Proxmox-Port/swtpm
1
0
Fork 0
mirror of https://github.com/stefanberger/swtpm.git synced 2026-08-07 19:17:36 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

swtpm_localca: Test for available issuercert before creating CA

Browse Source 
Avoid trying to create TPM certificates while the issuer certificate has
not been created, yet (in a 2nd step).

To resolve this do not just test for availability of the signing key, which
is created first, but also test for the issuer certifcate, which is created
in a 2nd step when the local CA is created. If either one is missing,
attempt to create the CA.

Resolves: #644
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2022-02-01 13:27:53 -05:00 committed by Stefan Berger
parent 9f683e4986
commit 27d4c5d83f
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
samples/py_swtpm_localca/swtpm_localca.py
View File

@ -206,7 +206,7 @@ def create_localca_cert(lockfile, statedir, signkey, signkey_password, issuercer
if not os.path.exists(statedir):
if makedir(statedir, "statedir") != 0:
return 1
if not os.access(signkey, os.R_OK):
if not os.access(signkey, os.R_OK) or not os.access(issuercert, os.R_OK):
directory = os.path.dirname(signkey)
cakey = os.path.join(directory, "swtpm-localca-rootca-privkey.pem")
cacert = os.path.join(directory, "swtpm-localca-rootca-cert.pem")
@ -663,13 +663,23 @@ def main():
sys.exit(1)
swtpm_cert_env.update(envvars)
else:
# if signkey does not exists it will be created...
create_certs = False
# create certificate if either the signing key or issuer cert are missing
if not os.access(signkey, os.R_OK):
if os.path.exists(signkey):
logerr(LOGFILE, "Need read rights on signing key %s for user %s.\n" %
(signkey, getpass.getuser()))
sys.exit(1)
create_certs = True
if not os.access(issuercert, os.R_OK):
if os.path.exists(issuercert):
logerr(LOGFILE, "Need read rights on issuer certficate %s for user %s.\n" %
(issuercert, getpass.getuser()))
sys.exit(1)
create_certs = True
if create_certs:
logit(LOGFILE, "Creating root CA and a local CA's signing key and issuer cert.\n")
if create_localca_cert(lockfile, statedir, signkey, signkey_password,
issuercert) != 0: