|
 |
7a8c6d |
From 199a97c11d4fc3a9e0f10e4eebf44f9f3841f8b1 Mon Sep 17 00:00:00 2001
|
|
|
7a8c6d |
From: Fraser Tweedale <ftweedal@redhat.com>
|
|
|
7a8c6d |
Date: Fri, 18 Aug 2017 13:03:05 +1000
|
|
|
7a8c6d |
Subject: [PATCH] MS cert template: add option to command line programs
|
|
|
7a8c6d |
|
|
|
7a8c6d |
Add the --ms-template-spec command line argument for specifying the
|
|
|
7a8c6d |
value of the V2 Certificate Template extension.
|
|
|
7a8c6d |
|
|
|
7a8c6d |
Part of: https://pagure.io/certmonger/issue/78
|
|
|
7a8c6d |
---
|
|
|
7a8c6d |
src/getcert-request.1.in | 6 ++++++
|
|
|
7a8c6d |
src/getcert-resubmit.1.in | 6 ++++++
|
|
|
7a8c6d |
src/getcert-start-tracking.1.in | 6 ++++++
|
|
|
7a8c6d |
src/getcert.c | 46 +++++++++++++++++++++++++++++++++++++++++
|
|
|
7a8c6d |
4 files changed, 64 insertions(+)
|
|
|
7a8c6d |
|
|
|
7a8c6d |
diff --git a/src/getcert-request.1.in b/src/getcert-request.1.in
|
|
|
7a8c6d |
index b6578dc..8269b78 100644
|
|
|
7a8c6d |
--- a/src/getcert-request.1.in
|
|
|
7a8c6d |
+++ b/src/getcert-request.1.in
|
|
|
7a8c6d |
@@ -88,6 +88,12 @@ the CA should correspond to one listed by \fIgetcert list-cas\fR.
|
|
|
7a8c6d |
Request a certificate using the named profile, template, or certtype,
|
|
|
7a8c6d |
from the specified CA.
|
|
|
7a8c6d |
.TP
|
|
|
7a8c6d |
+\fB\-\-ms-template-spec\fR SPEC
|
|
|
7a8c6d |
+Include a V2 Certificate Template extension in the signing request.
|
|
|
7a8c6d |
+This datum includes an Object Identifier, a major version number
|
|
|
7a8c6d |
+(positive integer) and an optional minor version number. The format
|
|
|
7a8c6d |
+is: \fB<oid>:<majorVersion>[:<minorVersion>]\fR.
|
|
|
7a8c6d |
+.TP
|
|
|
7a8c6d |
\fB\-X\fR NAME
|
|
|
7a8c6d |
Request a certificate using the named issuer from the specified CA.
|
|
|
7a8c6d |
|
|
|
7a8c6d |
diff --git a/src/getcert-resubmit.1.in b/src/getcert-resubmit.1.in
|
|
|
7a8c6d |
index 165940e..62d5f28 100644
|
|
|
7a8c6d |
--- a/src/getcert-resubmit.1.in
|
|
|
7a8c6d |
+++ b/src/getcert-resubmit.1.in
|
|
|
7a8c6d |
@@ -48,6 +48,12 @@ the CA should correspond to one listed by \fIgetcert list-cas\fR.
|
|
|
7a8c6d |
Request a certificate using the named profile, template, or certtype,
|
|
|
7a8c6d |
from the specified CA.
|
|
|
7a8c6d |
.TP
|
|
|
7a8c6d |
+\fB\-\-ms-template-spec\fR SPEC
|
|
|
7a8c6d |
+Include a V2 Certificate Template extension in the signing request.
|
|
|
7a8c6d |
+This datum includes an Object Identifier, a major version number
|
|
|
7a8c6d |
+(positive integer) and an optional minor version number. The format
|
|
|
7a8c6d |
+is: \fB<oid>:<majorVersion>[:<minorVersion>]\fR.
