From 34b55f4fecb1ae8bbe860f930056ffc8c030cada Mon Sep 17 00:00:00 2001 From: Alex Bramley Date: Sat, 13 Mar 2010 14:47:57 +0000 Subject: [PATCH] Make -t optional and configurable from config file (1/2). --- bin/ca-create-cert | 6 ++---- bin/ca-renew-cert | 4 ++-- bin/ca-revoke-cert | 4 ++-- ca-scripts.conf | 4 ++-- doc/ca-create-cert.pod | 19 ++++++++++--------- doc/ca-renew-cert.pod | 9 +++++---- doc/ca-revoke-cert.pod | 9 +++++---- lib/ca-functions | 30 ++++++++++++++++++++++-------- 8 files changed, 50 insertions(+), 35 deletions(-) diff --git a/bin/ca-create-cert b/bin/ca-create-cert index dc45c99..067bfae 100755 --- a/bin/ca-create-cert +++ b/bin/ca-create-cert @@ -15,15 +15,13 @@ MAKE_P12=0 usage() { cat <<__EOT__ Usage: - $PROGNAME -t server [options] - $PROGNAME -t client [options] - $PROGNAME -t user [options] + $PROGNAME [options] Options: -h, --help Print this helpful message! -c, --encrypt Encrypt certificate private key with Triple-DES -f, --config FILE Use config file instead of $CONFFILE - -t, --type TYPE Certificate type: "server", "client" or "user" + -t, --type TYPE Certificate type: "server" (default), "client" or "user" -d, --days DAYS Certificate valid for DAYS days instead of CA_CRT_DAYS -b, --bits BITS Generate a BITS bit certificate instead of CA_CRT_BITS -n, --alt-name NAME Alternative host name (can be provided multiple times) diff --git a/bin/ca-renew-cert b/bin/ca-renew-cert index 922f678..caf4e3a 100755 --- a/bin/ca-renew-cert +++ b/bin/ca-renew-cert @@ -4,12 +4,12 @@ usage() { cat <<__EOT__ -Usage: $PROGNAME -t [options] +Usage: $PROGNAME [options] | Options: -h, --help Print this helpful message! -f, --config FILE Use config file instead of $CONFFILE - -t, --type Certificate type: "server", "client" or "user" + -t, --type TYPE Certificate type: "server" (default), "client" or "user" -d, --days DAYS Renew certificate for DAYS days instead of CA_CRT_DAYS __EOT__ diff --git a/bin/ca-revoke-cert b/bin/ca-revoke-cert index 92b29ad..fa74a16 100755 --- a/bin/ca-revoke-cert +++ b/bin/ca-revoke-cert @@ -4,12 +4,12 @@ usage() { cat <<__EOT__ -Usage: $PROGNAME -t [options] +Usage: $PROGNAME [options] | Options: -h, --help Print this helpful message! -f, --config FILE Use config file instead of $CONFFILE - -t, --type Certificate type: "server", "client" or "user" + -t, --type TYPE Certificate type: "server" (default), "client" or "user" -i, --template FILE Use alternative index.html template -o, --output FILE Generate CA index.html in FILE diff --git a/ca-scripts.conf b/ca-scripts.conf index 445e0bc..38e9fe2 100644 --- a/ca-scripts.conf +++ b/ca-scripts.conf @@ -42,9 +42,9 @@ CA_DN_CN="Example Security Services Root Certificate Authority" # Default value: # CA_CRT_BITS=2048 -# OPTIONAL: CA_CRT_DAYS sets the default validity period for certificates. +# OPTIONAL: CA_CRT_TYPE sets the default type of generated certificate. # Default value: -# CA_CRT_DAYS=365 +# CA_CRT_TYPE="server" # OPTIONAL: CA_PATHLEN sets the maximum number of intermediate CA certificates # that can be in the chain of authority between the root CA and the diff --git a/doc/ca-create-cert.pod b/doc/ca-create-cert.pod index e6e2781..50efaf5 100755 --- a/doc/ca-create-cert.pod +++ b/doc/ca-create-cert.pod @@ -19,8 +19,8 @@ ca-create-cert - generate a signed X.509 SSL certificate =head1 SYNOPSIS -B -t I [B<-cprsx>] [B<-f> I] [B<-d> I] -[B<-n> I] [I] +B [B<-cpqrsx>] [B<-f> I] [B<-t> I] [B<-d> I] +[B<-b> I] [B<-n> I] [I] B [B<-h>] | [B<--help>] @@ -56,13 +56,14 @@ Prints out a short synopsis of the options to B. =item B<-t> I, B<--type> I -This argument is mandatory. B can create three types of -X.509 certificate: I, I, and I. These differ -in the X.509v3 extensions present in the signed certificate, and in the uses -the certificate is trusted for. See x509(1ssl) and x509v3_config(5ssl) -for more details about X.509 extensions, and the B -section of this manual for more details on the exact differences between the -certificate types. +B can create three types of X.509 certificate: I, +I, and I. The type can also be set using the config variable +B; it defaults to I in the absence of either the command +line or config variable being present. Certificate types differ in the X.509v3 +extensions present in the signed certificate, and in the uses the certificate +is trusted for. See x509(1ssl) and x509v3_config(5ssl) for more details about +X.509 extensions, and the B section of this manual for more +details on the exact differences between the certificate types. =item B<-c>, B<--encrypt> diff --git a/doc/ca-renew-cert.pod b/doc/ca-renew-cert.pod index fb8947a..6e659a8 100755 --- a/doc/ca-renew-cert.pod +++ b/doc/ca-renew-cert.pod @@ -19,8 +19,8 @@ ca-renew-cert - renew a previously generated X.509 certificate =head1 SYNOPSIS -B -t I [B<-f> I] [B<-d> I] -I +B [B<-f> I] [B<-t> I] [B<-d> I] +I| B [B<-h>] | [B<--help>] @@ -41,8 +41,9 @@ type. =item B<-t> I, B<--type> I -This argument is mandatory and tells B what type of certificate -it is renewing, either I, I, or I. +This argument overrides the type detection if multiple certificate types share +the same common name, telling B what type of certificate it is +renewing, either I, I, or I. =item B<-f> I, B<--config> I diff --git a/doc/ca-revoke-cert.pod b/doc/ca-revoke-cert.pod index d1c9d96..7cd0574 100755 --- a/doc/ca-revoke-cert.pod +++ b/doc/ca-revoke-cert.pod @@ -19,8 +19,8 @@ ca-revoke-cert - revoke a certificate and re-generate CRL =head1 SYNOPSIS -B -t I [B<-f> I] [B<-i> I