summaryrefslogtreecommitdiff
path: root/usr.sbin/ikectl/ikeca.c
AgeCommit message (Collapse)Author
2021-01-23Handle write() errors.tobhe
ok patrick@
2021-01-23Handle errors and truncated output from snprintf().tobhe
ok patrick@
2019-05-08convert system() calls to an execv() like interface.Ted Unangst
avoids sh difficulties, etc. from Matthew Martin. ok deraadt reyk
2019-02-26ikectl's built-in CA command for simple configurations has a fixed certificateStuart Henderson
validity for the ca certificate. Raise this from 365 days to 4500 as expiry means installing new CA certificates on all client machines which can cause significant pain. This doesn't change the default validity for server certificates which remains at 1 year (controlled by ikeca.cnf) - refreshing key and certificate on these can be done easily without visiting all machines. ok deraadt@
2017-11-08Since r1.41 the extensions are included in the CSR. Thus ca_request()Patrick Wildt
already sets the extension values and returns. ca_sign() re-uses the information to write out the extension file. Since ca_request() uses strings stored on the stack, on return the pointers to those strings will be unusable. To fix this, strdup() the strings passed ca_setenv() so we can re-use them in another scope. And free() them when we clear the environment in ca_clrenv(). Initial report and diff from Andrei-Marius Radu. ok markus@
2017-06-08Invoke openssl with -passin file rather than -key in ca_revoke().Jonathan Gray
From Andrei-Marius Radu via sthen@
2017-05-31ca_revoke() gets called two ways. Directly from ca_opt() with keynameJonathan Gray
set to the cert to revoke, and indirectly from ca_create() with a keyname set to NULL. ca_create() sets REQ_EXT so avoid setting it in ca_revoke() when keyname is NULL and the crl database is being initialised. Avoids "REQ_EXT already set" when creating a CA error introduced in rev 1.44 which set REQ_EXT unconditionally in ca_revoke().
2017-05-24Set REQ_EXT in req section so ikectl ca certificate revoke will work again.Jonathan Gray
2017-05-21A few more freezero() usesTheo de Raadt
ok yasuoka mikeb
2017-03-29set REQ_EXT to x509v3_CA, fixing "ikectl ca XX create" inadvertently brokenStuart Henderson
in r1.41. ok reyk deraadt
2017-01-31Teach ikectl to include extensions in the CSR, rather than just adding themStuart Henderson
when signing the certificates by the local CA. This can make things easier if you want to take a CSR from ikectl to another CA for signing, they often copy extensions from the request. ok reyk@
2015-11-02switch from using sha1 to sha256Jonathan Gray
As the ca section of the cnf file requires a default_md line (unlike req) this change also requires updating the installed ikeca.cnf or equivalent files. Requested by and ok reyk@ who also tested this against ios9 with iked.
2015-11-02sign csrs with openssl ca instead of x509 -reqJonathan Gray
This way openssl will add valid signed certs to the index file which is required to use the builtin openssl OCSP server. This change requires installing a new ikeca.cnf or updating the default cnf files with equivalent sections. Requested by and ok reyk@
2015-11-02Accept an ocsp option when creating certificates to set the extendedJonathan Gray
key usage for OCSP signing. Requested by and ok reyk@
2015-08-19ca_hier() und ca_newpass() abort on failure, return void instead of int.Reyk Floeter
Based on previous observation by semarie@
2015-08-19spacingReyk Floeter
2015-08-19fcopy_env() should return void as it aborts on failure.Reyk Floeter
Pointed out by semarie@
2015-08-19Use C99 integer types in ikectl(8).Reyk Floeter
OK jsg@
2015-08-19Support for overwriting $ENV:: variables in OpenSSL .cnf files fromReyk Floeter
the environment has been removed in LibreSSL. This was a good step but it unintentionally broke the "ikectl ca" commands. Rework the implementation for copying the .cnf files and expanding the $ENV:: variables ourselves before passing the generated .cnf file to the "openssl" command. Reported and tested by Jona Joachim (thanks!) OK jsg@
2015-08-15correct mode_t 644 to 0644Sebastien Marie
ok sthen@
2015-08-15corrects three err() to errx() callsSebastien Marie
- a if condition don't set errno - strlcpy(3) don't set errno (no mention is man page) - ca_readpass() already manage errno error message with warn(3) ok sthen@
2015-01-16Replace <sys/param.h> with <limits.h> and other less dirty headers whereTheo de Raadt
possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)
2014-08-26Move openssl(1) from /usr/sbin/openssl to /usr/bin/openssl, since it is notJoel Sing
a system/superuser binary. At the same time, move the source code from its current lib/libssl/src/apps location to a more appropriate home under usr.bin/openssl. ok deraadt@ miod@
2014-08-25Delete secret or secret-derived data with explicit_bzero.Doug Hogan
concept ok deraadt@ diff looks ok tedu@
2014-07-20Make sure the correct errno is reported by warn* or err* and notPhilip Guenther
the errno of an intervening cleanup operation like close/unlink/etc. Diff from Doug Hogan (doug (at) acyclic.org)
2014-04-18round up some enemy sympathizers found calling RAND_seed().Ted Unangst
ok beck reyk
2013-01-08Remove private CVS tag from an obsolete repository and bump copyrightReyk Floeter
to 2013 while I'm here... this is my way of saying "happy new year!".