|
|
|
7a8c6d |
+.TP
|
|
|
7a8c6d |
\fB\-X\fR NAME
|
|
|
7a8c6d |
Request a certificate using the named issuer from the specified CA.
|
|
|
7a8c6d |
.TP
|
|
|
7a8c6d |
diff --git a/src/getcert-start-tracking.1.in b/src/getcert-start-tracking.1.in
|
|
|
7a8c6d |
index a46f535..9daeed3 100644
|
|
|
7a8c6d |
--- a/src/getcert-start-tracking.1.in
|
|
|
7a8c6d |
+++ b/src/getcert-start-tracking.1.in
|
|
|
7a8c6d |
@@ -86,6 +86,12 @@ useful in combination with \fB\-r\fR.
|
|
|
7a8c6d |
Request a certificate using the named profile, template, or certtype,
|
|
|
7a8c6d |
from the specified CA.
|
|
|
7a8c6d |
.TP
|
|
|
7a8c6d |
+\fB\-\-ms-template-spec\fR SPEC
|
|
|
7a8c6d |
+Include a V2 Certificate Template extension in the signing request.
|
|
|
7a8c6d |
+This datum includes an Object Identifier, a major version number
|
|
|
7a8c6d |
+(positive integer) and an optional minor version number. The format
|
|
|
7a8c6d |
+is: \fB<oid>:<majorVersion>[:<minorVersion>]\fR.
|
|
|
7a8c6d |
+.TP
|
|
|
7a8c6d |
\fB\-X\fR NAME
|
|
|
7a8c6d |
Request a certificate using the named issuer from the specified CA.
|
|
|
7a8c6d |
|
|
|
7a8c6d |
diff --git a/src/getcert.c b/src/getcert.c
|
|
|
7a8c6d |
index c84273a..5277a15 100644
|
|
|
7a8c6d |
--- a/src/getcert.c
|
|
|
7a8c6d |
+++ b/src/getcert.c
|
|
|
7a8c6d |
@@ -692,6 +692,7 @@ request(const char *argv0, int argc, const char **argv)
|
|
|
7a8c6d |
int keysize = 0, auto_renew = 1, verbose = 0, ku = 0, kubit, c, i, j;
|
|
|
7a8c6d |
char *ca = DEFAULT_CA, *subject = NULL, **eku = NULL, *oid, *id = NULL;
|
|
|
7a8c6d |
char *profile = NULL, *issuer = NULL, kustring[16];
|
|
|
7a8c6d |
+ char *ms_template_spec = NULL;
|
|
|
7a8c6d |
char **principal = NULL, **dns = NULL, **email = NULL, **ipaddr = NULL;
|
|
|
7a8c6d |
char *key_owner = NULL, *key_perms = NULL;
|
|
|
7a8c6d |
char *cert_owner = NULL, *cert_perms = NULL;
|
|
|
7a8c6d |
@@ -732,6 +733,7 @@ request(const char *argv0, int argc, const char **argv)
|
|
|
7a8c6d |
{"ca", 'c', POPT_ARG_STRING, &ca, 0, _("use the specified CA configuration rather than the default"), HELP_TYPE_NAME},
|
|
|
7a8c6d |
#endif
|
|
|
7a8c6d |
{"profile", 'T', POPT_ARG_STRING, NULL, 'T', _("ask the CA to process the request using the named profile or template"), HELP_TYPE_NAME},
|
|
|
7a8c6d |
+ {"ms-template-spec", 0, POPT_ARG_STRING, NULL, 'Y', _("include V2 template specifier in CSR (format: OID:MAJOR-VERSION[:MINOR-VERSION])"), HELP_TYPE_NAME},
|
|
|
7a8c6d |
{"issuer", 'X', POPT_ARG_STRING, NULL, 'X', _("ask the CA to process the request using the named issuer"), HELP_TYPE_NAME},
