certifix/README

A small HTTPS API that accepts X509 CSRs and signs them if they
contain the magic number.

Modelled on the Puppet CA "Policy-based autosigning" functionality,
but without the rest of Puppet

[ This README is speculative ]


## Try it out

```
# create CA key and cert
openssl genrsa -out ca.key 4096  
CN=CA openssl req -config openssl.cnf -x509 -new -nodes -key ca.key -sha256 -days 3650  -out ca.crt

# create client CSR
CN=rotuer openssl req -config openssl.cnf -newkey rsa:2048 -nodes -keyout client.key -out client.csr 

# start the server
bin/certifix

# send it

curl -v -H 'content-type: application/x-pem-file' --data-binary @client.csr  http://localhost:8201/sign
```


https://www.puppet.com/docs/puppet/7/ssl_attributes_extensions#csr_custom_attributes-recommended-oids-custom-attributes

Custom attributes can use any public or site-specific OID, with the exception of the OIDs used for core X.509 functionality. This means you can’t re-use existing OIDs for things like subject alternative names.

One useful OID is the challengePassword attribute — 1.2.840.113549.1.9.7. This is a rarely-used corner of X.509 that can easily be repurposed to hold a pre-shared key.