github/certigo
4
0
Fork 0
mirror of https://github.com/square/certigo.git synced 2024-04-21 12:32:40 +00:00
Code Issues Releases Wiki Activity

Merge pull request #149 from square/cs/go1.9

Browse Source 
Better DNS name constraint handling
This commit is contained in:
Cedric Staub
2017-08-29 13:34:58 -07:00
committed by GitHub
parent 6a1c58a527 284598d9f2
commit a3243b8613
18 changed files with 261 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.travis.yml
+2 -2
View File
@@ -3,7 +3,7 @@
language: go
go:
- 1.8
- 1.9
install:
- go get github.com/Masterminds/glide
@@ -33,4 +33,4 @@ deploy:
on:
repo: square/certigo
tags: true
go: 1.8
go: 1.9
README.md
+1 -1
View File
@@ -27,7 +27,7 @@ On macOS you can also use homebrew to install:
brew install certigo
Note that certigo requires Go 1.8 or later to build.
Note that certigo requires Go 1.9 or later to build.
### Develop
lib/display.go
+43 -15
View File
@@ -48,30 +48,57 @@ Subject Info:
Issuer Info:
{{- template "PkixName" .Issuer.Name}}
{{- if .Subject.KeyID}}
Subject Key ID: {{.Subject.KeyID | hexify}}{{end}}{{if .Issuer.KeyID}}
Authority Key ID: {{.Issuer.KeyID | hexify}}{{end}}{{if .BasicConstraints}}
Basic Constraints: CA:{{.BasicConstraints.IsCA}}{{if .BasicConstraints.MaxPathLen}}, pathlen:{{.BasicConstraints.MaxPathLen}}{{end}}{{end}}{{if .NameConstraints}}
Name Constraints {{if .PermittedDNSDomains.Critical}}(critical){{end}}: {{range .NameConstraints.PermittedDNSDomains}}
{{.}}{{end}}{{end}}{{if .KeyUsage}}
Key Usage:{{range .KeyUsage | keyUsage}}
{{.}}{{end}}{{end}}{{if .ExtKeyUsage}}
Extended Key Usage:{{range .ExtKeyUsage}}
{{. | extKeyUsage}}{{end}}{{end}}
Subject Key ID: {{.Subject.KeyID | hexify}}
{{- end}}
{{- if .Issuer.KeyID}}
Authority Key ID: {{.Issuer.KeyID | hexify}}
{{- end}}
{{- if .BasicConstraints}}
Basic Constraints: CA:{{.BasicConstraints.IsCA}}{{if .BasicConstraints.MaxPathLen}}, pathlen:{{.BasicConstraints.MaxPathLen}}{{end}}{{end}}
{{- if .NameConstraints}}
DNS Name Constraints{{if .NameConstraints.Critical}} (critical){{end}}:
{{- if .NameConstraints.PermittedDNSDomains}}
Permitted:
{{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedDNSDomains)}}
{{- end}}
{{- if .NameConstraints.ExcludedDNSDomains}}
Excluded:
{{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedDNSDomains)}}
{{- end}}
{{- end}}
{{- if .KeyUsage}}
Key Usage:
{{- range .KeyUsage | keyUsage}}
{{.}}
{{- end}}
{{- end}}
{{- if .ExtKeyUsage}}
Extended Key Usage:
{{- range .ExtKeyUsage}}
{{. | extKeyUsage}}{{end}}
{{- end}}
{{- if .AltDNSNames}}
DNS Names:
{{wrapWith .Width "\n\t" (join ", " .AltDNSNames)}}{{end}}
{{wrapWith .Width "\n\t" (join ", " .AltDNSNames)}}
{{- end}}
{{- if .AltIPAddresses}}
IP Addresses:
{{wrapWith .Width "\n\t" (join ", " .AltIPAddresses)}}{{end}}
{{wrapWith .Width "\n\t" (join ", " .AltIPAddresses)}}
{{- end}}
{{- if .URINames}}
URI Names:
{{wrapWith .Width "\n\t" (join ", " .URINames)}}{{end}}
{{wrapWith .Width "\n\t" (join ", " .URINames)}}
{{- end}}
{{- if .EmailAddresses}}
Email Addresses:
{{wrapWith .Width "\n\t" (join ", " .EmailAddresses)}}{{end}}
{{wrapWith .Width "\n\t" (join ", " .EmailAddresses)}}
{{- end}}
{{- if .Warnings}}
Warnings:{{range .Warnings}}
{{. | redify}}{{end}}{{end}}`
Warnings:
{{- range .Warnings}}
{{. | redify}}
{{- end}}
{{- end}}`
var layout = `
{{- if .Alias}}{{.Alias}}
@@ -280,6 +307,7 @@ func greenify(text string) string {
return green.SprintfFunc()("%s", text)
}
// PrintShortName turns a pkix.Name into a string of RDN tuples.
func PrintShortName(name pkix.Name) (out string) {
// Try to print CN for short name if present.
if name.CommonName != "" {
lib/encoder.go
+3 -1
View File
@@ -173,6 +173,7 @@ type basicConstraints struct {
type nameConstraints struct {
Critical bool `json:"critical,omitempty"`
PermittedDNSDomains []string `json:"permitted_dns_domains,omitempty"`
ExcludedDNSDomains []string `json:"excluded_dns_domains,omitempty"`
}
// simpleCertificate is a JSON-representable certificate metadata holder.
@@ -249,10 +250,11 @@ func createSimpleCertificate(name string, cert *x509.Certificate) simpleCertific
}
}
if len(cert.PermittedDNSDomains) > 0 {
if len(cert.PermittedDNSDomains) > 0 || len(cert.ExcludedDNSDomains) > 0 {
out.NameConstraints = &nameConstraints{
Critical: cert.PermittedDNSDomainsCritical,
PermittedDNSDomains: cert.PermittedDNSDomains,
ExcludedDNSDomains: cert.ExcludedDNSDomains,
}
}
test-certs/Makefile
+4 -1
View File
@@ -1,7 +1,7 @@
TARGETS = \
example-root example-leaf example-sha1 example-md5 example-root-bad-ku \
example-bad-serial example-small-key example-expired example-elliptic-sha1 \
example-custom-oid
example-custom-oid example-name-constraints
all: \
$(addsuffix .crt,$(TARGETS)) \
@@ -80,3 +80,6 @@ example-custom-oid.csr: example-custom-oid.key
example-custom-oid.crt: example-custom-oid.csr
openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions leaf
example-name-constraints.crt: example-name-constraints.csr
openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions root_with_constraints
test-certs/example-custom-oid.crt
+20
View File
@@ -0,0 +1,20 @@
-----BEGIN CERTIFICATE-----
MIIDPDCCAiSgAwIBAgIJAMnEiF0KGVsZMA0GCSqGSIb3DQEBCwUAMDUxHDAaBgNV
BAMME2V4YW1wbGUtY3VzdG9tLW9pZHMxFTATBggrBgEEAYKgMgwHZXhhbXBsZTAe
Fw0xNzA4MTgxOTQyMDZaFw0yNDA2MjIxOTQyMDZaMDUxHDAaBgNVBAMME2V4YW1w
bGUtY3VzdG9tLW9pZHMxFTATBggrBgEEAYKgMgwHZXhhbXBsZTCCASIwDQYJKoZI
hvcNAQEBBQADggEPADCCAQoCggEBAMcjcsRRkqeVQxzhzKTgdt29XnihRrNRnsa2
