diff --git a/.travis.yml b/.travis.yml index 207116c..e375f43 100644 --- a/.travis.yml +++ b/.travis.yml @@ -3,7 +3,7 @@ language: go go: - - 1.8 + - 1.9 install: - go get github.com/Masterminds/glide @@ -33,4 +33,4 @@ deploy: on: repo: square/certigo tags: true - go: 1.8 + go: 1.9 diff --git a/README.md b/README.md index 4060581..ef17141 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ On macOS you can also use homebrew to install: brew install certigo -Note that certigo requires Go 1.8 or later to build. +Note that certigo requires Go 1.9 or later to build. ### Develop diff --git a/lib/display.go b/lib/display.go index bc2b25b..23b7b1c 100644 --- a/lib/display.go +++ b/lib/display.go @@ -48,30 +48,57 @@ Subject Info: Issuer Info: {{- template "PkixName" .Issuer.Name}} {{- if .Subject.KeyID}} -Subject Key ID: {{.Subject.KeyID | hexify}}{{end}}{{if .Issuer.KeyID}} -Authority Key ID: {{.Issuer.KeyID | hexify}}{{end}}{{if .BasicConstraints}} -Basic Constraints: CA:{{.BasicConstraints.IsCA}}{{if .BasicConstraints.MaxPathLen}}, pathlen:{{.BasicConstraints.MaxPathLen}}{{end}}{{end}}{{if .NameConstraints}} -Name Constraints {{if .PermittedDNSDomains.Critical}}(critical){{end}}: {{range .NameConstraints.PermittedDNSDomains}} - {{.}}{{end}}{{end}}{{if .KeyUsage}} -Key Usage:{{range .KeyUsage | keyUsage}} - {{.}}{{end}}{{end}}{{if .ExtKeyUsage}} -Extended Key Usage:{{range .ExtKeyUsage}} - {{. | extKeyUsage}}{{end}}{{end}} +Subject Key ID: {{.Subject.KeyID | hexify}} +{{- end}} +{{- if .Issuer.KeyID}} +Authority Key ID: {{.Issuer.KeyID | hexify}} +{{- end}} +{{- if .BasicConstraints}} +Basic Constraints: CA:{{.BasicConstraints.IsCA}}{{if .BasicConstraints.MaxPathLen}}, pathlen:{{.BasicConstraints.MaxPathLen}}{{end}}{{end}} +{{- if .NameConstraints}} +DNS Name Constraints{{if .NameConstraints.Critical}} (critical){{end}}: +{{- if .NameConstraints.PermittedDNSDomains}} +Permitted: + {{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedDNSDomains)}} +{{- end}} +{{- if .NameConstraints.ExcludedDNSDomains}} +Excluded: + {{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedDNSDomains)}} +{{- end}} +{{- end}} +{{- if .KeyUsage}} +Key Usage: +{{- range .KeyUsage | keyUsage}} + {{.