rcrowley/certified

Generate and manage an internal CA for your company

rcrowley's home

This repository is meant to be my home directory, which, if you're not provisioning systems with Puppet code that does this for you, is a slightly awkward thing to accomplish. I do roughly the following with new boxen:

cd
git init
git remote add "origin" "git://github.com/rcrowley/home.git"
git remote update "origin"
git pull "origin" "master"

certified's Issues

Support for generating client/server specific certs

OpenVPN wants to verify certificates in specific roles as client -> server. It would be helpful to have support for generating certificates with the extensions for that (like extendedKeyUsage=client).

See: https://github.com/OpenVPN/easy-rsa/tree/master/easyrsa3/x509-types

sha1 default probably not ideal

Sha1 as the default is probably not ideal, and there doesn't seem to be a straightforward way to use a different signature algorithm.

allow generating encrypted keys

Hello!

I've been playing with certified and it looks pretty cool so far. One thing that would be nice to have is an option to generate encrypted keys for more than just the root CA; for now, I've been piping the generated keys through openssl rsa -des3 -in blah -out blah to encrypt them, but I'd be more comfortable if they were never on disk in plaintext in the first place.

certified always cats `ca.crt` even when you select an alternate issuer

I'm trying to do a multi-intermediate certified hierarchy roughly like the following:

root-ca
 - ca-for-product-a
 - ca-for-product-b

I can generate the intermediates with certified --ca --issuer="root-ca" and then use them with certified --issuer="ca-for-product-a" and everything mostly works; however, when certified prints the certificate chain, it always cats certs/ca.crt instead of the actual intermediate certificate.

Add a "--no-git" mode

Hi,

We already have a git repository of certificates, and it would be ideal for us if this did not also try to make one. We'd rather have this be a subdirectory (not a submodule) within that repo.

Thanks!

crl dp url's not being properly added to root and intermedia ca certs

When creating a new root and intermediate CA with the --root-crl-url and --crl-url params, I expected the root-ca.crt would contain a CRL DP matching the root-crl-url and the intermediat ca.crt would contain the crl-url, but I only see the root-crl-url in the intermediate ca.crt and no crl dp in the root-ca.crt. My expectation was that the root-ca.crt would contain the --root-crl-url and the intermediate ca.crt would contain the --crl-url. Is this a bug?

certified-ca --db=test --root-password='test' \
   --root-crl-url=https://example.tld/rootca.crl  \
   --crl-url=https://example.tld/ca.crl \
   --ocsp-url=https://ocsp.example.tld \
   C="US" ST="CA" L="San Francisco" O="joe" CN=testCA

openssl x509 -text -noout -in test/certs/root-ca.crt | grep -i crl
                Non Repudiation, Certificate Sign, CRL Sign

openssl x509 -text -noout -in test/certs/ca.crt | grep -i crl
            X509v3 CRL Distribution Points:
                  URI:https://home.joeym.net/rootca.crl
                Non Repudiation, Certificate Sign, CRL Sign

sed commands fail on OS X

There is 1 sed command in the scripts (bin/certified-crt:53) that fails on OS X.
OS X sed (BSD) handles the -i option differently than the GNU/Linux one.
On OS X you have to specify a backup extension (which can be empty).

A syntax which seems to work for both BSD and GNU sed versions is

sed -i.bak 's/foo/bar/' file

This leaves you with a backup file though.

Updated: only 1 sed command fails, not all 3

Weird string_mask behaviour on Mac OS X 10.9.5

My co-worker generated a CA and some certificates using the openssl version that comes bundled with Mac OS X 10.9.4, and everything worked fine. Me on the other hand, running Mac OS X 10.9.5, am unable to generate any certificates (using the same CA files and whatnot), and the failure message I receive is:

The localityName field needed to be the same in the
CA certificate (Göteborg) and the request (Göteborg).

After scavenging through some websites and man pages I found the option string_mask and tried to explicitly set the option in the configuration that's generated here to default, and after that it works fine (and the city name is displayed correctly).

Unfortunately I don't know what version of openssl that's used on Mac OS X 10.9.4, but on 10.9.5 it's OpenSSL 0.9.8za, though I believe Apple has rolled their own version of openssl.

Bottom line is whether it's possible to support different string_mask configuration values in certified in some non-invasive way? Or is there some other way we can work around this? (Besides forking the project and simply adding the configuration option...).

repo does not have a Release file

When trying to use the packages.rcrowley.org repo I am told:

The repository 'http://packages.rcrowley.org main Release' does not have a Release file.

I am running Debian testing, and would prefer to install certified as a package over a git repo for ease of keeping it up-to-date.

Integrate ssss for root-ca.key sharing

Sam pointed out that by integrating http://point-at-infinity.org/ssss/, Certified could almost prevent anyone ever knowing the root CA's private key.