Set CA flag for new CA certificates

refs #7247

diff --git a/lib/base/tlsutility.cpp b/lib/base/tlsutility.cpp
index 44aba63857fd2ddd99efc4b3f1694c58d424d569..30317df82e2ec618e79b77bbce1a095dc29180ce 100644 (file)
--- a/lib/base/tlsutility.cpp
+++ b/lib/base/tlsutility.cpp
@@ -22,7 +22,6 @@
 #include "base/logger_fwd.hpp"
 #include "base/context.hpp"
 
-
 namespace icinga
 {
 
@@ -246,7 +245,7 @@ shared_ptr<X509> GetX509Certificate(const String& pemfile)
        return shared_ptr<X509>(cert, X509_free);
 }
 
-int MakeX509CSR(const String& cn, const String& keyfile, const String& csrfile, const String& certfile)
+int MakeX509CSR(const String& cn, const String& keyfile, const String& csrfile, const String& certfile, bool ca)
 {
        InitializeOpenSSL();
 
@@ -281,6 +280,21 @@ int MakeX509CSR(const String& cn, const String& keyfile, const String& csrfile,
                X509_NAME *name = X509_get_subject_name(cert);
                X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned char *)cn.CStr(), -1, -1, 0);
                X509_set_issuer_name(cert, name);
+               
+               if (ca) {
+                       X509_EXTENSION *ext;
+                       X509V3_CTX ctx;
+                       X509V3_set_ctx_nodb(&ctx);
+                       X509V3_set_ctx(&ctx, cert, cert, NULL, NULL, 0);
+                       ext = X509V3_EXT_conf_nid(NULL, &ctx, NID_basic_constraints, const_cast<char *>("critical,CA:TRUE"));
+                       
+                       if (ext)
+                               X509_add_ext(cert, ext, -1);
+                       
+                       X509_EXTENSION_free(ext);
+               }
+               
+               
                X509_sign(cert, key, EVP_sha1());
                
                Log(LogInformation, "base", "Writing X509 certificate to '" + certfile + "'.");

diff --git a/lib/base/tlsutility.hpp b/lib/base/tlsutility.hpp
index 662a604ad78b5231633794366aa1e7a8a8b11343..727d0133e6f6532cfc1731c9c68c83ef3c5c0dfb 100644 (file)
--- a/lib/base/tlsutility.hpp
+++ b/lib/base/tlsutility.hpp
@@ -29,6 +29,7 @@
 #include <openssl/err.h>
 #include <openssl/comp.h>
 #include <openssl/sha.h>
+#include <openssl/x509v3.h>
 
 namespace icinga
 {
@@ -37,7 +38,7 @@ shared_ptr<SSL_CTX> I2_BASE_API MakeSSLContext(const String& pubkey, const Strin
 void I2_BASE_API AddCRLToSSLContext(const shared_ptr<SSL_CTX>& context, const String& crlPath);
 String I2_BASE_API GetCertificateCN(const shared_ptr<X509>& certificate);
 shared_ptr<X509> I2_BASE_API GetX509Certificate(const String& pemfile);
-int I2_BASE_API MakeX509CSR(const String& cn, const String& keyfile, const String& csrfile = String(), const String& certfile = String());
+int I2_BASE_API MakeX509CSR(const String& cn, const String& keyfile, const String& csrfile = String(), const String& certfile = String(), bool ca = false);
 String I2_BASE_API SHA256(const String& s);
 
 class I2_BASE_API openssl_error : virtual public std::exception, virtual public boost::exception { };

diff --git a/lib/cli/pkinewcacommand.cpp b/lib/cli/pkinewcacommand.cpp
index 419115b00498d06a34ed71bf8c440d49def4c5e9..8c295cff5c919080f1f38985d280149eb80c6b4d 100644 (file)
--- a/lib/cli/pkinewcacommand.cpp
+++ b/lib/cli/pkinewcacommand.cpp
@@ -63,7 +63,7 @@ int PKINewCACommand::Run(const boost::program_options::variables_map& vm) const
                return 1;
        }
        
-       MakeX509CSR("Icinga CA", cadir + "/ca.key", String(), cadir + "/ca.crt");
+       MakeX509CSR("Icinga CA", cadir + "/ca.key", String(), cadir + "/ca.crt", true);
        
        String serialpath = cadir + "/serial.txt";