puppetserver-ca 0.4.2 → 0.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 675bbbde6ef2920bff8139cd7cbed1da317a26e4
-  data.tar.gz: 59856cf44f1a0f8629faadb2b69a4a9a66722225
+  metadata.gz: 9c19462a3167093517421b973f330b005a6776b4
+  data.tar.gz: 5c4dc2716c5063512594005c625ad391ca6ec3f0
 SHA512:
-  metadata.gz: a4ffd3cbedefabf0ae8c5e33eb173addfea289fd984e9252ecc971d6eea1775a5d8bcfdf6446b1d1aaa1d8d69bb0d6c802afb1e797e50f7ace7304c26794f48f
-  data.tar.gz: 02ae98ec500429f7c4d589c5a2e0d975cb06bce415c09f27caf4f24d0b9cab707bc1bc40bca9ed33596229ea75fc0749252e77bc33e683e3054e32d1b30a28bb
+  metadata.gz: cac3a5c1d00ddb4e4fc9948fc09c91bc6436e8c245cd17610b971e7dbc74c033ba41c7602d12fdbe11808eb51a0612c5fee71353af4b9956b4ac449fb889ec84
+  data.tar.gz: 8e8ac33850a91d128282572c0ef2f4dd421dd447911e09cc6aa561eae1f6b381c3b06f0e9661581616c2c516da92490ad59d180744737bf6873c049a9d9d673f

data/lib/puppetserver/ca/action/create.rb

@@ -21,6 +21,7 @@ module Puppetserver
 Usage:
   puppetserver ca create [--help]
   puppetserver ca create [--config PATH] [--certname CERTNAME[,ADDLCERTNAME]]
+                         [--subject-alt-names ALTNAME1[,ALTNAME2...]]
 
 Description:
 Creates a new certificate signed by the intermediate CA
@@ -38,6 +39,7 @@ BANNER
 
         def self.parser(parsed = {})
           parsed['certnames'] = []
+          parsed['subject-alt-names'] = ''
           OptionParser.new do |opts|
             opts.banner = BANNER
             opts.on('--certname FOO,BAR', Array,
@@ -50,6 +52,10 @@ BANNER
             opts.on('--config CONF', 'Path to puppet.conf') do |conf|
               parsed['config'] = conf
             end
+            opts.on('--subject-alt-names NAME1[,NAME2]',
+                    'Subject alternative names for the generated cert') do |sans|
+              parsed['subject-alt-names'] = sans
+            end
           end
         end
 
@@ -96,7 +102,12 @@ BANNER
           end
 
           # Load, resolve, and validate puppet config settings
-          puppet = Config::Puppet.parse(config_path)
+          settings_overrides = {}
+          # Since puppet expects the key to be called 'dns_alt_names', we need to use that here
+          # to ensure that the overriding works correctly.
+          settings_overrides[:dns_alt_names] = input['subject-alt-names'] unless input['subject-alt-names'].empty?
+          puppet = Config::Puppet.new(config_path)
+          puppet.load(settings_overrides)
           return 1 if CliParsing.handle_errors(@logger, puppet.errors)
 
           # Load most secure signing digest we can for csr signing.
@@ -139,7 +150,11 @@ BANNER
         def generate_key_csr(certname, settings, digest)
           host = Puppetserver::Ca::Host.new(digest)
           private_key = host.create_private_key(settings[:keylength])
-          csr = host.create_csr(certname, private_key)
+          extensions = []
+          if !settings[:subject_alt_names].empty?
+            extensions << host.create_extension("subjectAltName", settings[:subject_alt_names])
+          end
+          csr = host.create_csr(certname, private_key, extensions)
 
           return private_key, csr
         end

data/lib/puppetserver/ca/action/import.rb

@@ -90,7 +90,7 @@ BANNER
             [settings[:hostpubkey], master_key.public_key],
             [settings[:hostcert], master_cert],
             [settings[:cert_inventory], ca.inventory_entry(master_cert)],
-            [settings[:serial], "0x0002"],
+            [settings[:serial], "002"],
             [File.join(settings[:signeddir], "#{settings[:certname]}.pem"), master_cert]
           ]
 

data/lib/puppetserver/ca/config/puppet.rb

@@ -152,8 +152,11 @@ module Puppetserver
             settings[setting_name] = setting_value
           end
 
+          # If subject-alt-names are provided, we need to add the certname in addition
+          overrides[:dns_alt_names] << ',$certname' if overrides[:dns_alt_names]
+
           # rename dns_alt_names to subject_alt_names now that we support IP alt names
-          settings[:subject_alt_names] = overrides.fetch(:dns_alt_names, "puppet,$certname")
+          settings[:subject_alt_names] = overrides.fetch(:dns_alt_names, "")
 
           # Some special cases where we need to manipulate config settings:
           settings[:ca_ttl] = munge_ttl_setting(settings[:ca_ttl])

data/lib/puppetserver/ca/host.rb

@@ -12,15 +12,26 @@ module Puppetserver
         OpenSSL::PKey::RSA.new(keylength)
       end
 
-      def create_csr(name, key)
+      def create_csr(name, key, extensions = [])
         csr = OpenSSL::X509::Request.new
         csr.public_key = key.public_key
         csr.subject = OpenSSL::X509::Name.new([["CN", name]])
         csr.version = 2
+        add_csr_extension(csr, extensions) unless extensions.empty?
         csr.sign(key, @digest)
 
         csr
       end
+
+      def create_extension(extension_name, extension_value, critical = false)
+        OpenSSL::X509::ExtensionFactory.new.create_extension(extension_name, extension_value, critical)
+      end
+
+      def add_csr_extension(csr, extensions)
+        attribute_values = OpenSSL::ASN1::Set [OpenSSL::ASN1::Sequence(extensions)]
+        att = OpenSSL::X509::Attribute.new('extReq', attribute_values)
+        csr.add_attribute(att)
+      end
     end
   end
 end

data/lib/puppetserver/ca/local_certificate_authority.rb

@@ -82,11 +82,14 @@ module Puppetserver
           extension = ef.create_extension(*ext)
           cert.add_extension(extension)
         end
-
-        if !@settings[:subject_alt_names].empty?
-          alt_names_ext = ef.create_extension("subjectAltName", @settings[:subject_alt_names], false)
-          cert.add_extension(alt_names_ext)
-        end
+        sans =
+          if @settings[:subject_alt_names].empty?
+            "DNS:puppet, DNS:#{@settings[:certname]}"
+          else
+            @settings[:subject_alt_names]
+          end
+        alt_names_ext = ef.create_extension("subjectAltName", sans, false)
+        cert.add_extension(alt_names_ext)
 
         cert.sign(int_key, @digest)
         cert

data/lib/puppetserver/ca/version.rb

@@ -1,5 +1,5 @@
 module Puppetserver
   module Ca
-    VERSION = "0.4.2"
+    VERSION = "0.4.3"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppetserver-ca
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.4.3
 platform: ruby
 authors:
 - Puppet, Inc.
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-08-28 00:00:00.000000000 Z
+date: 2018-08-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: facter