Revision 27127b4a
Added by Jim Pingle almost 8 years ago
| src/etc/inc/certs.inc | ||
|---|---|---|
| 435 | 435 |
return true; |
| 436 | 436 |
} |
| 437 | 437 |
|
| 438 |
function csr_sign($csr, & $ca, $duration, $type = "user", $altnames) {
|
|
| 438 |
function csr_sign($csr, & $ca, $duration, $type = "user", $altnames, $digest_alg = "sha256") {
|
|
| 439 | 439 |
global $config; |
| 440 | 440 |
$old_err_level = error_reporting(0); |
| 441 | 441 |
|
| ... | ... | |
| 460 | 460 |
|
| 461 | 461 |
$args = array( |
| 462 | 462 |
"x509_extensions" => $cert_type, |
| 463 |
"digest_alg" => $digest_alg, |
|
| 463 | 464 |
"req_extensions" => "req_{$cert_type}"
|
| 464 | 465 |
); |
| 465 | 466 |
|
| ... | ... | |
| 682 | 683 |
} |
| 683 | 684 |
} |
| 684 | 685 |
|
| 686 |
function cert_get_sigtype($str_crt, $decode = true) {
|
|
| 687 |
if ($decode) {
|
|
| 688 |
$str_crt = base64_decode($str_crt); |
|
| 689 |
} |
|
| 690 |
$crt_details = openssl_x509_parse($str_crt); |
|
| 691 |
|
|
| 692 |
$signature = array(); |
|
| 693 |
if (isset($crt_details['signatureTypeSN']) && !empty($crt_details['signatureTypeSN'])) {
|
|
| 694 |
$signature['shortname'] = $crt_details['signatureTypeSN']; |
|
| 695 |
} |
|
| 696 |
if (isset($crt_details['signatureTypeLN']) && !empty($crt_details['signatureTypeLN'])) {
|
|
| 697 |
$signature['longname'] = $crt_details['signatureTypeLN']; |
|
| 698 |
} |
|
| 699 |
if (isset($crt_details['signatureTypeNID']) && !empty($crt_details['signatureTypeNID'])) {
|
|
| 700 |
$signature['nid'] = $crt_details['signatureTypeNID']; |
|
| 701 |
} |
|
| 702 |
|
|
| 703 |
return $signature; |
|
| 704 |
} |
|
| 705 |
|
|
| 685 | 706 |
function is_openvpn_server_ca($caref) {
|
| 686 | 707 |
global $config; |
| 687 | 708 |
if (!is_array($config['openvpn']['openvpn-server'])) {
|
| src/usr/local/www/system_certmanager.php | ||
|---|---|---|
| 103 | 103 |
$pconfig['digest_alg'] = "sha256"; |
| 104 | 104 |
$pconfig['csr_keylen'] = "2048"; |
| 105 | 105 |
$pconfig['csr_digest_alg'] = "sha256"; |
| 106 |
$pconfig['csrsign_digest_alg'] = "sha256"; |
|
| 106 | 107 |
$pconfig['type'] = "user"; |
| 107 | 108 |
$pconfig['lifetime'] = "3650"; |
| 108 | 109 |
} |
| ... | ... | |
| 371 | 372 |
if (($pconfig['method'] == "external") && !in_array($_POST["csr_digest_alg"], $openssl_digest_algs)) {
|
| 372 | 373 |
array_push($input_errors, gettext("Please select a valid Digest Algorithm."));
|
| 373 | 374 |
} |
| 375 |
if (($pconfig['method'] == "sign") && !in_array($_POST["csrsign_digest_alg"], $openssl_digest_algs)) {
|
|
| 376 |
array_push($input_errors, gettext("Please select a valid Digest Algorithm."));
|
|
| 377 |
} |
|
| 374 | 378 |
} |
| 375 | 379 |
|
| 376 | 380 |
/* save modifications */ |
| ... | ... | |
| 398 | 402 |
$altname_str = implode(",", $altnames_tmp);
|
| 399 | 403 |
} |
| 400 | 404 |
|
| 401 |
$n509 = csr_sign($csr, $ca, $pconfig['csrsign_lifetime'], $pconfig['type'], $altname_str); |
|
| 405 |
$n509 = csr_sign($csr, $ca, $pconfig['csrsign_lifetime'], $pconfig['type'], $altname_str, $pconfig['csrsign_digest_alg']);
|
|
| 402 | 406 |
|
| 403 | 407 |
if ($n509) {
|
| 404 | 408 |
// Gather the details required to save the new cert |
| ... | ... | |
| 718 | 722 |
'csrsign_lifetime', |
| 719 | 723 |
'*Certificate Lifetime (days)', |
| 720 | 724 |
'number', |
| 721 |
$pconfig['duration'] ? $pconfig['duration']:'3650'
|
|
| 725 |
$pconfig['csrsign_lifetime'] ? $pconfig['csrsign_lifetime']:'3650'
|
|
| 722 | 726 |
)); |
| 727 |
$section->addInput(new Form_Select( |
|
| 728 |
'csrsign_digest_alg', |
|
| 729 |
'*Digest Algorithm', |
|
| 730 |
$pconfig['csrsign_digest_alg'], |
|
| 731 |
array_combine($openssl_digest_algs, $openssl_digest_algs) |
|
| 732 |
))->setHelp('NOTE: It is recommended to use an algorithm stronger than '.
|
|
| 733 |
'SHA1 when possible'); |
|
| 723 | 734 |
|
| 724 | 735 |
$form->add($section); |
| 725 | 736 |
|
| ... | ... | |
| 1173 | 1184 |
<?=$subj?> |
| 1174 | 1185 |
<?php |
| 1175 | 1186 |
$certextinfo = ""; |
| 1187 |
$certserial = cert_get_serial($cert['crt']); |
|
| 1188 |
if (!empty($certserial)) {
|
|
| 1189 |
$certextinfo .= '<b>' . gettext("Serial: ") . '</b> ';
|
|
| 1190 |
$certextinfo .= htmlspecialchars(cert_escape_x509_chars($certserial, true)); |
|
| 1191 |
$certextinfo .= '<br/>'; |
|
| 1192 |
} |
|
| 1193 |
$certsig = cert_get_sigtype($cert['crt']); |
|
| 1194 |
if (is_array($certsig) && !empty($certsig) && !empty($certsig['shortname'])) {
|
|
| 1195 |
$certextinfo .= '<b>' . gettext("Signature Digest: ") . '</b> ';
|
|
| 1196 |
$certextinfo .= htmlspecialchars(cert_escape_x509_chars($certsig['shortname'], true)); |
|
| 1197 |
$certextinfo .= '<br/>'; |
|
| 1198 |
} |
|
| 1176 | 1199 |
if (is_array($sans) && !empty($sans)) {
|
| 1177 | 1200 |
$certextinfo .= '<b>' . gettext("SAN: ") . '</b> ';
|
| 1178 | 1201 |
$certextinfo .= htmlspecialchars(implode(', ', cert_escape_x509_chars($sans, true)));
|
Also available in: Unified diff
Add a field to pick a digest algo when signing a CSR, otherwise it ends up with SHA1. Fixes #7853
While here, add the cert serial number and sig digest type to the info block for each cert.
(cherry picked from commit aec3a259271be5dae63b148a48b7778c0cd0660e)