cert-enroll: Support three generations of CA certificates

If the lifetime of an issuing or sub CA is twice the lifetime of
the end entity certificates issued by it and the renewal cycle of
the issuing CAs is a little shorter than the validity of the end
entity certificates then three generations of CA certificates have
to be handled by the cert-enroll scripts.

diff --git a/src/cert-enroll/Makefile.am b/src/cert-enroll/Makefile.am
index f2eb9e6e01d8fe9e5c871d5f35d0c0064f7a0b97..745d7fc800f9decfa076e3c8b6728e772d402e80 100644 (file)
--- a/src/cert-enroll/Makefile.am
+++ b/src/cert-enroll/Makefile.am
@@ -28,6 +28,8 @@ cert_install_availabledir = $(sysconfdir)/cert-enroll.d/cert-install-available
 cert_install_available_DATA = \
        cert-install-ssl \
        cert-install-sssd \
+       cert-install-ldaputils \
+       cert-install-cockpit \
        cert-install-dirsrv \
        cert-install-lighttpd \
        cert-install-openxpki \
@@ -41,9 +43,10 @@ cert-install-ipsec : cert-install-ipsec.in
 
 EXTRA_DIST = \
        cert-enroll.conf cert-enroll.in cert-enroll.service.in cert-enroll.timer \
-       cert-install-dirsrv cert-install-gitea cert-install-ipsec.in \
-       cert-install-lighttpd cert-install-openxpki cert-install-ssl \
-       cert-install-sssd cert-install-swanctl.in
+       cert-install-cockpit cert-install-dirsrv cert-install-gitea \
+       cert-install-ipsec.in cert-install-ldaputils cert-install-lighttpd \
+       cert-install-openxpki cert-install-ssl cert-install-sssd \
+       cert-install-swanctl.in
 
 man8_MANS = cert-enroll.8
 

diff --git a/src/cert-enroll/cert-enroll.conf b/src/cert-enroll/cert-enroll.conf
index d2b12c82f9395c76a9acdb102d53a83ec099af08..ab8a644ba50bf1c7977f8406a4727c95afa9fbf6 100644 (file)
--- a/src/cert-enroll/cert-enroll.conf
+++ b/src/cert-enroll/cert-enroll.conf
@@ -22,8 +22,10 @@
 : ${CAOUT=cacert}
 : ${ROOTCA=$CAOUT.pem}
 : ${OLDROOTCA=$CAOUT-old.pem}
+: ${OLDERROOTCA=$CAOUT-older.pem}
 : ${SUBCA=$CAOUT-1.pem}
 : ${OLDSUBCA=$CAOUT-1-old.pem}
+: ${OLDERSUBCA=$CAOUT-1-older.pem}
 : ${RAOUT=racert}
 : ${RACERT=$RAOUT.pem}
 

diff --git a/src/cert-enroll/cert-enroll.in b/src/cert-enroll/cert-enroll.in
index 84251a9477a3ed51a541871f441b698321dcb3b8..71ef7a4e13f55c97989b2b74c5e88aa613fe1126 100644 (file)
--- a/src/cert-enroll/cert-enroll.in
+++ b/src/cert-enroll/cert-enroll.in
@@ -155,6 +155,10 @@ function check_ca_certs()
   if [ $ROOTCA_CHANGED -ne 0 ]
   then
     echo "Warning: '$ROOTCA' has changed"
+    if [ -s old/$ROOTCA ]
+    then
+      mv old/$ROOTCA older
+    fi
     mv $ROOTCA old
     mv new/$ROOTCA .
   fi
@@ -164,6 +168,10 @@ function check_ca_certs()
   if [ $SUBCA_CHANGED -ne 0 ]
   then
     echo "Warning: '$SUBCA' has changed"
+    if [ -s old/$SUBCA ]
+    then
+      mv old/$SUBCA older
+    fi
     mv $SUBCA old
     mv new/$SUBCA .
   fi
@@ -192,6 +200,7 @@ function install_certs()
     KEYTYPE="$KEYTYPE" CERTDIR="$CERTDIR" HOSTKEY="$HOSTKEY" \
     HOSTCERT="$HOSTCERT" ROOTCA="$ROOTCA" SUBCA="$SUBCA" \
     OLDROOTCA="$OLDROOTCA" OLDSUBCA="$OLDSUBCA" \
+    OLDERROOTCA="$OLDERROOTCA" OLDERSUBCA="$OLDERSUBCA" \
     USER_GROUP="$USER_GROUP" SERVICE="$SERVICE" \
     /bin/bash $script || status=$?
     if [ $status -ne 0 ]
@@ -251,7 +260,7 @@ esac
 ##############################################################################
 # Create and change into certificates directory
 #
-mkdir -p $CERTDIR/new $CERTDIR/old
+mkdir -p $CERTDIR/new $CERTDIR/old $CERTDIR/older
 cd $CERTDIR
 echo "  changed into the '$CERTDIR' directory"
 