o2KVZGQOcavJGkosjD1xG9/I8m4dr04h/2Mc06g6VH65wWWJ5UKceBks00/ftFcG
9I5iorXf5WQQPM73y9zYtmJtE6WUBh6f0MmlTr76g4mI26zfliWsubrB1MRQ8RTD
9TY8lgk/UCmT63YryrYBTEMwgqAZInN95ir0n4vt53ee6JfNwSYIyLxGRZFYOEeP
30hlntw1vN+q1kyTsY/xSA4BnD8tXliJ0AR5he+wmExrrlTDKxp1fm63ODOBZQVJ
0L/LMvEul2Qa3xtWdp6WB5LygmTOC1DpipqRhhQAgJb5qwaJSGMCAwEAAaNPME0w
HQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMCwGA1UdEQQlMCOHBH8AAAGH
EAAAAAAAAAAAAAAAAAAAAAGCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAQEA
Tglf3JyqYQXGA7cftxoNh8ZHbKlGwZ/V7qGPunhY+3lUdcU9nMrGJkHfhtHjbxwy
Mp8Xin+oJWxvQC74MhwN4eYmbgxoeIhnWpwycuLC748/dEF3G+lbzPoBDGC7oaLd
Bdy4ChAAPGu47fQrkxCJP9TTYWrTcrgo7rioB+7v7Hu68nW3qp5hlcBOpI5f8SIm
2RKJMZDkavUrwQx/wRWqG5lrn7mRVNNJ1hO//NrfrcobtGdKCSH9uoNTCYvBtcAT
j+MGqfv1mmYaTzS3RGBd3w14bWxR9qBuFB5GccgPMzW6hMaIhGM5+qjdQ0GnOgnz
n2g4qtGeN+uglDfulWZ7lA==
-----END CERTIFICATE-----
test-certs/example-custom-oid.csr
+16
View File
@@ -0,0 +1,16 @@
-----BEGIN CERTIFICATE REQUEST-----
MIICejCCAWICAQAwNTEcMBoGA1UEAwwTZXhhbXBsZS1jdXN0b20tb2lkczEVMBMG
CCsGAQQBgqAyDAdleGFtcGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAxyNyxFGSp5VDHOHMpOB23b1eeKFGs1GexrajYpVkZA5xq8kaSiyMPXEb38jy
bh2vTiH/YxzTqDpUfrnBZYnlQpx4GSzTT9+0Vwb0jmKitd/lZBA8zvfL3Ni2Ym0T
pZQGHp/QyaVOvvqDiYjbrN+WJay5usHUxFDxFMP1NjyWCT9QKZPrdivKtgFMQzCC
oBkic33mKvSfi+3nd57ol83BJgjIvEZFkVg4R4/fSGWe3DW836rWTJOxj/FIDgGc
Py1eWInQBHmF77CYTGuuVMMrGnV+brc4M4FlBUnQv8sy8S6XZBrfG1Z2npYHkvKC
ZM4LUOmKmpGGFACAlvmrBolIYwIDAQABoAAwDQYJKoZIhvcNAQEFBQADggEBAFqr
qQK9/gLAxBxUfny7cCN+NFBb11HJx8HerLKqBGN4VOh27SkJGg6H5ozj/qwhElVw
SQUX33TigC6roiPDK3+KvL9fxjUY60xnLRXKciMm/1jqeYjht33hQMZAi4OwT+dG
FFVys2zlSFXxqX79+6mkKUIRurymnJWjOHNWOhrDckShDjf5N+A3lUNWgwu7M0cX
T5Bv/6AFV4vuMJALv4JTBC60bT+cfXmYxCox+5rZ+bT+6uOFWu+0H4CPXfP9OU5B
/aA20r2bN16TftaLPY9HSJNPXqlZHX196e6+oqd16Rr6AyYAvGlKmpJgpm5OS17r
7yMFrPWSWlsOmIhxhXs=
-----END CERTIFICATE REQUEST-----
test-certs/example-custom-oid.jceks
BIN
View File
Binary file not shown.
test-certs/example-custom-oid.key
+27
View File
@@ -0,0 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAxyNyxFGSp5VDHOHMpOB23b1eeKFGs1GexrajYpVkZA5xq8ka
SiyMPXEb38jybh2vTiH/YxzTqDpUfrnBZYnlQpx4GSzTT9+0Vwb0jmKitd/lZBA8
zvfL3Ni2Ym0TpZQGHp/QyaVOvvqDiYjbrN+WJay5usHUxFDxFMP1NjyWCT9QKZPr
divKtgFMQzCCoBkic33mKvSfi+3nd57ol83BJgjIvEZFkVg4R4/fSGWe3DW836rW
TJOxj/FIDgGcPy1eWInQBHmF77CYTGuuVMMrGnV+brc4M4FlBUnQv8sy8S6XZBrf
G1Z2npYHkvKCZM4LUOmKmpGGFACAlvmrBolIYwIDAQABAoIBAFbQmmkB0viiNtbx
jYDXppp2wye9z4+/ZoPk/Yet7007iszEaGSr1Ru4ItnFxgLBiDp80dTIrXFqtIlm
u+xjWIJYqnb3Nsxcj0ddbeJhF+RITr334jqshsCp7aEtQmJuDNju/VvbaGAT4KJl
+rb75n5YNcQ4WmSXkPJnl5Bki1hN75zjlnVlD+FV+/j0hz2Kg7mAQkJqbLn7Cd/4
398qYABak0aAA2ZH2DeybZsZGstka2yIypQsJVQNYvxWcxCNweWMOljRPfxX50Oa
ZIuuO70VQlXmIZYHruvqpImEOSWQtiVm2lTR+jVR6wof/oWOWkYqefoAQdLJy1ud
FgEFUXkCgYEA7sSMOVM6pvz+ALz3aKFCqUYe+yA3HBkCUDF8ESVNnl9OMQB5mXRg
J6kxr8z/Pu8P8J9Np87hBZPSJe7rFavfhjgxJ1rnrg73Btq4+TZ85qby3H57Ybnm
SVohAWOQfEaPt9wD4AIy8p/tKBaWoNnBwuYBux52WX0iO2nZIgTA+W0CgYEA1YK2
k55Rfo6WfUWCK3CyR+6kGfphxPY3GWkuckTh3M8cQvFzQEZ6p4eBPBxxZ9VtogXR
CP5AXzHZYNhH9s9djmiZh/m0MHGKILQD3feD0dtypySQ0gCh+NOCxAProB2gDK5C
kCOJ5x45nujiPcz8mqq/qvWBQjEaOunL8ivNdw8CgYBS8Ek5PHT6PpVI0lsqqCGM
xUPLvcQG6ZUJIDdViVyt77MsiFq0+FzSSg5tX8smJEqoLd3+tXkqw89Sx+w3Ke3K
JMjGP+iMaLxcUCvCva+jO0jPWMwpBTc+MaWXYut0j9oqZq2d6YWjC/SIYVhPZXTN
67GcOxenPDVg6AK5s2cI/QKBgQCD5C8smUv2Rdaoo9t5QjCfRseQVJ84sG/w/ox2
gh6T7Eyk/coYFnGGM6qdm2Rio/EJeVZbm9Pf+kcyD+jEiexdIDhXSuUIV9rfwNPy
tgd0B3+XyHq9fy6PKvlIZLOVQTexHaR4rbtuTbmCdJHtY0dXs8qarPWgEf0GD46w
lmZh+QKBgQDPPfnORduMYFTLmcqHBDIyK4X4Y4bZfsEJkoyRbPRP2YSTuliFzuUe
qBDOPcy9JcDg+jAmTmPeaEKK3Ad516QpS4uk7u0n5AE3UTdiC7ICs4+VmGWOO2T4
mQP1CdSxBEsYap5ZT1szVwRllInSHLqCeKDSI6LD+0AzA2biBaRmaw==
-----END RSA PRIVATE KEY-----
test-certs/example-custom-oid.p12
BIN
View File
Binary file not shown.