|
|
|
7a8c6d |
{"subject-name", 'N', POPT_ARG_STRING, NULL, 'N', _("set requested subject name (default: CN=<hostname>)"), HELP_TYPE_SUBJECT},
|
|
|
7a8c6d |
{"key-usage", 'u', POPT_ARG_STRING, NULL, 'u', _("set requested key usage value"), HELP_TYPE_KU},
|
|
|
7a8c6d |
@@ -859,6 +861,9 @@ request(const char *argv0, int argc, const char **argv)
|
|
|
7a8c6d |
case 'T':
|
|
|
7a8c6d |
profile = talloc_strdup(globals.tctx, poptarg);
|
|
|
7a8c6d |
break;
|
|
|
7a8c6d |
+ case 'Y':
|
|
|
7a8c6d |
+ ms_template_spec = talloc_strdup(globals.tctx, poptarg);
|
|
|
7a8c6d |
+ break;
|
|
|
7a8c6d |
case 'X':
|
|
|
7a8c6d |
issuer = talloc_strdup(globals.tctx, poptarg);
|
|
|
7a8c6d |
break;
|
|
|
7a8c6d |
@@ -1293,6 +1298,13 @@ request(const char *argv0, int argc, const char **argv)
|
|
|
7a8c6d |
params[i] = ¶m[i];
|
|
|
7a8c6d |
i++;
|
|
|
7a8c6d |
}
|
|
|
7a8c6d |
+ if (ms_template_spec != NULL) {
|
|
|
7a8c6d |
+ param[i].key = CM_DBUS_PROP_TEMPLATE_MS_CERTIFICATE_TEMPLATE;
|
|
|
7a8c6d |
+ param[i].value_type = cm_tdbusm_dict_s;
|
|
|
7a8c6d |
+ param[i].value.s = ms_template_spec;
|
|
|
7a8c6d |
+ params[i] = ¶m[i];
|
|
|
7a8c6d |
+ i++;
|
|
|
7a8c6d |
+ }
|
|
|
7a8c6d |
if (issuer != NULL) {
|
|
|
7a8c6d |
param[i].key = CM_DBUS_PROP_TEMPLATE_ISSUER;
|
|
|
7a8c6d |
param[i].value_type = cm_tdbusm_dict_s;
|
|
|
7a8c6d |
@@ -1492,6 +1504,7 @@ add_basic_request(enum cm_tdbus_type bus, char *id,
|
|
|
7a8c6d |
char *pin, char *pinfile,
|
|
|
7a8c6d |
char *cpass, char *cpassfile,
|
|
|
7a8c6d |
char *ca, char *profile, char *issuer,
|
|
|
7a8c6d |
+ char *ms_template_spec,
|
|
|
7a8c6d |
char *precommand, char *postcommand,
|
|
|
7a8c6d |
char **anchor_dbs, char **anchor_files,
|
|
|
7a8c6d |
dbus_bool_t auto_renew_stop, int waitreq,
|
|
|
7a8c6d |
@@ -1655,6 +1668,13 @@ add_basic_request(enum cm_tdbus_type bus, char *id,
|
|
|
7a8c6d |
params[i] = ¶m[i];
|
|
|
7a8c6d |
i++;
|
|
|
7a8c6d |
}
|
|
|
7a8c6d |
+ if (ms_template_spec != NULL) {
|
|
|
7a8c6d |
+ param[i].key = CM_DBUS_PROP_TEMPLATE_MS_CERTIFICATE_TEMPLATE;
|
|
|
7a8c6d |
+ param[i].value_type = cm_tdbusm_dict_s;
|
|
|
7a8c6d |
+ param[i].value.s = ms_template_spec;
|
|
|
7a8c6d |
+ params[i] = ¶m[i];
|
|
|
7a8c6d |
+ i++;
|
|
|
7a8c6d |
+ }
|
|
|
7a8c6d |
if (issuer != NULL) {
|
|
|
7a8c6d |
param[i].key = CM_DBUS_PROP_TEMPLATE_ISSUER;
|
|
|
7a8c6d |
param[i].value_type = cm_tdbusm_dict_s;
|
|
|
7a8c6d |
@@ -1745,6 +1765,7 @@ set_tracking(const char *argv0, const char *category,
