195 lines
6.0 KiB
HTML
195 lines
6.0 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8"/>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
|
|
<title>Certidude server</title>
|
|
<link href="/css/style.css" rel="stylesheet" type="text/css"/>
|
|
<link href="//fonts.googleapis.com/css?family=Ubuntu+Mono" rel="stylesheet" type="text/css"/>
|
|
<link href="//fonts.googleapis.com/css?family=Gentium" rel="stylesheet" type="text/css"/>
|
|
<link href="//fonts.googleapis.com/css?family=PT+Sans+Narrow" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="/js/jquery-2.1.4.min.js"></script>
|
|
</head>
|
|
<body>
|
|
<div id="container">
|
|
|
|
<h1>Submit signing request</h1>
|
|
|
|
<p>Request submission is allowed from: {% for i in authority.request_whitelist %}{{ i }} {% endfor %}</p>
|
|
<p>Autosign is allowed from: {% for i in authority.autosign_whitelist %}{{ i }} {% endfor %}</p>
|
|
|
|
<h2>IPsec gateway on OpenWrt</h2>
|
|
|
|
{% set s = authority.certificate.subject %}
|
|
|
|
<pre>
|
|
opkg update
|
|
opkg install strongswan-default curl openssl-util
|
|
modprobe authenc
|
|
</pre>
|
|
|
|
<p>Generate key and submit using standard shell tools:</p>
|
|
|
|
<pre>
|
|
CN=$(cat /proc/sys/kernel/hostname)
|
|
curl {{request.url}}/certificate/ > /etc/ipsec.d/cacerts/ca.pem
|
|
openssl genrsa -out /etc/ipsec.d/private/$CN.pem 4096
|
|
chmod 0600 /etc/ipsec.d/private/$CN.pem
|
|
openssl req -new -sha256 -key /etc/ipsec.d/private/$CN.pem -out /etc/ipsec.d/reqs/$CN.pem -subj "{% if s.C %}/C={{s.C}}{% endif %}{% if s.ST %}/ST={{s.ST}}{% endif %}{% if s.L %}/L={{s.L}}{% endif %}{% if s.O %}/O={{s.O}}{% endif %}{% if s.OU %}/OU={{s.OU}}{% endif %}/CN=$CN"
|
|
curl -L -H "Content-Type: application/pkcs10" --data-binary @/etc/ipsec.d/reqs/$CN.pem {{request.uri}}/request/?autosign=1\&wait=30 > /etc/ipsec.d/certs/$CN.pem.part
|
|
if [ $? -eq 0 ]; then mv /etc/ipsec.d/certs/$CN.pem.part /etc/ipsec.d/certs/$CN.pem; fi
|
|
openssl verify -CAfile /etc/ipsec.d/cacerts/ca.pem /etc/ipsec.d/certs/$CN.pem
|
|
</pre>
|
|
|
|
<p>
|
|
Inspect newly created files:
|
|
</p>
|
|
|
|
<pre>
|
|
openssl x509 -text -noout -in /etc/ipsec.d/cacerts/ca.pem
|
|
openssl x509 -text -noout -in /etc/ipsec.d/certs/$CN.pem
|
|
openssl rsa -check -in /etc/ipsec.d/private/$CN.pem
|
|
</pre>
|
|
|
|
<p>Assuming you have Certidude installed</p>
|
|
|
|
<pre>
|
|
certidude setup client {{request.url}}
|
|
</pre>
|
|
|
|
<p>To set up OpenVPN server</p>
|
|
<pre>
|
|
certidude setup openvpn server {{request.url}}
|
|
</pre>
|
|
|
|
<p>Or to set up OpenVPN client</p>
|
|
<pre>
|
|
certidude setup openvpn client {{request.url}}
|
|
</pre>
|
|
|
|
<h1>Pending requests</h1>
|
|
|
|
<ul>
|
|
{% for j in authority.get_requests() %}
|
|
<li>
|
|
<a class="button" href="/api/{{authority.slug}}/request/{{j.common_name}}/">Fetch</a>
|
|
{% if j.signable %}
|
|
<button onClick="javascript:$.ajax({url:'/api/{{authority.slug}}/request/{{j.common_name}}/',type:'patch'});">Sign</button>
|
|
{% else %}
|
|
