mirror of
https://github.com/square/certigo.git
synced 2024-04-21 12:32:40 +00:00
Support new name constraint fields in crypto/x509
This commit is contained in:
Cedric Staub
+27
-6
@@ -56,15 +56,39 @@ Authority Key ID: {{.Issuer.KeyID | hexify}}
|
||||
{{- if .BasicConstraints}}
|
||||
Basic Constraints: CA:{{.BasicConstraints.IsCA}}{{if .BasicConstraints.MaxPathLen}}, pathlen:{{.BasicConstraints.MaxPathLen}}{{end}}{{end}}
|
||||
{{- if .NameConstraints}}
|
||||
DNS Name Constraints{{if .NameConstraints.Critical}} (critical){{end}}:
|
||||
Name Constraints{{if .NameConstraints.Critical}} (critical){{end}}:
|
||||
{{- if .NameConstraints.PermittedDNSDomains}}
|
||||
Permitted:
|
||||
Permitted DNS domains:
|
||||
{{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedDNSDomains)}}
|
||||
{{- end -}}
|
||||
{{- if .NameConstraints.PermittedEmailAddresses}}
|
||||
Permitted email addresses:
|
||||
{{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedEmailAddresses)}}
|
||||
{{- end -}}
|
||||
{{- if .NameConstraints.PermittedIPRanges}}
|
||||
Permitted IP ranges:
|
||||
{{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedIPRanges)}}
|
||||
{{- end -}}
|
||||
{{- if .NameConstraints.PermittedURIDomains}}
|
||||
Permitted URI domains:
|
||||
{{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedURIDomains)}}
|
||||
{{- end}}
|
||||
{{- if .NameConstraints.ExcludedDNSDomains}}
|
||||
Excluded:
|
||||
Excluded DNS domains:
|
||||
{{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedDNSDomains)}}
|
||||
{{- end}}
|
||||
{{- if .NameConstraints.ExcludedEmailAddresses}}
|
||||
Excluded email addresses:
|
||||
{{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedEmailAddresses)}}
|
||||
{{- end}}
|
||||
{{- if .NameConstraints.ExcludedIPRanges}}
|
||||
Excluded IP ranges:
|
||||
{{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedIPRanges)}}
|
||||
{{- end}}
|
||||
{{- if .NameConstraints.ExcludedURIDomains}}
|
||||
Excluded URI domains:
|
||||
{{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedURIDomains)}}
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
{{- if .OCSPServer}}
|
||||
OCSP Server(s):
|
||||
@@ -114,9 +138,6 @@ var layout = `
|
||||
Valid: {{.NotBefore | certStart}} to {{.NotAfter | certEnd}}
|
||||
Subject: {{.Subject.Name | printShortName }}
|
||||
Issuer: {{.Issuer.Name | printShortName }}
|
||||
{{- if .NameConstraints}}
|
||||
Name Constraints{{if .NameConstraints.Critical}} (critical){{end}}: {{range .NameConstraints.PermittedDNSDomains}}
|
||||
{{.}}{{end}}{{end}}
|
||||
{{- if .AltDNSNames}}
|
||||
DNS Names:
|
||||
{{wrapWith .Width "\n\t" (join ", " .AltDNSNames)}}{{end}}
|
||||
|
||||
+23
-7
@@ -171,9 +171,15 @@ type basicConstraints struct {
|
||||
}
|
||||
|
||||
type nameConstraints struct {
|
||||
Critical bool `json:"critical,omitempty"`
|
||||
PermittedDNSDomains []string `json:"permitted_dns_domains,omitempty"`
|
||||
ExcludedDNSDomains []string `json:"excluded_dns_domains,omitempty"`
|
||||
Critical bool `json:"critical,omitempty"`
|
||||
PermittedDNSDomains []string `json:"permitted_dns_domains,omitempty"`
|
||||
ExcludedDNSDomains []string `json:"excluded_dns_domains,omitempty"`
|
||||
PermittedIPRanges []*net.IPNet `json:"permitted_ip_ranges,omitempty"`
|
||||
ExcludedIPRanges []*net.IPNet `json:"excluded_ip_ranges,omitempty"`
|
||||
PermittedEmailAddresses []string `json:"permitted_email_addresses,omitempty"`
|
||||
ExcludedEmailAddresses []string `json:"excluded_email_addresses,omitempty"`
|
||||
PermittedURIDomains []string `json:"permitted_uri_domains,omitempty"`
|
||||
ExcludedURIDomains []string `json:"excluded_uri_domains,omitempty"`
|
||||
}
|
||||
|
||||
// simpleCertificate is a JSON-representable certificate metadata holder.