2012-12-08don't forget to include a path separator after an SSLDIR;Mike Belopuhov
reported by david hill
2012-10-23Allow to overwrite a few more definitions like file paths from theReyk Floeter
Makefile. No functional change.
2012-09-18update email addresses to match reality.Reyk Floeter
sure jsg@ mikeb@
2012-07-08if you use nitems() in userland, you must define it yourselfTheo de Raadt
discussed with guenther
2011-05-27spacingReyk Floeter
2010-10-08set the client/server certificate options with all the common keyusageReyk Floeter
and extendedkeyusage and nscerttype flags. the ikectl CA can now be used with all kinds of other vpn tools in addition to iked and isakmpd. ok phessler@
2010-10-08check if a directory exists before trying to create it in the exportJonathan Gray
case as well, spotted by mikeb
2010-10-08if non absolute paths are specified in install commands assume theyJonathan Gray
are relative to /etc
2010-10-08allow optional paths for the install commands so we canJonathan Gray
install into the isakmpd directory hierarchy for example.
2010-10-08Allow to show certificate details (show ca x cert [y]).Reyk Floeter
2010-10-07only try to setup a passfile when creating a CAJonathan Gray
2010-10-07Allow to specify the export password on the command line (optionally, forReyk Floeter
scripting). The "peer" argument now needs to be preceded with the "peer" keyword, eg. ... export peer 10.1.1.1 instead of export 10.1.1.1.
2010-10-07- add a -q (quiet) command line option that will be used by ikeca toReyk Floeter
set openssl batch mode: don't ask for x509 options, use the defaults. - allow to specify the initial ca password on the command line to also make it scriptable. - allow to create certificates for clientAuth or serverAuth only (eg. ikectl ca foo certificate bar server). - cosmetics: move double declarations of ca_*() functions to parser.h. ok phessler@
2010-10-07set saner permissions on the directory we export, so we don't changePeter Hessler
perms of /etc/iked when extracting OK jsg@
2010-10-07When we create a new CA, also create an empty (but valid) CRL list.Peter Hessler
While here, set our used defaults in the config file. OK reyk@, jsg@
2010-06-23fix the permissions on directories inside the exported tarballJonathan Gray
in the cert case.
2010-06-23More appropriate contents for the exported ca tarball.Jonathan Gray
2010-06-23Add a ca export command for EAP mode where we only require the CA cert,Jonathan Gray
and make both export commands optionally take an argument that will be added to a peer.txt file in the exported output. Additionally include any site specific notes from /usr/share/iked if present. man page bits and help with the parser from reyk
2010-06-21use the full path to zipJonathan Gray
2010-06-14Add commands to create/delete/install/import keys withoutJonathan Gray
involving certificates as suggested by reyk and don't recreate private keys if a key already exists. ok reyk@
2010-06-10Add a command to revoke a certificate and generate a CRL;Jonathan Gray
make the ca install command install the CRL as well. discussed with reyk@
2010-06-07switch iked pki files to /etc/iked, discussed with reyk.Jonathan Gray
2010-06-04Install the cert as well as the keys and make certs worldJonathan Gray
readable as suggested by reyk@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-26 09:09:55 +0000