}} +{{- end}} +{{- end}} +{{- if .ExtKeyUsage}} +Extended Key Usage: +{{- range .ExtKeyUsage}} + {{. | extKeyUsage}}{{end}} +{{- end}} {{- if .AltDNSNames}} DNS Names: - {{wrapWith .Width "\n\t" (join ", " .AltDNSNames)}}{{end}} + {{wrapWith .Width "\n\t" (join ", " .AltDNSNames)}} +{{- end}} {{- if .AltIPAddresses}} IP Addresses: - {{wrapWith .Width "\n\t" (join ", " .AltIPAddresses)}}{{end}} + {{wrapWith .Width "\n\t" (join ", " .AltIPAddresses)}} +{{- end}} {{- if .URINames}} URI Names: - {{wrapWith .Width "\n\t" (join ", " .URINames)}}{{end}} + {{wrapWith .Width "\n\t" (join ", " .URINames)}} +{{- end}} {{- if .EmailAddresses}} Email Addresses: - {{wrapWith .Width "\n\t" (join ", " .EmailAddresses)}}{{end}} + {{wrapWith .Width "\n\t" (join ", " .EmailAddresses)}} +{{- end}} {{- if .Warnings}} -Warnings:{{range .Warnings}} - {{. | redify}}{{end}}{{end}}` +Warnings: +{{- range .Warnings}} + {{. | redify}} +{{- end}} +{{- end}}` var layout = ` {{- if .Alias}}{{.Alias}} @@ -280,6 +307,7 @@ func greenify(text string) string { return green.SprintfFunc()("%s", text) } +// PrintShortName turns a pkix.Name into a string of RDN tuples. func PrintShortName(name pkix.Name) (out string) { // Try to print CN for short name if present. if name.CommonName != "" { diff --git a/lib/encoder.go b/lib/encoder.go index d80b77b..63f0a03 100644 --- a/lib/encoder.go +++ b/lib/encoder.go @@ -173,6 +173,7 @@ type basicConstraints struct { type nameConstraints struct { Critical bool `json:"critical,omitempty"` PermittedDNSDomains []string `json:"permitted_dns_domains,omitempty"` + ExcludedDNSDomains []string `json:"excluded_dns_domains,omitempty"` } // simpleCertificate is a JSON-representable certificate metadata holder. @@ -249,10 +250,11 @@ func createSimpleCertificate(name string, cert *x509.Certificate) simpleCertific } } - if len(cert.PermittedDNSDomains) > 0 { + if len(cert.PermittedDNSDomains) > 0 || len(cert.ExcludedDNSDomains) > 0 { out.NameConstraints = &nameConstraints{ Critical: cert.PermittedDNSDomainsCritical, PermittedDNSDomains: cert.PermittedDNSDomains, + ExcludedDNSDomains: cert.ExcludedDNSDomains, } } diff --git a/test-certs/Makefile b/test-certs/Makefile index 854235e..8909f1e 100644 --- a/test-certs/Makefile +++ b/test-certs/Makefile @@ -1,7 +1,7 @@ TARGETS = \ example-root example-leaf example-sha1 example-md5 example-root-bad-ku \ example-bad-serial example-small-key example-expired example-elliptic-sha1 \ - example-custom-oid + example-custom-oid example-name-constraints all: \ $(addsuffix .crt,$(TARGETS)) \ @@ -80,3 +80,6 @@ example-custom-oid.csr: example-custom-oid.key example-custom-oid.crt: example-custom-oid.csr openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions leaf + +example-name-constraints.crt: example-name-constraints.csr + openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions root_with_constraints diff --git a/test-certs/example-custom-oid.crt b/test-certs/example-custom-oid.crt new file mode 100644 index 0000000..e9bd80e --- /dev/null +++ b/test-certs/example-custom-oid.