Revision 3f0b7bc3
Added by Jim Pingle over 5 years ago
| src/usr/local/www/system_camanager.php | ||
|---|---|---|
| 41 | 41 |
$ca_keylens = array("1024", "2048", "3072", "4096", "6144", "7680", "8192", "15360", "16384");
|
| 42 | 42 |
$ca_keytypes = array("RSA", "ECDSA");
|
| 43 | 43 |
global $openssl_digest_algs; |
| 44 |
global $cert_strict_values; |
|
| 44 | 45 |
$openssl_ecnames = openssl_get_curve_names(); |
| 45 | 46 |
|
| 46 | 47 |
if (isset($_REQUEST['id']) && is_numericint($_REQUEST['id'])) {
|
| ... | ... | |
| 648 | 649 |
null, |
| 649 | 650 |
$pconfig['keylen'], |
| 650 | 651 |
array_combine($ca_keylens, $ca_keylens) |
| 651 |
)); |
|
| 652 |
))->setHelp('The length to use when generating a new RSA key, in bits. %1$s' .
|
|
| 653 |
'The Key Length should not be lower than 2048 or some platforms ' . |
|
| 654 |
'may consider the certificate invalid.', '<br/>'); |
|
| 652 | 655 |
$section->add($group); |
| 653 | 656 |
|
| 654 | 657 |
$group = new Form_Group($i == 0 ? '*Elliptic Curve Name':''); |
| ... | ... | |
| 666 | 669 |
'*Digest Algorithm', |
| 667 | 670 |
$pconfig['digest_alg'], |
| 668 | 671 |
array_combine($openssl_digest_algs, $openssl_digest_algs) |
| 669 |
))->setHelp('NOTE: It is recommended to use an algorithm stronger than SHA1 '.
|
|
| 670 |
'when possible.'); |
|
| 672 |
))->setHelp('The digest method used when the CA is signed. %1$s' .
|
|
| 673 |
'The best practice is to use an algorithm stronger than SHA1. '. |
|
| 674 |
'Some platforms may consider weaker digest algorithms invalid', '<br/>'); |
|
| 671 | 675 |
|
| 672 | 676 |
$section->addInput(new Form_Input( |
| 673 | 677 |
'lifetime', |
| ... | ... | |
| 752 | 756 |
change_keytype(); |
| 753 | 757 |
}); |
| 754 | 758 |
|
| 759 |
function check_keylen() {
|
|
| 760 |
var min_keylen = <?= $cert_strict_values['min_private_key_bits'] ?>; |
|
| 761 |
var klid = '#keylen'; |
|
| 762 |
/* Color the Parent/Label */ |
|
| 763 |
if (parseInt($(klid).val()) < min_keylen) {
|
|
| 764 |
$(klid).parent().parent().removeClass("text-normal").addClass("text-warning");
|
|
| 765 |
} else {
|
|
| 766 |
$(klid).parent().parent().removeClass("text-warning").addClass("text-normal");
|
|
| 767 |
} |
|
| 768 |
/* Color individual options */ |
|
| 769 |
$(klid + " option").filter(function() {
|
|
| 770 |
return parseInt($(this).val()) < min_keylen; |
|
| 771 |
}).removeClass("text-normal").addClass("text-warning").siblings().removeClass("text-warning").addClass("text-normal");
|
|
| 772 |
} |
|
| 773 |
|
|
| 774 |
function check_digest() {
|
|
| 775 |
var weak_algs = <?= json_encode($cert_strict_values['digest_blacklist']) ?>; |
|
| 776 |
var daid = '#digest_alg'; |
|
| 777 |
/* Color the Parent/Label */ |
|
| 778 |
if (jQuery.inArray($(daid).val(), weak_algs) > -1) {
|
|
| 779 |
$(daid).parent().parent().removeClass("text-normal").addClass("text-warning");
|
|
| 780 |
} else {
|
|
| 781 |
$(daid).parent().parent().removeClass("text-warning").addClass("text-normal");
|
|
| 782 |
} |
|
| 783 |
/* Color individual options */ |
|
| 784 |
$(daid + " option").filter(function() {
|
|
| 785 |
return (jQuery.inArray($(this).val(), weak_algs) > -1); |
|
| 786 |
}).removeClass("text-normal").addClass("text-warning").siblings().removeClass("text-warning").addClass("text-normal");
|
|
| 787 |
} |
|
| 788 |
|
|
| 789 |
// ---------- Control change handlers --------------------------------------------------------- |
|
| 790 |
|
|
| 791 |
$('#method').on('change', function() {
|
|
| 792 |
check_keylen(); |
|
| 793 |
check_digest(); |
|
| 794 |
}); |
|
| 795 |
|
|
| 796 |
$('#keylen').on('change', function() {
|
|
| 797 |
check_keylen(); |
|
| 798 |
}); |
|
| 799 |
|
|
| 800 |
$('#digest_alg').on('change', function() {
|
|
| 801 |
check_digest(); |
|
| 802 |
}); |
|
| 803 |
|
|
| 755 | 804 |
// ---------- On initial page load ------------------------------------------------------------ |
| 756 | 805 |
change_keytype(); |
| 806 |
check_keylen(); |
|
| 807 |
check_digest(); |
|
| 757 | 808 |
}); |
| 758 | 809 |
//]]> |
| 759 | 810 |
</script> |
Also available in: Unified diff
Certificate strength improvements. Fixes #9825
chocies
recommended.