Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

gvm-manage-certs: Added SAN parsing #1246

Merged
merged 4 commits into from
Aug 17, 2020
Merged

gvm-manage-certs: Added SAN parsing #1246

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
82e6e9c
gvm-manage-certs: Added SAN parsing
Aug 11, 2020
a9ee89e
Default value is empty to avoid unexpected
Aug 11, 2020
eb52ad8
Added changelog entry.
Aug 12, 2020
4dbfb24
Created dedicated function for modularity
Aug 17, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
## [20.8.1] (unreleased)

### Added
- Added ability to enter Subject Alternative Names (SAN) when generating a CSR [#1246](https://github.com/greenbone/gvmd/pull/1246)

### Changed
- Extended the output of invalid / missing --feed parameter given to greenbone-feed-sync [#1255](https://github.com/greenbone/gvmd/pull/1255)
Expand Down
38 changes: 37 additions & 1 deletion tools/gvm-manage-certs.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,8 @@ set_defaults () {
GVM_CERTIFICATE_ORG=${GVM_CERTIFICATE_ORG:-"GVM Users"}
# (Organization unit)
GVM_CERTIFICATE_ORG_UNIT=${GVM_CERTIFICATE_ORG_UNIT:-""}
# Subject Alternative Name(s)
GVM_CERTIFICATE_SAN=${GVM_CERTIFICATE_SAN:-""}

# Hostname
if [ -z "$GVM_CERTIFICATE_HOSTNAME" ]
Expand All @@ -102,7 +104,8 @@ set_defaults () {
GVM_CA_CERTIFICATE_ORG=${GVM_CA_CERTIFICATE_ORG:-"$GVM_CERTIFICATE_ORG"}
# (Organization unit)
GVM_CA_CERTIFICATE_ORG_UNIT=${GVM_CA_CERTIFICATE_ORG_UNIT:-"Certificate Authority for $GVM_CERTIFICATE_HOSTNAME"}

# The array with all the SANs
GVM_CA_CERTIFICATE_SAN=${GVM_CA_CERTIFICATE_SAN:-"$GVM_CERTIFICATE_SAN"}
# Key size
if [ -z "$GVM_CERTIFICATE_KEYSIZE" ]
then
Expand Down Expand Up @@ -290,6 +293,31 @@ create_private_key ()
log_write "Generated private key in $1."
}

# Add SAN settings
add_san_settings ()
{
for i in $1
do
case "$i" in
*.*.*.*)
echo "ip_address = \"$i\"" >> $GVM_CERT_TEMPLATE_FILENAME
;;
http*)
echo "uri = \"$i\"" >> $GVM_CERT_TEMPLATE_FILENAME
;;
*.*)
echo "dns_name = \"$i\"" >> $GVM_CERT_TEMPLATE_FILENAME
;;
localhost )
echo "dns_name = \"localhost\"" >> $GVM_CERT_TEMPLATE_FILENAME
;;
*)
log_verbose "Invalid formatting for SAN: $i"
;;
esac
done
}

# Create a certificate
create_certificate ()
{
Expand Down Expand Up @@ -330,6 +358,10 @@ create_certificate ()
then
echo "cn = \"$GVM_CA_CERTIFICATE_HOSTNAME\"" >> $GVM_CERT_TEMPLATE_FILENAME
fi
if [ -n "$GVM_CA_CERTIFICATE_SAN" ]
then
add_san_settings GVM_CA_CERTIFICATE_SAN
fi
else
if [ -n "$GVM_CERTIFICATE_LIFETIME" ]
then
Expand Down Expand Up @@ -359,6 +391,10 @@ create_certificate ()
then
echo "cn = \"$GVM_CERTIFICATE_HOSTNAME\"" >> $GVM_CERT_TEMPLATE_FILENAME
fi
if [ -n "$GVM_CERTIFICATE_SAN" ]
then
add_san_settings GVM_CERTIFICATE_SAN
fi
fi

# Add key usage constraints if the certificate type is known
Expand Down