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDPDCCAiSgAwIBAgIJAMnEiF0KGVsZMA0GCSqGSIb3DQEBCwUAMDUxHDAaBgNV +BAMME2V4YW1wbGUtY3VzdG9tLW9pZHMxFTATBggrBgEEAYKgMgwHZXhhbXBsZTAe +Fw0xNzA4MTgxOTQyMDZaFw0yNDA2MjIxOTQyMDZaMDUxHDAaBgNVBAMME2V4YW1w +bGUtY3VzdG9tLW9pZHMxFTATBggrBgEEAYKgMgwHZXhhbXBsZTCCASIwDQYJKoZI +hvcNAQEBBQADggEPADCCAQoCggEBAMcjcsRRkqeVQxzhzKTgdt29XnihRrNRnsa2 +o2KVZGQOcavJGkosjD1xG9/I8m4dr04h/2Mc06g6VH65wWWJ5UKceBks00/ftFcG +9I5iorXf5WQQPM73y9zYtmJtE6WUBh6f0MmlTr76g4mI26zfliWsubrB1MRQ8RTD +9TY8lgk/UCmT63YryrYBTEMwgqAZInN95ir0n4vt53ee6JfNwSYIyLxGRZFYOEeP +30hlntw1vN+q1kyTsY/xSA4BnD8tXliJ0AR5he+wmExrrlTDKxp1fm63ODOBZQVJ +0L/LMvEul2Qa3xtWdp6WB5LygmTOC1DpipqRhhQAgJb5qwaJSGMCAwEAAaNPME0w +HQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMCwGA1UdEQQlMCOHBH8AAAGH +EAAAAAAAAAAAAAAAAAAAAAGCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAQEA +Tglf3JyqYQXGA7cftxoNh8ZHbKlGwZ/V7qGPunhY+3lUdcU9nMrGJkHfhtHjbxwy +Mp8Xin+oJWxvQC74MhwN4eYmbgxoeIhnWpwycuLC748/dEF3G+lbzPoBDGC7oaLd +Bdy4ChAAPGu47fQrkxCJP9TTYWrTcrgo7rioB+7v7Hu68nW3qp5hlcBOpI5f8SIm +2RKJMZDkavUrwQx/wRWqG5lrn7mRVNNJ1hO//NrfrcobtGdKCSH9uoNTCYvBtcAT +j+MGqfv1mmYaTzS3RGBd3w14bWxR9qBuFB5GccgPMzW6hMaIhGM5+qjdQ0GnOgnz +n2g4qtGeN+uglDfulWZ7lA== +-----END CERTIFICATE----- diff --git a/test-certs/example-custom-oid.csr b/test-certs/example-custom-oid.csr new file mode 100644 index 0000000..9a9e03d --- /dev/null +++ b/test-certs/example-custom-oid.csr @@ -0,0 +1,16 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIICejCCAWICAQAwNTEcMBoGA1UEAwwTZXhhbXBsZS1jdXN0b20tb2lkczEVMBMG +CCsGAQQBgqAyDAdleGFtcGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC +AQEAxyNyxFGSp5VDHOHMpOB23b1eeKFGs1GexrajYpVkZA5xq8kaSiyMPXEb38jy +bh2vTiH/YxzTqDpUfrnBZYnlQpx4GSzTT9+0Vwb0jmKitd/lZBA8zvfL3Ni2Ym0T +pZQGHp/QyaVOvvqDiYjbrN+WJay5usHUxFDxFMP1NjyWCT9QKZPrdivKtgFMQzCC +oBkic33mKvSfi+3nd57ol83BJgjIvEZFkVg4R4/fSGWe3DW836rWTJOxj/FIDgGc +Py1eWInQBHmF77CYTGuuVMMrGnV+brc4M4FlBUnQv8sy8S6XZBrfG1Z2npYHkvKC +ZM4LUOmKmpGGFACAlvmrBolIYwIDAQABoAAwDQYJKoZIhvcNAQEFBQADggEBAFqr +qQK9/gLAxBxUfny7cCN+NFBb11HJx8HerLKqBGN4VOh27SkJGg6H5ozj/qwhElVw +SQUX33TigC6roiPDK3+KvL9fxjUY60xnLRXKciMm/1jqeYjht33hQMZAi4OwT+dG +FFVys2zlSFXxqX79+6mkKUIRurymnJWjOHNWOhrDckShDjf5N+A3lUNWgwu7M0cX +T5Bv/6AFV4vuMJALv4JTBC60bT+cfXmYxCox+5rZ+bT+6uOFWu+0H4CPXfP9OU5B +/aA20r2bN16TftaLPY9HSJNPXqlZHX196e6+oqd16Rr6AyYAvGlKmpJgpm5OS17r +7yMFrPWSWlsOmIhxhXs= +-----END CERTIFICATE REQUEST----- diff --git a/test-certs/example-custom-oid.jceks b/test-certs/example-custom-oid.jceks new file mode 100644 index 0000000..6ccf8ef Binary files /dev/null and b/test-certs/example-custom-oid.jceks differ diff --git a/test-certs/example-custom-oid.key b/test-certs/example-custom-oid.key new file mode 100644 index 0000000..42586b3 --- /dev/null +++ b/test-certs/example-custom-oid.key @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEAxyNyxFGSp5VDHOHMpOB23b1eeKFGs1GexrajYpVkZA5xq8ka +SiyMPXEb38jybh2vTiH/YxzTqDpUfrnBZYnlQpx4GSzTT9+0Vwb0jmKitd/lZBA8 +zvfL3Ni2Ym0TpZQGHp/QyaVOvvqDiYjbrN+WJay5usHUxFDxFMP1NjyWCT9QKZPr +divKtgFMQzCCoBkic33mKvSfi+3nd57ol83BJgjIvEZFkVg4R4/fSGWe3DW836rW +TJOxj/FIDgGcPy1eWInQBHmF77CYTGuuVMMrGnV+brc4M4FlBUnQv8sy8S6XZBrf +G1Z2npYHkvKCZM4LUOmKmpGGFACAlvmrBolIYwIDAQABAoIBAFbQmmkB0viiNtbx +jYDXppp2wye9z4+/ZoPk/Yet7007iszEaGSr1Ru4ItnFxgLBiDp80dTIrXFqtIlm +u+xjWIJYqnb3Nsxcj0ddbeJhF+RITr334jqshsCp7aEtQmJuDNju/VvbaGAT4KJl ++rb75n5YNcQ4WmSXkPJnl5Bki1hN75zjlnVlD+FV+/j0hz2Kg7mAQkJqbLn7Cd/4 +398qYABak0aAA2ZH2DeybZsZGstka2yIypQsJVQNYvxWcxCNweWMOljRPfxX50Oa +ZIuuO70VQlXmIZYHruvqpImEOSWQtiVm2lTR+jVR6wof/oWOWkYqefoAQdLJy1ud +FgEFUXkCgYEA7sSMOVM6pvz+ALz3aKFCqUYe+yA3HBkCUDF8ESVNnl9OMQB5mXRg +J6kxr8z/Pu8P8J9Np87hBZPSJe7rFavfhjgxJ1rnrg73Btq4+TZ85qby3H57Ybnm +SVohAWOQfEaPt9wD4AIy8p/tKBaWoNnBwuYBux52WX0iO2nZIgTA+W0CgYEA1YK2 +k55Rfo6WfUWCK3CyR+6kGfphxPY3GWkuckTh3M8cQvFzQEZ6p4eBPBxxZ9VtogXR +CP5AXzHZYNhH9s9djmiZh/m0MHGKILQD3feD0dtypySQ0gCh+NOCxAProB2gDK5C +kCOJ5x45nujiPcz8mqq/qvWBQjEaOunL8ivNdw8CgYBS8Ek5PHT6PpVI0lsqqCGM +xUPLvcQG6ZUJIDdViVyt77MsiFq0+FzSSg5tX8smJEqoLd3+tXkqw89Sx+w3Ke3K +JMjGP+iMaLxcUCvCva+jO0jPWMwpBTc+MaWXYut0j9oqZq2d6YWjC/SIYVhPZXTN +67GcOxenPDVg6AK5s2cI/QKBgQCD5C8smUv2Rdaoo9t5QjCfRseQVJ84sG/w/ox2 +gh6T7Eyk/coYFnGGM6qdm2Rio/EJeVZbm9Pf+kcyD+jEiexdIDhXSuUIV9rfwNPy +tgd0B3+XyHq9fy6PKvlIZLOVQTexHaR4rbtuTbmCdJHtY0dXs8qarPWgEf0GD46w +lmZh+QKBgQDPPfnORduMYFTLmcqHBDIyK4X4Y4bZfsEJkoyRbPRP2YSTuliFzuUe +qBDOPcy9JcDg+jAmTmPeaEKK3Ad516QpS4uk7u0n5AE3UTdiC7ICs4+VmGWOO2T4 +mQP1CdSxBEsYap5ZT1szVwRllInSHLqCeKDSI6LD+0AzA2biBaRmaw== +-----END RSA PRIVATE KEY----- diff --git a/test-certs/example-custom-oid.p12 b/test-certs/example-custom-oid.p12 new