test-certs/example-custom-oid.p7b
+21
View File
@@ -0,0 +1,21 @@
-----BEGIN PKCS7-----
MIIDbQYJKoZIhvcNAQcCoIIDXjCCA1oCAQExADALBgkqhkiG9w0BBwGgggNAMIID
PDCCAiSgAwIBAgIJAMnEiF0KGVsZMA0GCSqGSIb3DQEBCwUAMDUxHDAaBgNVBAMM
E2V4YW1wbGUtY3VzdG9tLW9pZHMxFTATBggrBgEEAYKgMgwHZXhhbXBsZTAeFw0x
NzA4MTgxOTQyMDZaFw0yNDA2MjIxOTQyMDZaMDUxHDAaBgNVBAMME2V4YW1wbGUt
Y3VzdG9tLW9pZHMxFTATBggrBgEEAYKgMgwHZXhhbXBsZTCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBAMcjcsRRkqeVQxzhzKTgdt29XnihRrNRnsa2o2KV
ZGQOcavJGkosjD1xG9/I8m4dr04h/2Mc06g6VH65wWWJ5UKceBks00/ftFcG9I5i
orXf5WQQPM73y9zYtmJtE6WUBh6f0MmlTr76g4mI26zfliWsubrB1MRQ8RTD9TY8
lgk/UCmT63YryrYBTEMwgqAZInN95ir0n4vt53ee6JfNwSYIyLxGRZFYOEeP30hl
ntw1vN+q1kyTsY/xSA4BnD8tXliJ0AR5he+wmExrrlTDKxp1fm63ODOBZQVJ0L/L
MvEul2Qa3xtWdp6WB5LygmTOC1DpipqRhhQAgJb5qwaJSGMCAwEAAaNPME0wHQYD
VR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMCwGA1UdEQQlMCOHBH8AAAGHEAAA
AAAAAAAAAAAAAAAAAAGCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAQEATglf
3JyqYQXGA7cftxoNh8ZHbKlGwZ/V7qGPunhY+3lUdcU9nMrGJkHfhtHjbxwyMp8X
in+oJWxvQC74MhwN4eYmbgxoeIhnWpwycuLC748/dEF3G+lbzPoBDGC7oaLdBdy4
ChAAPGu47fQrkxCJP9TTYWrTcrgo7rioB+7v7Hu68nW3qp5hlcBOpI5f8SIm2RKJ
MZDkavUrwQx/wRWqG5lrn7mRVNNJ1hO//NrfrcobtGdKCSH9uoNTCYvBtcATj+MG
qfv1mmYaTzS3RGBd3w14bWxR9qBuFB5GccgPMzW6hMaIhGM5+qjdQ0GnOgnzn2g4
qtGeN+uglDfulWZ7lKEAMQA=
-----END PKCS7-----
test-certs/example-name-constraints.crt
+23
View File
@@ -0,0 +1,23 @@
-----BEGIN CERTIFICATE-----
MIID1DCCArygAwIBAgIJAL8xOGAOaSzBMA0GCSqGSIb3DQEBCwUAMGExCzAJBgNV
BAYTAlVTMQswCQYDVQQIEwJDQTEQMA4GA1UEChMHY2VydGlnbzEQMA4GA1UECxMH
ZXhhbXBsZTEhMB8GA1UEAxMYZXhhbXBsZS1uYW1lLWNvbnN0cmFpbnRzMB4XDTE3
MDgxODE5NDg1MFoXDTI0MDYyMjE5NDg1MFowYTELMAkGA1UEBhMCVVMxCzAJBgNV
BAgTAkNBMRAwDgYDVQQKEwdjZXJ0aWdvMRAwDgYDVQQLEwdleGFtcGxlMSEwHwYD
VQQDExhleGFtcGxlLW5hbWUtY29uc3RyYWludHMwggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQDkrrryvC1a63Vc2yCBb0SliieU6TnqZAQ5rJzAa4zf7uq9
obwLuGfZV5j/7nYl04M2gPiz4Rk8uia14tIqBjFjB5DH7czuaPiGKgMSKMXt9lPZ
xu3ZnRLRmF+I/zlIjxqLU9bxem7Qs7RBoncbbd65gy8PPe2J09rJdrcj5V/hD2jZ
