Skip to content

fix: add x509v3 extensions for CA and node certificates in configuration #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

fix: add x509v3 extensions for CA and node certificates in configuration #19

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions config/cert/ca.cnf.mustache
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,17 @@ commonName = supplied
[req]
prompt = no
distinguished_name = dn
x509_extensions = x509_v3_ca

[dn]
CN = {{{name}}}-account

[x509_v3_ca]
basicConstraints = critical,CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer

[x509_v3_node]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
4 changes: 2 additions & 2 deletions src/service/CertificateService.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,7 +230,7 @@ export class CertificateService {
const createCaCertificate = renew
? `openssl x509 -in ${CertificateService.CA_CERTIFICATE_FILE_NAME} -text -noout`
: `# create CA cert and self-sign it
openssl req -config ca.cnf -keyform PEM -key ca.key.pem -new -x509 -days ${caCertificateExpirationInDays} -out ${CertificateService.CA_CERTIFICATE_FILE_NAME}
openssl req -config ca.cnf -keyform PEM -key ca.key.pem -new -x509 -days ${caCertificateExpirationInDays} -out ${CertificateService.CA_CERTIFICATE_FILE_NAME} -extensions x509_v3_ca
openssl x509 -in ${CertificateService.CA_CERTIFICATE_FILE_NAME} -text -noout
`;
return `set -e
Expand Down Expand Up @@ -263,7 +263,7 @@ openssl req -text -noout -verify -in node.csr.pem
# CA side

# sign cert for 375 days
openssl ca -batch -config ca.cnf -days ${nodeCertificateExpirationInDays} -notext -in node.csr.pem -out ${CertificateService.NODE_CERTIFICATE_FILE_NAME}
openssl ca -batch -config ca.cnf -days ${nodeCertificateExpirationInDays} -notext -in node.csr.pem -out ${CertificateService.NODE_CERTIFICATE_FILE_NAME} -extensions x509_v3_node
openssl verify -CAfile ${CertificateService.CA_CERTIFICATE_FILE_NAME} ${CertificateService.NODE_CERTIFICATE_FILE_NAME}

# finally create full crt
Expand Down
8 changes: 8 additions & 0 deletions test/service/CertificateService.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@

import { expect } from '@oclif/test';
import { deepStrictEqual } from 'assert';
import { execSync } from 'child_process';
import { promises as fsPromises, readFileSync } from 'fs';
import 'mocha';
import { join } from 'path';
Expand Down Expand Up @@ -89,6 +90,11 @@ describe('CertificateService', () => {
});
}

async function verifyCertX509v3Extensions(certFileName: string) {
const opensslOut = execSync(`openssl x509 -in ${join(target, certFileName)} -text -noout`).toString();
expect(opensslOut.includes('X509v3 extensions')).eq(true);
}

it('createCertificates', async () => {
fileSystemService.deleteFolder(target);

Expand All @@ -105,6 +111,8 @@ describe('CertificateService', () => {
};
expect(expectedMetadata).deep.eq(YamlUtils.loadYaml(join(target, 'metadata.yml'), false));
await verifyCertFolder();
await verifyCertX509v3Extensions('ca.cert.pem');
await verifyCertX509v3Extensions('node.crt.pem');
});

it('createCertificates expiration warnings', async () => {
Expand Down