version
go version go1.2 linux/amd64
⋯᚜ ~/etcd-ca ᚛⋯ ⋯᚜ master  ✭ ᚛⋯
 rmoral00@dcavm-ch2-052p ❯ lsb_release -a
LSB Version:    :core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch
Distributor ID: RedHatEnterpriseServer
Description:    Red Hat Enterprise Linux Server release 6.1 (Santiago)
Release:    6.1
Codename:   Santiago

Can't Sign Generated Cert Using etcd-ca

For some reason, etcd-ca can't stat the file it created.

Generate certs:

root@0947d9ea9a4d:/go/etcd-ca/bin# ./etcd-ca new-cert --organization "MyOrg" --country "US" --ip 10.0.0.10 server1.mydomain.com
Enter passphrase (empty for no passphrase): *******
Enter same passphrase again: *******
Created server1.mydomain.com/key
Created server1.mydomain.com/crt

Go ahead and sign the cert:

root@0947d9ea9a4d:/go/etcd-ca/bin# ./etcd-ca sign server1.mydomain.com
Get CA certificate error: stat /go/etcd-ca/bin/.etcd-ca/ca.crt: no such file or directory

root@0947d9ea9a4d:/go/etcd-ca/bin# pwd
/go/etcd-ca/bin

root@0947d9ea9a4d:/go/etcd-ca/bin# ls -al .etcd-ca/
total 24
drwxr-xr-x 2 root root 4096 Apr 13 15:44 .
drwxr-xr-x 3 root root 4096 Apr 13 15:30 ..
-r--r--r-- 1 root root 1708 Apr 13 15:44 server1.mydomain.com.host.csr
-r--r----- 1 root root 3311 Apr 13 15:44 server1.mydomain.com.host.key
root@0947d9ea9a4d:/go/etcd-ca/bin#

root@0947d9ea9a4d:/go/etcd-ca/bin# go version
go version go1.4.2 linux/amd64
root@0947d9ea9a4d:/go/etcd-ca/bin#