pNWtrYA6ANGsMSxLchtpn3LKyDy/bW2HIhXmqVIq/2j2p2ljKf6E63L4S7e7FW8E
MGiW9y+DLO5U7qSZUiqgAiXHjTKWtYgbnlqboPtZRV5quN2PE0KD3FOLhAQX5MKS
3P48+cjeswmruNVc8qjdCi1NLsRCTHukM/WxAC35AgMBAAGjgY4wgYswDgYDVR0P
AQH/BAQDAgIEMBIGA1UdEwEB/wQIMAYBAf8CAQAwZQYDVR0eBF4wXKAsMA6CDC5l
eGFtcGxlLmNvbTAKhwjAqAAA//8AADAOgQwuZXhhbXBsZS5jb22hLDAOggwuZXhh
bXBsZS5vcmcwCocICgoAAP//AAAwDoEMLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEB
CwUAA4IBAQBDxhzTZc0fB7B2EvHmzz45J3xgk/aQksKFXeWxyX7UdgSY+gzABRMk
txHCMZtdTJxi4BACpRlO4QMbJXSiofhGJQb+ThSvM1CQv+W5X4j7/40RBfRnWbQP
ZGfxSyGhLYAIzUsHi6X7DbJmzV2EixPbYKCJ+5Vlf7IH0aDexzf4xKLQdy+cWy1g
Y4bHiiQbVqfTjlzdsMuiFqoZe3/NhOP93XSMZErx6pJ/lrWiO+6ytM3gdwh1y0DE
tFmaBKzI+2uQwt6DHQuPmOSEmI7NcrVS2WhPVPa7fIY/ExUy7jqIr2qM59eSl7OC
AhzgLtgqfwLgbj5PWZENYlNRXmZGi4GD
-----END CERTIFICATE-----
test-certs/example-name-constraints.csr
+17
View File
@@ -0,0 +1,17 @@
-----BEGIN CERTIFICATE REQUEST-----
MIICpjCCAY4CAQAwYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRAwDgYDVQQK
EwdjZXJ0aWdvMRAwDgYDVQQLEwdleGFtcGxlMSEwHwYDVQQDExhleGFtcGxlLW5h
bWUtY29uc3RyYWludHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDk
rrryvC1a63Vc2yCBb0SliieU6TnqZAQ5rJzAa4zf7uq9obwLuGfZV5j/7nYl04M2
gPiz4Rk8uia14tIqBjFjB5DH7czuaPiGKgMSKMXt9lPZxu3ZnRLRmF+I/zlIjxqL
U9bxem7Qs7RBoncbbd65gy8PPe2J09rJdrcj5V/hD2jZpNWtrYA6ANGsMSxLchtp
n3LKyDy/bW2HIhXmqVIq/2j2p2ljKf6E63L4S7e7FW8EMGiW9y+DLO5U7qSZUiqg
AiXHjTKWtYgbnlqboPtZRV5quN2PE0KD3FOLhAQX5MKS3P48+cjeswmruNVc8qjd
Ci1NLsRCTHukM/WxAC35AgMBAAGgADANBgkqhkiG9w0BAQUFAAOCAQEAf486fgU4
srGDTypLMY/rBBf/Y8Dhp+O/bEeHEDbSCBM4k8/WwsQvgZqwkvzQ6xW8HAXBWDe6
r0swDFc4wkKPpwQBhAu6JT8FxozCfbsGT9ITBESWZnphs5bXJmhcXFOjNa78jSPX
uygXlQZB+vKmpURZYehg/sLBFTUslOtrM/PTC40KZfLP6CgRiMASQbZyKcKudHJi
sSiyK3FLCeMoIEDiDAT7CdTH6VKRwgIH9S/D2ZtuNAm0rS2HjRjH3HOYPJy5S2Gl
V8k1LPiCcMc2eDhSkbESvn4MLORHGQdm+bonduG2xn+Mm1WZGF5sVcJ4u13oG06S
WcVAIB7TSGAoDw==
-----END CERTIFICATE REQUEST-----
test-certs/example-name-constraints.jceks
BIN
View File
Binary file not shown.
test-certs/example-name-constraints.p12
BIN
View File
Binary file not shown.
