33 lines
1.2 KiB
Plaintext
33 lines
1.2 KiB
Plaintext
A small HTTPS API that accepts X509 CSRs and signs them if they
|
||
contain the magic number.
|
||
|
||
Modelled on the Puppet CA "Policy-based autosigning" functionality,
|
||
but without the rest of Puppet
|
||
|
||
[ This README is speculative ]
|
||
|
||
|
||
## Try it out
|
||
|
||
```
|
||
# create CA key and cert
|
||
openssl genrsa -out ca.key 4096
|
||
CN=CA openssl req -config openssl.cnf -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt
|
||
|
||
# create client CSR
|
||
CN=rotuer openssl req -config openssl.cnf -newkey rsa:2048 -nodes -keyout client.key -out client.csr
|
||
|
||
# start the server
|
||
bin/certifix
|
||
|
||
# send it
|
||
|
||
curl -v -H 'content-type: application/x-pem-file' --data-binary @client.csr http://localhost:8201/sign
|
||
```
|
||
|
||
|
||
https://www.puppet.com/docs/puppet/7/ssl_attributes_extensions#csr_custom_attributes-recommended-oids-custom-attributes
|
||
|
||
Custom attributes can use any public or site-specific OID, with the exception of the OIDs used for core X.509 functionality. This means you can’t re-use existing OIDs for things like subject alternative names.
|
||
|
||
One useful OID is the challengePassword attribute — 1.2.840.113549.1.9.7. This is a rarely-used corner of X.509 that can easily be repurposed to hold a pre-shared key. |