forked from lfs-book/make-ca
-
Notifications
You must be signed in to change notification settings - Fork 0
PKI setup script for LFS (and others)
License
Unknown and 2 other licenses found
Licenses found
Unknown
LICENSE
GPL-3.0
LICENSE.GPLv3
MIT
LICENSE.MIT
djlucas/make-ca
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
Future development will continue at https://github.com/lfs-book make-ca is a utility to deliver and manage a complete PKI configuration for workstations and servers using only standard Unix utilities, OpenSSL, and p11-kit, using a Mozilla cacerts.txt or like file as the trust source. It can optionally generate keystores for OpenJDK PKCS#12 and NSS if installed. It was originally developed for use with Linux From Scratch to minimize dependencies for early system build, but has been written to be generic enough for any Linux distribution. The make-ca script will process the certificates included in the certdata.txt file, and place them in the system trust anchors, for use in multiple certificate stores. Additionally, any local OpenSSL Trusted certificates stored in /etc/ssl/local will also be imported into the system trust anchors and certificate stores making it a full trust management utiltiy. The make-ca script depends on OpenSSL >= 1.1.0, P11-Kit >= 0.23.19, and optionally NSS >= 3.23 and Java >= 1.7. Additionally, Coreutils, gawk, and sed are used. The default locations for output files can be tailored for your environment via the /etc/make-ca.conf configuration file (copy /etc/make-ca/make-ca.conf.dist). A p11-kit helper, copy-trust-modifications, is included for use in p11-kit's trust-extract-compat script (which should be symlinked to the user's path as update-ca-certificates). Manual creation of OpenSSL Trusted certificates is no longer required for general use. Instead, import the certificate using p11-kit's 'trust anchor --store /path/to/certificate.crt' functionality. This will recreate the individual stores assigning approriate permissions to the newly added anchor(s). Additionally, a copy of any newly added anchors will be placed into $LOCALDIR for future use. For the p11-kit distro hook, remove the "not configured" and "exit 1" lines from trust/trust-extract-compat, and append the following: =============================================================================== # Copy existing modifications to local store /usr/libexec/make-ca/copy-trust-modifications # Update trust stores /usr/sbin/make-ca -r =============================================================================== If you wish to distribute the results of this script as a standalone package, unlike in the BLFS distribution for which it was originally written, where the end user is ultimately responsible for the content, you, as the distributor, are taking ownership for the results. You are strongly encouraged to define a written inclusion policy, distribute all blacklisted files as a part of the local directory, and to provide the written policy in the distributed package. While the p11-kit trust utility can be used in most simple cases, you may require additional trust arguments for certian certificates. In these cases, you will need to manually create an OpenSSL trusted certificate from a regular PEM encoded file (use -inform for der or pkcs7 encoded certs). There are three trust types that are recognized by the make-ca.sh script, SSL/TLS, S/Mime, and code signing. For example, using the CAcert root, if you want it to be trusted for all three roles, the following commands will create an appropriate OpenSSL Trusted certificate: # install -vdm755 /etc/ssl/local && # wget http://www.cacert.org/certs/root.crt && # openssl x509 -in root.crt -text -fingerprint -setalias "CAcert Class 1 root" \ -addtrust serverAuth -addtrust emailProtection -addtrust codeSigning \ > /etc/ssl/local/CAcert_Class_1_root.pem If one of the three trust arguments is omitted, the certificate is neither trusted, nor rejected for that role. Clients using GnuTLS without p11-kit support are not aware of trusted certificates. To include this CA into the ca-bundle.crt (used for GnuTLS linked applications not using the p11-module), it must have serverAuth trust. Additionally, to explicitly disallow a certificate for a particular use, replace the -addtrust flag with the -addreject flag. Local trust overrides are handled entirely using the /etc/ssl/local directory. To override Mozilla's trust values, simply make a copy of the certificate in the local directory with alternate trust values.
About
PKI setup script for LFS (and others)
Resources
License
Unknown and 2 other licenses found
Licenses found
Unknown
LICENSE
GPL-3.0
LICENSE.GPLv3
MIT
LICENSE.MIT
Stars
Watchers
Forks
Packages 0
No packages published
Languages
- Shell 62.1%
- Perl 35.0%
- Makefile 2.9%