|
|
|
7a8c6d |
char *id = NULL, *new_id = NULL, *new_request;
|
|
|
7a8c6d |
char *keyfile = NULL, *certfile = NULL, *ca = DEFAULT_CA;
|
|
|
7a8c6d |
char *profile = NULL, *issuer = NULL;
|
|
|
7a8c6d |
+ char *ms_template_spec = NULL;
|
|
|
7a8c6d |
char *pin = NULL, *pinfile = NULL, *cpass = NULL, *cpassfile = NULL;
|
|
|
7a8c6d |
char *key_owner = NULL, *key_perms = NULL;
|
|
|
7a8c6d |
char *cert_owner = NULL, *cert_perms = NULL;
|
|
|
7a8c6d |
@@ -1785,6 +1806,7 @@ set_tracking(const char *argv0, const char *category,
|
|
|
7a8c6d |
{"ca", 'c', POPT_ARG_STRING, &ca, 0, _("use the specified CA configuration rather than the default"), HELP_TYPE_NAME},
|
|
|
7a8c6d |
#endif
|
|
|
7a8c6d |
{"profile", 'T', POPT_ARG_STRING, NULL, 'T', _("ask the CA to process the request using the named profile or template"), HELP_TYPE_NAME},
|
|
|
7a8c6d |
+ {"ms-template-spec", 0, POPT_ARG_STRING, NULL, 'Y', _("include V2 template specifier in CSR (format: OID:MAJOR-VERSION[:MINOR-VERSION])"), HELP_TYPE_NAME},
|
|
|
7a8c6d |
{"issuer", 'X', POPT_ARG_STRING, NULL, 'X', _("ask the CA to process the request using the named issuer"), HELP_TYPE_NAME},
|
|
|
7a8c6d |
{"key-usage", 'u', POPT_ARG_STRING, NULL, 'u', _("override requested key usage value"), HELP_TYPE_KU},
|
|
|
7a8c6d |
{"extended-key-usage", 'U', POPT_ARG_STRING, NULL, 'U', _("override requested extended key usage OID"), HELP_TYPE_EKU},
|
|
|
7a8c6d |
@@ -1887,6 +1909,9 @@ set_tracking(const char *argv0, const char *category,
|
|
|
7a8c6d |
case 'T':
|
|
|
7a8c6d |
profile = talloc_strdup(globals.tctx, poptarg);
|
|
|
7a8c6d |
break;
|
|
|
7a8c6d |
+ case 'Y':
|
|
|
7a8c6d |
+ ms_template_spec = talloc_strdup(globals.tctx, poptarg);
|
|
|
7a8c6d |
+ break;
|
|
|
7a8c6d |
case 'i':
|
|
|
7a8c6d |
id = talloc_strdup(globals.tctx, poptarg);
|
|
|
7a8c6d |
break;
|
|
|
7a8c6d |
@@ -2311,6 +2336,7 @@ set_tracking(const char *argv0, const char *category,
|
|
|
7a8c6d |
pin, pinfile,
|
|
|
7a8c6d |
cpass, cpassfile,
|
|
|
7a8c6d |
ca, profile, issuer,
|
|
|
7a8c6d |
+ ms_template_spec,
|
|
|
7a8c6d |
precommand, postcommand,
|
|
|
7a8c6d |
anchor_dbs, anchor_files,
|
|
|
7a8c6d |
(auto_renew_stop > 0),
|
|
|
7a8c6d |
@@ -2386,6 +2412,7 @@ rekey_or_resubmit(const char *argv0, const char *category, int argc,
|
|
|
7a8c6d |
char *subject = NULL, **eku = NULL, *oid = NULL;
|
|
|
7a8c6d |
char **principal = NULL, **dns = NULL, **email = NULL, **ipaddr = NULL;
|
|
|
7a8c6d |
char *profile = NULL, *issuer = NULL, kustring[16];
|
|
|
7a8c6d |