diff --git a/src/cert-enroll/cert-install-cockpit b/src/cert-enroll/cert-install-cockpit
new file mode 100644 (file)
index 0000000..f985ab7
--- /dev/null
+++ b/src/cert-enroll/cert-install-cockpit
@@ -0,0 +1,50 @@
+#!/bin/bash
+# Install the generated key and certificate as TLS credentials for the Cockpit 
+# management interface.
+#
+# Copyright (C) 2024 Andreas Steffen
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+#
+set -e
+
+##############################################################################
+# Set local paths 
+#
+
+# Path to the cockpit credentials 
+COCKPIT="/etc/cockpit/ws-certs.d"
+
+##############################################################################
+# Change into the certificates directory
+#
+cd $CERTDIR
+
+##############################################################################
+# Install the private key and certificate
+#
+cp $HOSTKEY  $COCKPIT/ldap.key
+cp $HOSTCERT $COCKPIT/ldap.crt
+
+##############################################################################
+# Restart the cockpit systemd service
+#
+/usr/bin/systemctl restart cockpit.service
+exit 0
+

diff --git a/src/cert-enroll/cert-install-dirsrv b/src/cert-enroll/cert-install-dirsrv
index da196f7565777741458e20e4513632fe9eb6d186..8cffe2b9218263264a0641ba48e2b7af2bbe7bf3 100644 (file)
--- a/src/cert-enroll/cert-install-dirsrv
+++ b/src/cert-enroll/cert-install-dirsrv
@@ -88,6 +88,16 @@ then
   $CERTUTIL -d . -A -t "CT,," -n "Old Sub CA" -i $CERTDIR/old/$SUBCA \
             -f passwd.txt
 fi
+if [ -s $CERTDIR/older/$ROOTCA ]
+then
+  $CERTUTIL -d . -A -t "CT,," -n "Older Root CA" -i $CERTDIR/older/$ROOTCA \
+            -f passwd.txt
+fi
+if [ -s $CERTDIR/older/$SUBCA ]
+then
+  $CERTUTIL -d . -A -t "CT,," -n "Older Sub CA" -i $CERTDIR/older/$SUBCA \
+            -f passwd.txt
+fi
  
 ##############################################################################
 # Move the generated credentials to the correct place and delete the build dir 

diff --git a/src/cert-enroll/cert-install-ipsec.in b/src/cert-enroll/cert-install-ipsec.in
index 1eea8def0a757ba4d859d44d1c2bb3f7e90ea7fc..e50104caed5e08c41f6d2399fa99b4af7a470100 100644 (file)
--- a/src/cert-enroll/cert-install-ipsec.in
+++ b/src/cert-enroll/cert-install-ipsec.in
@@ -53,6 +53,22 @@ cp $HOSTCERT $IPSECDIR/certs
 # Install the CA certificates
 #
 cp $ROOTCA $SUBCA $IPSECDIR/cacerts
+if [ -s old/$ROOTCA ]
+then
+  cp old/$ROOTCA $IPSECDIR/cacerts/$OLDROOTCA
+fi
+if [ -s old/$SUBCA ]
+then
+  cp old/$SUBCA $IPSECDIR/cacerts/$OLDSUBCA
+fi
+if [ -s older/$ROOTCA ]
+then
+  cp older/$ROOTCA $IPSECDIR/cacerts/$OLDERROOTCA
+fi
+if [ -s older/$SUBCA ]
+then
+  cp older/$SUBCA $IPSECDIR/cacerts/$OLDERSUBCA
+fi
 
 ##############################################################################
 # Reload the strongSwan charon daemon if it is running

diff --git a/src/cert-enroll/cert-install-ldaputils b/src/cert-enroll/cert-install-ldaputils
new file mode 100644 (file)
index 0000000..90160e4
--- /dev/null
+++ b/src/cert-enroll/cert-install-ldaputils
@@ -0,0 +1,64 @@
+#!/bin/bash
+# Concatenate the present and past CA certificates into a single TLS_CACERT
+# file defined by ldap.conf so that the ldap-utils can verify the LDAP server
+# certificate.
+#
+# Copyright (C) 2024 Andreas Steffen
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+#
+set -e
+
+##############################################################################
+# Set some local paths
+#
+
+# Path to the LDAP configuration file
+LDAP_CONF="/etc/ldap/ldap.conf"
+
+# Extract or set path to the LDAP TLS CA cert directory
+LDAP_TLS_CACERTS=$(awk '/TLS_CACERT/ {print $2}' $LDAP_CONF)
+
+##############################################################################
+# Change into the certificate directory
+#
+cd $CERTDIR
+
+##############################################################################
+# Concatenate the CA certificates into a single file
+#
+cat $ROOTCA $SUBCA > $LDAP_TLS_CACERTS
+if [ -s old/$ROOTCA ]
+then
+  cat old/$ROOTCA >> $LDAP_TLS_CACERTS
+fi
+if [ -s old/$SUBCA ]
+then
+  cat old/$SUBCA >> $LDAP_TLS_CACERTS
+fi
+if [ -s older/$ROOTCA ]
+then
+  cat older/$ROOTCA >> $LDAP_TLS_CACERTS
+fi
+if [ -s older/$SUBCA ]
+then
+  cat older/$SUBCA >> $LDAP_TLS_CACERTS
+fi
+
+exit 0