<button title="Please use certidude command-line utility to sign unusual requests" disabled>Sign</button>
|
|
{% endif %}
|
|
<button onClick="javascript:$.ajax({url:'/api/{{authority.slug}}/request/{{j.common_name}}/',type:'delete'});">Delete</button>
|
|
|
|
|
|
<div class="monospace">
|
|
{% include 'iconmonstr-certificate-15-icon.svg' %}
|
|
{{j.distinguished_name}}
|
|
</div>
|
|
|
|
{% if j.email_address %}
|
|
<div class="email">{% include 'iconmonstr-email-2-icon.svg' %} {{ j.email_address }}</div>
|
|
{% endif %}
|
|
|
|
<div class="monospace">
|
|
{% include 'iconmonstr-key-2-icon.svg' %}
|
|
<span title="SHA-1 of public key">
|
|
{{ j.fingerprint() }}
|
|
</span>
|
|
{{ j.key_length }}-bit
|
|
{{ j.key_type }}
|
|
</div>
|
|
|
|
{% set key_usage = j.key_usage %}
|
|
{% if key_usage %}
|
|
<div>
|
|
{% include 'iconmonstr-flag-3-icon.svg' %}
|
|
{{j.key_usage}}
|
|
</div>
|
|
{% endif %}
|
|
|
|
</li>
|
|
{% else %}
|
|
<li>Great job! No certificate signing requests to sign.</li>
|
|
{% endfor %}
|
|
</ul>
|
|
|
|
<h1>Signed certificates</h1>
|
|
|
|
|
|
|
|
<p>You can fetch a certificate by <i>common name</i> signing the request</p>
|
|
|
|
<pre>
|
|
curl -f {{request.url}}/signed/$CN > $CN.crt
|
|
</pre>
|
|
|
|
<ul>
|
|
{% for j in authority.get_signed() | sort | reverse %}
|
|
<li>
|
|
<a class="button" href="/api/{{authority.slug}}/signed/{{j.subject.CN}}/">Fetch</a>
|
|
<button onClick="javascript:$.ajax({url:'/api/{{authority.slug}}/signed/{{j.subject.CN}}/',type:'delete'});">Revoke</button>
|
|
|
|
<div class="monospace">
|
|
{% include 'iconmonstr-certificate-15-icon.svg' %}
|
|
{{j.distinguished_name}}
|
|
</div>
|
|
|
|
{% if j.email_address %}
|
|
<div class="email">{% include 'iconmonstr-email-2-icon.svg' %} {{ j.email_address }}</div>
|
|
{% endif %}
|
|
|
|
<div class="monospace">
|
|
{% include 'iconmonstr-key-2-icon.svg' %}
|
|
<span title="SHA-1 of public key">
|
|
{{ j.fingerprint() }}
|
|
</span>
|
|
{{ j.key_length }}-bit
|
|
{{ j.key_type }}
|
|
</div>
|
|
|
|
<div>
|
|
{% include 'iconmonstr-flag-3-icon.svg' %}
|
|
{{j.key_usage}}
|
|
</div>
|
|
|
|
|
|
</li>
|
|
{% endfor %}
|
|
</ul>
|
|
|
|
<h1>Revoked certificates</h1>
|
|
|
|
<p>To fetch certificate revocation list:</p>
|
|
<pre>
|
|
curl {{request.url}}/revoked/ | openssl crl -text -noout
|
|
</pre>
|
|
<!--
|
|
<p>To perform online certificate status request</p>
|
|
|
|
<pre>
|
|
curl {{request.url}}/certificate/ > ca.pem
|
|
openssl ocsp -issuer ca.pem -CAfile ca.pem -url {{request.url}}/ocsp/ -serial 0x
|
|
</pre>
|
|
-->
|
|
<ul>
|
|
{% for j in authority.get_revoked() %}
|
|
<li>
|
|
{{j.changed}}
|
|
{{j.serial_number}} <span class="monospace">{{j.distinguished_name}}</span>
|
|
</li>
|
|
{% else %}
|
|
<li>Great job! No certificate signing requests to sign.</li>
|
|
{% endfor %}
|
|
</ul>
|
|
|
|
</div>
|
|
</body>
|
|
|
|
<footer>
|
|
<a href="http://github.com/laurivosandi/certidude">Certidude</a> by
|
|
<a href="http://github.com/laurivosandi/">Lauri Võsandi</a>
|
|
</footer>
|
|
|
|
</html>
|
|
|