|
||||
@@ -254,11 +260,21 @@ func createSimpleCertificate(name string, cert *x509.Certificate) simpleCertific
|
||||
}
|
||||
}
|
||||
|
||||
if len(cert.PermittedDNSDomains) > 0 || len(cert.ExcludedDNSDomains) > 0 {
|
||||
if len(cert.PermittedDNSDomains) > 0 || len(cert.ExcludedDNSDomains) > 0 ||
|
||||
len(cert.PermittedIPRanges) > 0 || len(cert.ExcludedIPRanges) > 0 ||
|
||||
len(cert.PermittedEmailAddresses) > 0 || len(cert.ExcludedEmailAddresses) > 0 ||
|
||||
len(cert.PermittedURIDomains) > 0 || len(cert.ExcludedURIDomains) > 0 {
|
||||
|
||||
out.NameConstraints = &nameConstraints{
|
||||
Critical: cert.PermittedDNSDomainsCritical,
|
||||
PermittedDNSDomains: cert.PermittedDNSDomains,
|
||||
ExcludedDNSDomains: cert.ExcludedDNSDomains,
|
||||
Critical: cert.PermittedDNSDomainsCritical,
|
||||
PermittedDNSDomains: cert.PermittedDNSDomains,
|
||||
ExcludedDNSDomains: cert.ExcludedDNSDomains,
|
||||
PermittedIPRanges: cert.PermittedIPRanges,
|
||||
ExcludedIPRanges: cert.ExcludedIPRanges,
|
||||
PermittedEmailAddresses: cert.PermittedEmailAddresses,
|
||||
ExcludedEmailAddresses: cert.ExcludedEmailAddresses,
|
||||
PermittedURIDomains: cert.PermittedURIDomains,
|
||||
ExcludedURIDomains: cert.ExcludedURIDomains,
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -3736,3 +3736,9 @@ Dump trust store and make sure there are no errors.
|
||||
|
||||
$ certigo dump cacert.pem >/dev/null; echo $?
|
||||
0
|
||||
$ certigo dump --verbose cacert.pem >/dev/null; echo $?
|
||||
0
|
||||
$ certigo dump --json cacert.pem >/dev/null; echo $?
|
||||
0
|
||||
$ certigo dump --pem cacert.pem >/dev/null; echo $?
|
||||
0
|
||||
|
||||
@@ -24,6 +24,31 @@ Set up test data.
|
||||
> tFmaBKzI+2uQwt6DHQuPmOSEmI7NcrVS2WhPVPa7fIY/ExUy7jqIr2qM59eSl7OC
|
||||
> AhzgLtgqfwLgbj5PWZENYlNRXmZGi4GD
|
||||
> -----END CERTIFICATE-----
|
||||
> -----BEGIN CERTIFICATE-----
|
||||
> MIIEMTCCAxmgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBlTELMAkGA1UEBhMCR1Ix
|
||||
> RDBCBgNVBAoTO0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1
|
||||
> dGlvbnMgQ2VydC4gQXV0aG9yaXR5MUAwPgYDVQQDEzdIZWxsZW5pYyBBY2FkZW1p
|
||||
> YyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIFJvb3RDQSAyMDExMB4XDTExMTIw
|
||||
> NjEzNDk1MloXDTMxMTIwMTEzNDk1MlowgZUxCzAJBgNVBAYTAkdSMUQwQgYDVQQK
|
||||
> EztIZWxsZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIENl
|
||||
> cnQuIEF1dGhvcml0eTFAMD4GA1UEAxM3SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
|
||||
> c2VhcmNoIEluc3RpdHV0aW9ucyBSb290Q0EgMjAxMTCCASIwDQYJKoZIhvcNAQEB
|
||||
> BQADggEPADCCAQoCggEBAKlTAOMupvaO+mDYLZU++CwqVE7NuYRhlFhPjz2L5EPz
|
||||
> dYmNUeTDN9KKiE15HrcS3UN4SoqS5tdI1Q+kOilENbgH9mgdVc04UfCMJDGFr4PJ
|
||||
> fel3r+0ae50X+bOdOFAPplp5kYCvN66m0zH7tSYJnTxa71HFK9+WXesyHgLacEns
|
||||
> bgzImjeN9/E2YEsmLIKe0HjzDQ9jpFEw4fkrJxIH2Oq9GGKYsFk3fb7u8yBRQlqD