+ char *ms_template_spec = NULL;
|
|
|
7a8c6d |
char *key_owner = NULL, *key_perms = NULL;
|
|
|
7a8c6d |
char *cert_owner = NULL, *cert_perms = NULL;
|
|
|
7a8c6d |
char *keytype = NULL;
|
|
|
7a8c6d |
@@ -2422,6 +2449,7 @@ rekey_or_resubmit(const char *argv0, const char *category, int argc,
|
|
|
7a8c6d |
{"ca", 'c', POPT_ARG_STRING, &ca, 0, _("use the specified CA configuration rather than the current one"), HELP_TYPE_NAME},
|
|
|
7a8c6d |
#endif
|
|
|
7a8c6d |
{"profile", 'T', POPT_ARG_STRING, NULL, 'T', _("ask the CA to process the request using the named profile or template"), HELP_TYPE_NAME},
|
|
|
7a8c6d |
+ {"ms-template-spec", 0, POPT_ARG_STRING, NULL, 'Y', _("include V2 template specifier in CSR (format: OID:MAJOR-VERSION[:MINOR-VERSION])"), HELP_TYPE_NAME},
|
|
|
7a8c6d |
{"issuer", 'X', POPT_ARG_STRING, NULL, 'X', _("ask the CA to process the request using the named issuer"), HELP_TYPE_NAME},
|
|
|
7a8c6d |
{"subject-name", 'N', POPT_ARG_STRING, NULL, 'N', _("set requested subject name (default: CN=<hostname>)"), HELP_TYPE_SUBJECT},
|
|
|
7a8c6d |
{"key-usage", 'u', POPT_ARG_STRING, NULL, 'u', _("set requested key usage value"), HELP_TYPE_KU},
|
|
|
7a8c6d |
@@ -2497,6 +2525,9 @@ rekey_or_resubmit(const char *argv0, const char *category, int argc,
|
|
|
7a8c6d |
case 'T':
|
|
|
7a8c6d |
profile = talloc_strdup(globals.tctx, poptarg);
|
|
|
7a8c6d |
break;
|
|
|
7a8c6d |
+ case 'Y':
|
|
|
7a8c6d |
+ ms_template_spec = talloc_strdup(globals.tctx, poptarg);
|
|
|
7a8c6d |
+ break;
|
|
|
7a8c6d |
case 'X':
|
|
|
7a8c6d |
issuer = talloc_strdup(globals.tctx, poptarg);
|
|
|
7a8c6d |
break;
|
|
|
7a8c6d |
@@ -2861,6 +2892,13 @@ rekey_or_resubmit(const char *argv0, const char *category, int argc,
|
|
|
7a8c6d |
params[i] = ¶m[i];
|
|
|
7a8c6d |
i++;
|
|
|
7a8c6d |
}
|
|
|
7a8c6d |
+ if (ms_template_spec != NULL) {
|
|
|
7a8c6d |
+ param[i].key = CM_DBUS_PROP_TEMPLATE_MS_CERTIFICATE_TEMPLATE;
|
|
|
7a8c6d |
+ param[i].value_type = cm_tdbusm_dict_s;
|
|
|
7a8c6d |
+ param[i].value.s = ms_template_spec;
|
|
|
7a8c6d |
+ params[i] = ¶m[i];
|
|
|
7a8c6d |
+ i++;
|
|
|
7a8c6d |
+ }
|
|
|
7a8c6d |
if (issuer != NULL) {
|
|
|
7a8c6d |
param[i].key = CM_DBUS_PROP_TEMPLATE_ISSUER;
|
|
|
7a8c6d |
param[i].value_type = cm_tdbusm_dict_s;
|
|
|
7a8c6d |
@@ -4677,6 +4715,8 @@ help(const char *twopartcmd, const char *category)
|
|
|
7a8c6d |
N_(" -c CA use the specified CA rather than the default\n"),
|
|
|
7a8c6d |
#endif
|
|
|
7a8c6d |
N_(" -T PROFILE ask the CA to process the request using the named profile or template\n"),