test-certs/example-name-constraints.p7b
+24
View File
@@ -0,0 +1,24 @@
-----BEGIN PKCS7-----
MIIEBQYJKoZIhvcNAQcCoIID9jCCA/ICAQExADALBgkqhkiG9w0BBwGgggPYMIID
1DCCArygAwIBAgIJAL8xOGAOaSzBMA0GCSqGSIb3DQEBCwUAMGExCzAJBgNVBAYT
AlVTMQswCQYDVQQIEwJDQTEQMA4GA1UEChMHY2VydGlnbzEQMA4GA1UECxMHZXhh
bXBsZTEhMB8GA1UEAxMYZXhhbXBsZS1uYW1lLWNvbnN0cmFpbnRzMB4XDTE3MDgx
ODE5NDg1MFoXDTI0MDYyMjE5NDg1MFowYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgT
AkNBMRAwDgYDVQQKEwdjZXJ0aWdvMRAwDgYDVQQLEwdleGFtcGxlMSEwHwYDVQQD
ExhleGFtcGxlLW5hbWUtY29uc3RyYWludHMwggEiMA0GCSqGSIb3DQEBAQUAA4IB
DwAwggEKAoIBAQDkrrryvC1a63Vc2yCBb0SliieU6TnqZAQ5rJzAa4zf7uq9obwL
uGfZV5j/7nYl04M2gPiz4Rk8uia14tIqBjFjB5DH7czuaPiGKgMSKMXt9lPZxu3Z
nRLRmF+I/zlIjxqLU9bxem7Qs7RBoncbbd65gy8PPe2J09rJdrcj5V/hD2jZpNWt
rYA6ANGsMSxLchtpn3LKyDy/bW2HIhXmqVIq/2j2p2ljKf6E63L4S7e7FW8EMGiW
9y+DLO5U7qSZUiqgAiXHjTKWtYgbnlqboPtZRV5quN2PE0KD3FOLhAQX5MKS3P48
+cjeswmruNVc8qjdCi1NLsRCTHukM/WxAC35AgMBAAGjgY4wgYswDgYDVR0PAQH/
BAQDAgIEMBIGA1UdEwEB/wQIMAYBAf8CAQAwZQYDVR0eBF4wXKAsMA6CDC5leGFt
cGxlLmNvbTAKhwjAqAAA//8AADAOgQwuZXhhbXBsZS5jb22hLDAOggwuZXhhbXBs
ZS5vcmcwCocICgoAAP//AAAwDoEMLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUA
A4IBAQBDxhzTZc0fB7B2EvHmzz45J3xgk/aQksKFXeWxyX7UdgSY+gzABRMktxHC
MZtdTJxi4BACpRlO4QMbJXSiofhGJQb+ThSvM1CQv+W5X4j7/40RBfRnWbQPZGfx
SyGhLYAIzUsHi6X7DbJmzV2EixPbYKCJ+5Vlf7IH0aDexzf4xKLQdy+cWy1gY4bH
iiQbVqfTjlzdsMuiFqoZe3/NhOP93XSMZErx6pJ/lrWiO+6ytM3gdwh1y0DEtFma
BKzI+2uQwt6DHQuPmOSEmI7NcrVS2WhPVPa7fIY/ExUy7jqIr2qM59eSl7OCAhzg
LtgqfwLgbj5PWZENYlNRXmZGi4GDoQAxAA==
-----END PKCS7-----
test-certs/openssl.ext
+4
View File
@@ -7,3 +7,7 @@ subjectAltName = IP:127.0.0.1,IP:::1,DNS:localhost
[root_bad]
keyUsage=critical, cRLSign
basicConstraints=critical, CA:TRUE, pathlen:0
[root_with_constraints]
keyUsage=critical, keyCertSign
basicConstraints=critical, CA:TRUE, pathlen:0
nameConstraints=permitted;DNS:.example.com,permitted;IP:192.168.0.0/255.255.0.0,permitted;email:.example.com,excluded;DNS:.example.org,excluded;IP:10.10.0.0/255.255.0.0,excluded;email:.example.org
tests/dump-name-constraints-to-text.t
+56
View File
@@ -0,0 +1,56 @@
Set up test data.