|
||||
> 75O6aRXxYp2fmTmCobd0LovUxQt7L/DICto9eQqakxylKHJzkUOap9FNhYS5qXSP
|
||||
> FEDH3N6sQWRstBmbAmNtJGSPRLIl6s5ddAxjMlyNh+UCAwEAAaOBiTCBhjAPBgNV
|
||||
> HRMBAf8EBTADAQH/MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQUppFC/RNhSiOeCKQp
|
||||
> 5dgTBCPuQSUwRwYDVR0eBEAwPqA8MAWCAy5ncjAFggMuZXUwBoIELmVkdTAGggQu
|
||||
> b3JnMAWBAy5ncjAFgQMuZXUwBoEELmVkdTAGgQQub3JnMA0GCSqGSIb3DQEBBQUA
|
||||
> A4IBAQAf73lB4XtuP7KMhjdCSk4cNx6NZrokgclPEg8hwAOXhiVtXdMiKahsog2p
|
||||
> 6z0GW5k6x8zDmjR/qw7IThzh+uTczQ2+vyT+bOdrwg3IBp5OjWEopmr95fZi6hg8
|
||||
> TqBTnbI6nOulnJEWtk2C4AwFSKls9cz4y51JtPACpf1wA+2KIaWuE4ZJwzNzvoc7
|
||||
> dIsXRSZMFpGD/md9zU1jZ/rzAxKWeAaNsWftjj++n08C9bMJL/NMh98qy5V8Acys
|
||||
> Nnq/onN694/BtZqhFLKPM58N7yLcZnuEvUUXBj08yrl3NI/K6s8/MT7jiOOASSXI
|
||||
> l7WdmplNsDz4SgCbZN2fOUvRJ9e4
|
||||
> -----END CERTIFICATE-----
|
||||
> EOF
|
||||
|
||||
Dump an example certificate with name constraints (example-name-constraints.crt)
|
||||
@@ -46,11 +71,45 @@ Dump an example certificate with name constraints (example-name-constraints.crt)
|
||||
\tOrganizational Unit: example (esc)
|
||||
\tCommonName: example-name-constraints (esc)
|
||||
Basic Constraints: CA:true, pathlen:0
|
||||
DNS Name Constraints:
|
||||
Permitted:
|
||||
Name Constraints:
|
||||
Permitted DNS domains:
|
||||
\t.example.com (esc)
|
||||
Excluded:
|
||||
Permitted email addresses:
|
||||
\t.example.com (esc)
|
||||
Permitted IP ranges:
|
||||
\t192.168.0.0/16 (esc)
|
||||
Excluded DNS domains:
|
||||
\t.example.org (esc)
|
||||
Excluded email addresses:
|
||||
\t.example.org (esc)
|
||||
Excluded IP ranges:
|
||||
\t10.10.0.0/16 (esc)
|
||||
Key Usage:
|
||||
\tCert Sign (esc)
|
||||
|
||||
** CERTIFICATE 2 **
|
||||
Serial: 0
|
||||
Valid: 2011-12-06 13:49 UTC to 2031-12-01 13:49 UTC
|
||||
Signature: SHA1-RSA (self-signed)
|
||||
Subject Info:
|
||||
\tCountry: GR (esc)
|
||||
\tOrganization: Hellenic Academic and Research Institutions Cert. Authority (esc)
|
||||
\tCommonName: Hellenic Academic and Research Institutions RootCA 2011 (esc)
|
||||
Issuer Info:
|
||||
\tCountry: GR (esc)
|
||||
\tOrganization: Hellenic Academic and Research Institutions Cert. Authority (esc)
|
||||
\tCommonName: Hellenic Academic and Research Institutions RootCA 2011 (esc)
|
||||
Subject Key ID: A6:91:42:FD:13:61:4A:23:9E:08:A4:29:E5:D8:13:04:23:EE:41:25
|
||||
Basic Constraints: CA:true
|
||||
Name Constraints:
|
||||
Permitted DNS domains:
|
||||
\t.gr, .eu, .edu, .org (esc)
|
||||
Permitted email addresses:
|
||||
\t.gr, .eu, .edu, .org (esc)
|
||||
Key Usage:
|
||||
\tCert Sign (esc)
|
||||
\tCRL Sign (esc)
|
||||
Warnings:
|
||||
\tSerial number in cert appears to be zero/negative (esc)
|
||||
\tSigned with SHA1-RSA, which is an outdated signature algorithm (esc)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user