|
|
|
7a8c6d |
+ N_(" --ms-template-spec SPEC\n"),
|
|
|
7a8c6d |
+ N_(" include V2 template specifier in CSR (format: OID:MAJOR-VERSION[:MINOR-VERSION])\n"),
|
|
|
7a8c6d |
N_(" -X ISSUER ask the CA to process the request using the named issuer\n"),
|
|
|
7a8c6d |
N_("* Parameters for the signing request:\n"),
|
|
|
7a8c6d |
N_(" -N NAME set requested subject name (default: CN=<hostname>)\n"),
|
|
|
7a8c6d |
@@ -4726,6 +4766,8 @@ help(const char *twopartcmd, const char *category)
|
|
|
7a8c6d |
N_(" -c CA use the specified CA rather than the default\n"),
|
|
|
7a8c6d |
#endif
|
|
|
7a8c6d |
N_(" -T PROFILE ask the CA to process the request using the named profile or template\n"),
|
|
|
7a8c6d |
+ N_(" --ms-template-spec SPEC\n"),
|
|
|
7a8c6d |
+ N_(" include V2 template specifier in CSR (format: OID:MAJOR-VERSION[:MINOR-VERSION])\n"),
|
|
|
7a8c6d |
N_(" -X ISSUER ask the CA to process the request using the named issuer\n"),
|
|
|
7a8c6d |
N_("* Parameters for the signing request at renewal time:\n"),
|
|
|
7a8c6d |
N_(" -U EXTUSAGE override requested extended key usage OID\n"),
|
|
|
7a8c6d |
@@ -4805,6 +4847,8 @@ help(const char *twopartcmd, const char *category)
|
|
|
7a8c6d |
N_(" -c CA use the specified CA rather than the current one\n"),
|
|
|
7a8c6d |
#endif
|
|
|
7a8c6d |
N_(" -T PROFILE ask the CA to process the request using the named profile or template\n"),
|
|
|
7a8c6d |
+ N_(" --ms-template-spec SPEC\n"),
|
|
|
7a8c6d |
+ N_(" include V2 template specifier in CSR (format: OID:MAJOR-VERSION[:MINOR-VERSION])\n"),
|
|
|
7a8c6d |
N_(" -X ISSUER ask the CA to process the request using the named issuer\n"),
|
|
|
7a8c6d |
N_("* Bus options:\n"),
|
|
|
7a8c6d |
N_(" -S connect to the certmonger service on the system bus\n"),
|
|
|
7a8c6d |
@@ -4853,6 +4897,8 @@ help(const char *twopartcmd, const char *category)
|
|
|
7a8c6d |
N_(" -c CA use the specified CA rather than the current one\n"),
|
|
|
7a8c6d |
#endif
|
|
|
7a8c6d |
N_(" -T PROFILE ask the CA to process the request using the named profile or template\n"),
|
|
|
7a8c6d |
+ N_(" --ms-template-spec SPEC\n"),
|
|
|
7a8c6d |
+ N_(" include V2 template specifier in CSR (format: OID:MAJOR-VERSION[:MINOR-VERSION])\n"),
|
|
|
7a8c6d |
N_(" -X ISSUER ask the CA to process the request using the named issuer\n"),
|
|
|
7a8c6d |
N_(" -G TYPE type of new key to be generated\n"),
|
|
|
7a8c6d |
N_(" -g SIZE size of new key to be generated\n"),
|
|
|
7a8c6d |
--
|
|
|
7a8c6d |
1.8.3.1
|
|
|
7a8c6d |
|