file mode 100644 index 0000000..47e5775 Binary files /dev/null and b/test-certs/example-custom-oid.p12 differ diff --git a/test-certs/example-custom-oid.p7b b/test-certs/example-custom-oid.p7b new file mode 100644 index 0000000..0880af8 --- /dev/null +++ b/test-certs/example-custom-oid.p7b @@ -0,0 +1,21 @@ +-----BEGIN PKCS7----- +MIIDbQYJKoZIhvcNAQcCoIIDXjCCA1oCAQExADALBgkqhkiG9w0BBwGgggNAMIID +PDCCAiSgAwIBAgIJAMnEiF0KGVsZMA0GCSqGSIb3DQEBCwUAMDUxHDAaBgNVBAMM +E2V4YW1wbGUtY3VzdG9tLW9pZHMxFTATBggrBgEEAYKgMgwHZXhhbXBsZTAeFw0x +NzA4MTgxOTQyMDZaFw0yNDA2MjIxOTQyMDZaMDUxHDAaBgNVBAMME2V4YW1wbGUt +Y3VzdG9tLW9pZHMxFTATBggrBgEEAYKgMgwHZXhhbXBsZTCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBAMcjcsRRkqeVQxzhzKTgdt29XnihRrNRnsa2o2KV +ZGQOcavJGkosjD1xG9/I8m4dr04h/2Mc06g6VH65wWWJ5UKceBks00/ftFcG9I5i +orXf5WQQPM73y9zYtmJtE6WUBh6f0MmlTr76g4mI26zfliWsubrB1MRQ8RTD9TY8 +lgk/UCmT63YryrYBTEMwgqAZInN95ir0n4vt53ee6JfNwSYIyLxGRZFYOEeP30hl +ntw1vN+q1kyTsY/xSA4BnD8tXliJ0AR5he+wmExrrlTDKxp1fm63ODOBZQVJ0L/L +MvEul2Qa3xtWdp6WB5LygmTOC1DpipqRhhQAgJb5qwaJSGMCAwEAAaNPME0wHQYD +VR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMCwGA1UdEQQlMCOHBH8AAAGHEAAA +AAAAAAAAAAAAAAAAAAGCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAQEATglf +3JyqYQXGA7cftxoNh8ZHbKlGwZ/V7qGPunhY+3lUdcU9nMrGJkHfhtHjbxwyMp8X +in+oJWxvQC74MhwN4eYmbgxoeIhnWpwycuLC748/dEF3G+lbzPoBDGC7oaLdBdy4 +ChAAPGu47fQrkxCJP9TTYWrTcrgo7rioB+7v7Hu68nW3qp5hlcBOpI5f8SIm2RKJ +MZDkavUrwQx/wRWqG5lrn7mRVNNJ1hO//NrfrcobtGdKCSH9uoNTCYvBtcATj+MG +qfv1mmYaTzS3RGBd3w14bWxR9qBuFB5GccgPMzW6hMaIhGM5+qjdQ0GnOgnzn2g4 +qtGeN+uglDfulWZ7lKEAMQA= +-----END PKCS7----- diff --git a/test-certs/example-name-constraints.crt b/test-certs/example-name-constraints.crt new file mode 100644 index 0000000..cbff43a --- /dev/null +++ b/test-certs/example-name-constraints.crt @@ -0,0 +1,23 @@ +-----BEGIN CERTIFICATE----- +MIID1DCCArygAwIBAgIJAL8xOGAOaSzBMA0GCSqGSIb3DQEBCwUAMGExCzAJBgNV +BAYTAlVTMQswCQYDVQQIEwJDQTEQMA4GA1UEChMHY2VydGlnbzEQMA4GA1UECxMH +ZXhhbXBsZTEhMB8GA1UEAxMYZXhhbXBsZS1uYW1lLWNvbnN0cmFpbnRzMB4XDTE3 +MDgxODE5NDg1MFoXDTI0MDYyMjE5NDg1MFowYTELMAkGA1UEBhMCVVMxCzAJBgNV +BAgTAkNBMRAwDgYDVQQKEwdjZXJ0aWdvMRAwDgYDVQQLEwdleGFtcGxlMSEwHwYD +VQQDExhleGFtcGxlLW5hbWUtY29uc3RyYWludHMwggEiMA0GCSqGSIb3DQEBAQUA +A4IBDwAwggEKAoIBAQDkrrryvC1a63Vc2yCBb0SliieU6TnqZAQ5rJzAa4zf7uq9 +obwLuGfZV5j/7nYl04M2gPiz4Rk8uia14tIqBjFjB5DH7czuaPiGKgMSKMXt9lPZ +xu3ZnRLRmF+I/zlIjxqLU9bxem7Qs7RBoncbbd65gy8PPe2J09rJdrcj5V/hD2jZ +pNWtrYA6ANGsMSxLchtpn3LKyDy/bW2HIhXmqVIq/2j2p2ljKf6E63L4S7e7FW8E +MGiW9y+DLO5U7qSZUiqgAiXHjTKWtYgbnlqboPtZRV5quN2PE0KD3FOLhAQX5MKS +3P48+cjeswmruNVc8qjdCi1NLsRCTHukM/WxAC35AgMBAAGjgY4wgYswDgYDVR0P +AQH/BAQDAgIEMBIGA1UdEwEB/wQIMAYBAf8CAQAwZQYDVR0eBF4wXKAsMA6CDC5l +eGFtcGxlLmNvbTAKhwjAqAAA//8AADAOgQwuZXhhbXBsZS5jb22hLDAOggwuZXhh +bXBsZS5vcmcwCocICgoAAP//AAAwDoEMLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEB +CwUAA4IBAQBDxhzTZc0fB7B2EvHmzz45J3xgk/aQksKFXeWxyX7UdgSY+gzABRMk +txHCMZtdTJxi4BACpRlO4QMbJXSiofhGJQb+ThSvM1CQv+W5X4j7/40RBfRnWbQP +ZGfxSyGhLYAIzUsHi6X7DbJmzV2EixPbYKCJ+5Vlf7IH0aDexzf4xKLQdy+cWy1g +Y4bHiiQbVqfTjlzdsMuiFqoZe3/NhOP93XSMZErx6pJ/lrWiO+6ytM3gdwh1y0DE +tFmaBKzI+2uQwt6DHQuPmOSEmI7NcrVS2WhPVPa7fIY/ExUy7jqIr2qM59eSl7OC +AhzgLtgqfwLgbj5PWZENYlNRXmZGi4GD +-----END CERTIFICATE----- diff --git a/test-certs/example-name-constraints.csr b/test-certs/example-name-constraints.csr new file mode 100644 index 0000000..678c951 --- /dev/null +++ b/test-certs/example-name-constraints.csr @@ -0,0 +1,17 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIICpjCCAY4CAQAwYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRAwDgYDVQQK +EwdjZXJ0aWdvMRAwDgYDVQQLEwdleGFtcGxlMSEwHwYDVQQDExhleGFtcGxlLW5h +bWUtY29uc3RyYWludHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDk +rrryvC1a63Vc2yCBb0SliieU6TnqZAQ5rJzAa4zf7uq9obwLuGfZV5j/7nYl04M2 +gPiz4Rk8uia14tIqBjFjB5DH7czuaPiGKgMSKMXt9lPZxu3ZnRLRmF+I/zlIjxqL +U9bxem7Qs7RBoncbbd65gy8PPe2J09rJdrcj5V/hD2jZpNWtrYA6ANGsMSxLchtp +n3LKyDy/bW2HIhXmqVIq/2j2p2ljKf6E63L4S7e7FW8EMGiW9y+DLO5U7qSZUiqg +AiXHjTKWtYgbnlqboPtZRV5quN2PE0KD3FOLhAQX5MKS3P48+cjeswmruNVc8qjd +Ci1NLsRCTHukM/WxAC35AgMBAAGgADANBgkqhkiG9w0BAQUFAAOCAQEAf486fgU4 +srGDTypLMY/rBBf/Y8Dhp+O/bEeHEDbSCBM4k8/WwsQvgZqwkvzQ6xW8HAXBWDe6 +r0swDFc4wkKPpwQBhAu6JT8FxozCfbsGT9ITBESWZnphs5bXJmhcXFOjNa78jSPX +uygXlQZB+vKmpURZYehg/sLBFTUslOtrM/PTC40KZfLP6CgRiMASQbZyKcKudHJi +sSiyK3FLCeMoIEDiDAT7CdTH6VKRwgIH9S/D2ZtuNAm0rS2HjRjH3HOYPJy5S2Gl +V8k1LPiCcMc2eDhSkbESvn4MLORHGQdm+bonduG2xn+Mm1WZGF5sVcJ4u13oG06S +WcVAIB7TSGAoDw== +-----END CERTIFICATE REQUEST----- diff --git a/test-certs/example-name-constraints.jceks b/test-certs/example-name-constraints.jceks new file mode 100644 index 0000000..498f74e Binary files /dev/null and b/test-certs/example-name-constraints.jceks differ diff --git a/test-certs/example-name-constraints.p12 b/test-certs/example-name-constraints.p12 new file mode 100644 index 0000000..b18527e Binary files /dev/null and b/test-certs/example-name-constraints.p12 