diff --git a/src/cert-enroll/cert-install-openxpki b/src/cert-enroll/cert-install-openxpki
index 3bed2a9f334f61e14961617d368d38d82a41b679..e30aa87a49e13b0cfbc675c14cfd0265ea3d12b5 100644 (file)
--- a/src/cert-enroll/cert-install-openxpki
+++ b/src/cert-enroll/cert-install-openxpki
@@ -54,6 +54,14 @@ if [ -s old/$SUBCA ]
 then
   cp old/$SUBCA $OPENXPKI_TLS/chain/$OLDSUBCA
 fi
+if [ -s older/$ROOTCA ]
+then
+  cp older/$ROOTCA $OPENXPKI_TLS/chain/$OLDERROOTCA
+fi
+if [ -s older/$SUBCA ]
+then
+  cp older/$SUBCA $OPENXPKI_TLS/chain/$OLDERSUBCA
+fi
 
 rm -f $OPENXPKI_TLS/chain/*.0
 

diff --git a/src/cert-enroll/cert-install-ssl b/src/cert-enroll/cert-install-ssl
index 4db7c0b9cd6d51ac5062d276af25e46cc5402f9a..306e661b9107974d21d17c046e4e5d31b38a84e3 100644 (file)
--- a/src/cert-enroll/cert-install-ssl
+++ b/src/cert-enroll/cert-install-ssl
@@ -49,6 +49,14 @@ if [ -s $CERTDIR/old/$SUBCA ]
 then
   cat $CERTDIR/old/$SUBCA  >> $SSL_DIR/trusted.pem
 fi
+if [ -s $CERTDIR/older/$ROOTCA ]
+then
+  cat $CERTDIR/older/$ROOTCA >> $SSL_DIR/trusted.pem
+fi
+if [ -s $CERTDIR/older/$SUBCA ]
+then
+  cat $CERTDIR/older/$SUBCA  >> $SSL_DIR/trusted.pem
+fi
 
 ##############################################################################
 # Restart the systemd service if it is active

diff --git a/src/cert-enroll/cert-install-sssd b/src/cert-enroll/cert-install-sssd
index 260e1440f44657b9528203490122b7e3cc4427bd..ae3d8bd2ed4f9806cf0bbfdb76e4ae189dbd24f8 100644 (file)
--- a/src/cert-enroll/cert-install-sssd
+++ b/src/cert-enroll/cert-install-sssd
@@ -53,6 +53,14 @@ if [ -s old/$SUBCA ]
 then
   cp old/$SUBCA $LDAP_TLS_CACERTDIR/$OLDSUBCA
 fi
+if [ -s older/$ROOTCA ]
+then
+  cp older/$ROOTCA $LDAP_TLS_CACERTDIR/$OLDERROOTCA
+fi
+if [ -s older/$SUBCA ]
+then
+  cp older/$SUBCA $LDAP_TLS_CACERTDIR/$OLDERSUBCA
+fi
 
 rm -f $LDAP_TLS_CACERTDIR/*.0
 

diff --git a/src/cert-enroll/cert-install-swanctl.in b/src/cert-enroll/cert-install-swanctl.in
index 2b2781d5254114e34872e753dc3c8ef891a62cd1..ff8aad7d84ff0ecfae4f21236c3ecefab30dc8fd 100644 (file)
--- a/src/cert-enroll/cert-install-swanctl.in
+++ b/src/cert-enroll/cert-install-swanctl.in
@@ -69,6 +69,14 @@ if [ -s old/$SUBCA ]
 then
   cp old/$SUBCA ${SWANCTLDIR}/x509ca/$OLDSUBCA
 fi
+if [ -s older/$ROOTCA ]
+then
+  cp older/$ROOTCA ${SWANCTLDIR}/x509ca/$OLDERROOTCA
+fi
+if [ -s older/$SUBCA ]
+then
+  cp older/$SUBCA ${SWANCTLDIR}/x509ca/$OLDERSUBCA
+fi
 
 ##############################################################################
 # Reload the strongswan systemd service if it is running