Add suggestions for virt-pki-query-dn usage

To make it easier for users to figure out how the DN should be formatted.

Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

diff --git a/docs/remote.html.in b/docs/remote.html.in
index 66f56a3a64fc3523d32e5acc8cbc730901d44c42..efdb2b32535d9567c9399cfdd339e0df2097ba74 100644 (file)
--- a/docs/remote.html.in
+++ b/docs/remote.html.in
@@ -259,6 +259,10 @@ Blank lines and comments beginning with <code>#</code> are ignored.
   Note also that GnuTLS returns DNs without spaces
   after commas between the fields (and this is what we check against),
   but the <code>openssl x509</code> tool shows spaces.
+  </p>
+  To make it easy to see the order of the fields in the DN a helper executable
+  <code>virt-pki-query-dn</code> is provided for this particular use case.
+          <p>
 </p>
         </td>
       </tr>

diff --git a/src/remote/libvirtd.conf.in b/src/remote/libvirtd.conf.in
index b18c5885a1a77f30060e428f584f1f51a8c51166..2cd20aaa7f52a41e73a52646481a342412c8dabf 100644 (file)
--- a/src/remote/libvirtd.conf.in
+++ b/src/remote/libvirtd.conf.in
@@ -292,6 +292,11 @@
 #
 # Any * matches any number of consecutive spaces, like a simplified glob(7).
 #
+# The format of the DN for a particular certificate can be queried
+# using:
+#
+#    virt-pki-query-dn clientcert.pem
+#
 # NB If this is an empty list, no client can connect, so comment out
 # entirely rather than using empty list to disable these checks
 #

diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c
index 3babf3ee4dc3760bede6df85a5b0cebcf883baf4..1a3dd92676f7b1c4292f8cd1568f268bc3fc83d2 100644 (file)
--- a/src/rpc/virnettlscontext.c
+++ b/src/rpc/virnettlscontext.c
@@ -371,7 +371,7 @@ virNetTLSContextCheckCertDNACL(const char *dname,
     virReportError(VIR_ERR_SYSTEM_ERROR, "%s",
                    _("Client's Distinguished Name is not on the list "
                      "of allowed clients (tls_allowed_dn_list).  Use "
-                     "'certtool -i --infile clientcert.pem' to view the "
+                     "'virt-pki-query-dn clientcert.pem' to view the "
                      "Distinguished Name field in the client certificate, "
                      "or run this daemon with --verbose option."));
     return 0;

diff --git a/tests/virconfdata/libvirtd.conf b/tests/virconfdata/libvirtd.conf
index f4c35e9e430fdeb7e912fffb7d38e9007ccf836e..c5a225e42f6f34aea2ba631ebcc459abc184fa52 100644 (file)
--- a/tests/virconfdata/libvirtd.conf
+++ b/tests/virconfdata/libvirtd.conf
@@ -185,6 +185,10 @@ tls_no_verify_certificate = 1
 #
 # Any * matches any number of consecutive spaces, like a simplified glob(7).
 #
+# The format of the DN for a particular certificate can be queried
+# using:
+#
+#    virt-pki-query-dn clientcert.pem
 #
 # NB If this is an empty list, no client can connect, so comment out
 # entirely rather than using empty list to disable these checks

diff --git a/tests/virconfdata/libvirtd.out b/tests/virconfdata/libvirtd.out
index a407c5f189e92b3a083a19d0a170aba3b4262c0b..754bf56ee4dd639a78d89348fe71db760e29684f 100644 (file)
--- a/tests/virconfdata/libvirtd.out
+++ b/tests/virconfdata/libvirtd.out
@@ -149,6 +149,10 @@ tls_no_verify_certificate = 1
 #
 # Any * matches any number of consecutive spaces, like a simplified glob(7).
 #
+# The format of the DN for a particular certificate can be queried
+# using:
+#
+#    virt-pki-query-dn clientcert.pem
 #
 # NB If this is an empty list, no client can connect, so comment out
 # entirely rather than using empty list to disable these checks