$ cat > example-name-constraints.crt <<EOF
> -----BEGIN CERTIFICATE-----
> MIID1DCCArygAwIBAgIJAL8xOGAOaSzBMA0GCSqGSIb3DQEBCwUAMGExCzAJBgNV
> BAYTAlVTMQswCQYDVQQIEwJDQTEQMA4GA1UEChMHY2VydGlnbzEQMA4GA1UECxMH
> ZXhhbXBsZTEhMB8GA1UEAxMYZXhhbXBsZS1uYW1lLWNvbnN0cmFpbnRzMB4XDTE3
> MDgxODE5NDg1MFoXDTI0MDYyMjE5NDg1MFowYTELMAkGA1UEBhMCVVMxCzAJBgNV
> BAgTAkNBMRAwDgYDVQQKEwdjZXJ0aWdvMRAwDgYDVQQLEwdleGFtcGxlMSEwHwYD
> VQQDExhleGFtcGxlLW5hbWUtY29uc3RyYWludHMwggEiMA0GCSqGSIb3DQEBAQUA
> A4IBDwAwggEKAoIBAQDkrrryvC1a63Vc2yCBb0SliieU6TnqZAQ5rJzAa4zf7uq9
> obwLuGfZV5j/7nYl04M2gPiz4Rk8uia14tIqBjFjB5DH7czuaPiGKgMSKMXt9lPZ
> xu3ZnRLRmF+I/zlIjxqLU9bxem7Qs7RBoncbbd65gy8PPe2J09rJdrcj5V/hD2jZ
> pNWtrYA6ANGsMSxLchtpn3LKyDy/bW2HIhXmqVIq/2j2p2ljKf6E63L4S7e7FW8E
> MGiW9y+DLO5U7qSZUiqgAiXHjTKWtYgbnlqboPtZRV5quN2PE0KD3FOLhAQX5MKS
> 3P48+cjeswmruNVc8qjdCi1NLsRCTHukM/WxAC35AgMBAAGjgY4wgYswDgYDVR0P
> AQH/BAQDAgIEMBIGA1UdEwEB/wQIMAYBAf8CAQAwZQYDVR0eBF4wXKAsMA6CDC5l
> eGFtcGxlLmNvbTAKhwjAqAAA//8AADAOgQwuZXhhbXBsZS5jb22hLDAOggwuZXhh
> bXBsZS5vcmcwCocICgoAAP//AAAwDoEMLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEB
> CwUAA4IBAQBDxhzTZc0fB7B2EvHmzz45J3xgk/aQksKFXeWxyX7UdgSY+gzABRMk
> txHCMZtdTJxi4BACpRlO4QMbJXSiofhGJQb+ThSvM1CQv+W5X4j7/40RBfRnWbQP
> ZGfxSyGhLYAIzUsHi6X7DbJmzV2EixPbYKCJ+5Vlf7IH0aDexzf4xKLQdy+cWy1g
> Y4bHiiQbVqfTjlzdsMuiFqoZe3/NhOP93XSMZErx6pJ/lrWiO+6ytM3gdwh1y0DE
> tFmaBKzI+2uQwt6DHQuPmOSEmI7NcrVS2WhPVPa7fIY/ExUy7jqIr2qM59eSl7OC
> AhzgLtgqfwLgbj5PWZENYlNRXmZGi4GD
> -----END CERTIFICATE-----
> EOF
Dump an example certificate with name constraints (example-name-constraints.crt)
$ certigo --verbose dump example-name-constraints.crt
** CERTIFICATE 1 **
Serial: 13776854720312847553
Valid: 2017-08-18 19:48 UTC to 2024-06-22 19:48 UTC
Signature: SHA256-RSA (self-signed)
Subject Info:
\tCountry: US (esc)
\tProvince: CA (esc)
\tOrganization: certigo (esc)
\tOrganizational Unit: example (esc)
\tCommonName: example-name-constraints (esc)
Issuer Info:
\tCountry: US (esc)
\tProvince: CA (esc)
\tOrganization: certigo (esc)
\tOrganizational Unit: example (esc)
\tCommonName: example-name-constraints (esc)
Basic Constraints: CA:true, pathlen:0
DNS Name Constraints:
Permitted:
\t.example.com (esc)
Excluded:
\t.example.org (esc)
Key Usage:
\tCert Sign (esc)