differ diff --git a/test-certs/example-name-constraints.p7b b/test-certs/example-name-constraints.p7b new file mode 100644 index 0000000..5f047d5 --- /dev/null +++ b/test-certs/example-name-constraints.p7b @@ -0,0 +1,24 @@ +-----BEGIN PKCS7----- +MIIEBQYJKoZIhvcNAQcCoIID9jCCA/ICAQExADALBgkqhkiG9w0BBwGgggPYMIID +1DCCArygAwIBAgIJAL8xOGAOaSzBMA0GCSqGSIb3DQEBCwUAMGExCzAJBgNVBAYT +AlVTMQswCQYDVQQIEwJDQTEQMA4GA1UEChMHY2VydGlnbzEQMA4GA1UECxMHZXhh +bXBsZTEhMB8GA1UEAxMYZXhhbXBsZS1uYW1lLWNvbnN0cmFpbnRzMB4XDTE3MDgx +ODE5NDg1MFoXDTI0MDYyMjE5NDg1MFowYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgT +AkNBMRAwDgYDVQQKEwdjZXJ0aWdvMRAwDgYDVQQLEwdleGFtcGxlMSEwHwYDVQQD +ExhleGFtcGxlLW5hbWUtY29uc3RyYWludHMwggEiMA0GCSqGSIb3DQEBAQUAA4IB +DwAwggEKAoIBAQDkrrryvC1a63Vc2yCBb0SliieU6TnqZAQ5rJzAa4zf7uq9obwL +uGfZV5j/7nYl04M2gPiz4Rk8uia14tIqBjFjB5DH7czuaPiGKgMSKMXt9lPZxu3Z +nRLRmF+I/zlIjxqLU9bxem7Qs7RBoncbbd65gy8PPe2J09rJdrcj5V/hD2jZpNWt +rYA6ANGsMSxLchtpn3LKyDy/bW2HIhXmqVIq/2j2p2ljKf6E63L4S7e7FW8EMGiW +9y+DLO5U7qSZUiqgAiXHjTKWtYgbnlqboPtZRV5quN2PE0KD3FOLhAQX5MKS3P48 ++cjeswmruNVc8qjdCi1NLsRCTHukM/WxAC35AgMBAAGjgY4wgYswDgYDVR0PAQH/ +BAQDAgIEMBIGA1UdEwEB/wQIMAYBAf8CAQAwZQYDVR0eBF4wXKAsMA6CDC5leGFt +cGxlLmNvbTAKhwjAqAAA//8AADAOgQwuZXhhbXBsZS5jb22hLDAOggwuZXhhbXBs +ZS5vcmcwCocICgoAAP//AAAwDoEMLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUA +A4IBAQBDxhzTZc0fB7B2EvHmzz45J3xgk/aQksKFXeWxyX7UdgSY+gzABRMktxHC +MZtdTJxi4BACpRlO4QMbJXSiofhGJQb+ThSvM1CQv+W5X4j7/40RBfRnWbQPZGfx +SyGhLYAIzUsHi6X7DbJmzV2EixPbYKCJ+5Vlf7IH0aDexzf4xKLQdy+cWy1gY4bH +iiQbVqfTjlzdsMuiFqoZe3/NhOP93XSMZErx6pJ/lrWiO+6ytM3gdwh1y0DEtFma +BKzI+2uQwt6DHQuPmOSEmI7NcrVS2WhPVPa7fIY/ExUy7jqIr2qM59eSl7OCAhzg +LtgqfwLgbj5PWZENYlNRXmZGi4GDoQAxAA== +-----END PKCS7----- diff --git a/test-certs/openssl.ext b/test-certs/openssl.ext index e48c744..9f42098 100644 --- a/test-certs/openssl.ext +++ b/test-certs/openssl.ext @@ -7,3 +7,7 @@ subjectAltName = IP:127.0.0.1,IP:::1,DNS:localhost [root_bad] keyUsage=critical, cRLSign basicConstraints=critical, CA:TRUE, pathlen:0 +[root_with_constraints] +keyUsage=critical, keyCertSign +basicConstraints=critical, CA:TRUE, pathlen:0 +nameConstraints=permitted;DNS:.example.com,permitted;IP:192.168.0.0/255.255.0.0,permitted;email:.example.com,excluded;DNS:.example.org,excluded;IP:10.10.0.0/255.255.0.0,excluded;email:.example.org diff --git a/tests/dump-name-constraints-to-text.t b/tests/dump-name-constraints-to-text.t new file mode 100644 index 0000000..2741971 --- /dev/null +++ b/tests/dump-name-constraints-to-text.t @@ -0,0 +1,56 @@ +Set up test data. + + $ cat > example-name-constraints.crt < -----BEGIN CERTIFICATE----- + > MIID1DCCArygAwIBAgIJAL8xOGAOaSzBMA0GCSqGSIb3DQEBCwUAMGExCzAJBgNV + > BAYTAlVTMQswCQYDVQQIEwJDQTEQMA4GA1UEChMHY2VydGlnbzEQMA4GA1UECxMH + > ZXhhbXBsZTEhMB8GA1UEAxMYZXhhbXBsZS1uYW1lLWNvbnN0cmFpbnRzMB4XDTE3 + > MDgxODE5NDg1MFoXDTI0MDYyMjE5NDg1MFowYTELMAkGA1UEBhMCVVMxCzAJBgNV + > BAgTAkNBMRAwDgYDVQQKEwdjZXJ0aWdvMRAwDgYDVQQLEwdleGFtcGxlMSEwHwYD + > VQQDExhleGFtcGxlLW5hbWUtY29uc3RyYWludHMwggEiMA0GCSqGSIb3DQEBAQUA + > A4IBDwAwggEKAoIBAQDkrrryvC1a63Vc2yCBb0SliieU6TnqZAQ5rJzAa4zf7uq9 + > obwLuGfZV5j/7nYl04M2gPiz4Rk8uia14tIqBjFjB5DH7czuaPiGKgMSKMXt9lPZ + > xu3ZnRLRmF+I/zlIjxqLU9bxem7Qs7RBoncbbd65gy8PPe2J09rJdrcj5V/hD2jZ + > pNWtrYA6ANGsMSxLchtpn3LKyDy/bW2HIhXmqVIq/2j2p2ljKf6E63L4S7e7FW8E + > MGiW9y+DLO5U7qSZUiqgAiXHjTKWtYgbnlqboPtZRV5quN2PE0KD3FOLhAQX5MKS + > 3P48+cjeswmruNVc8qjdCi1NLsRCTHukM/WxAC35AgMBAAGjgY4wgYswDgYDVR0P + > AQH/BAQDAgIEMBIGA1UdEwEB/wQIMAYBAf8CAQAwZQYDVR0eBF4wXKAsMA6CDC5l + > eGFtcGxlLmNvbTAKhwjAqAAA//8AADAOgQwuZXhhbXBsZS5jb22hLDAOggwuZXhh + > bXBsZS5vcmcwCocICgoAAP//AAAwDoEMLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEB + > CwUAA4IBAQBDxhzTZc0fB7B2EvHmzz45J3xgk/aQksKFXeWxyX7UdgSY+gzABRMk + > txHCMZtdTJxi4BACpRlO4QMbJXSiofhGJQb+ThSvM1CQv+W5X4j7/40RBfRnWbQP + > ZGfxSyGhLYAIzUsHi6X7DbJmzV2EixPbYKCJ+5Vlf7IH0aDexzf4xKLQdy+cWy1g + > Y4bHiiQbVqfTjlzdsMuiFqoZe3/NhOP93XSMZErx6pJ/lrWiO+6ytM3gdwh1y0DE + > tFmaBKzI+2uQwt6DHQuPmOSEmI7NcrVS2WhPVPa7fIY/ExUy7jqIr2qM59eSl7OC + > AhzgLtgqfwLgbj5PWZENYlNRXmZGi4GD + > -----END CERTIFICATE----- + > EOF + +Dump an example certificate with name constraints (example-name-constraints.crt) + + $ certigo --verbose dump example-name-constraints.crt + ** CERTIFICATE 1 ** + Serial: 13776854720312847553 + Valid: 2017-08-18 19:48 UTC to 2024-06-22 19:48 UTC + Signature: SHA256-RSA (self-signed) + Subject Info: + \tCountry: US (esc) + \tProvince: CA (esc) + \tOrganization: certigo (esc) + \tOrganizational Unit: example (esc) + \tCommonName: example-name-constraints (esc) + Issuer Info: + \tCountry: US (esc) + \tProvince: CA (esc) + \tOrganization: certigo (esc) + \tOrganizational Unit: example (esc) + \tCommonName: example-name-constraints (esc) + Basic Constraints: CA:true, pathlen:0 + DNS Name Constraints: + Permitted: + \t.example.com (esc) + Excluded: + \t.example.org (esc) + Key Usage: + \tCert Sign (esc) +