Proxmox-Port/swtpm
1
0
Fork 0
mirror of https://github.com/stefanberger/swtpm.git synced 2026-08-10 03:24:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

samples: swtpm-localca: Pass password via template file when possible

Browse Source 
Pass the CA's private key password via the template file. Remove recently
added old GnuTLS support. Extend man page with a paragraph about short-
comings of certtool that doesn't seem to allow private key password being
passed either as environment variable or template file.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2020-09-21 13:29:17 -04:00 committed by Stefan Berger
parent c73771b0c5
commit 7b72dfedec
2 changed files with 22 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
man/man8/swtpm-localca.pod
View File

@ -28,6 +28,12 @@ swtpm-localca-rootca-cert.pem respectively. The environment variable
SWTPM_ROOTCA_PASSWORD can be set for the password of the root CA's
private key.
Note: Due to limitations of 'certtool', the possible passwords used for
securing the root CA's private key and the intermedia CA's private
key have to be passed over the command line and therefore will be visible
to others on the system. If you are concerned about this, you should create
the CAs elsewhere and copy them onto the target system.
The following options are supported:
=over 4

33
samples/py_swtpm_localca/swtpm_localca.py
View File

@ -217,6 +217,7 @@ def create_localca_cert(lockfile, statedir, signkey, signkey_password, issuercer
# First the root CA
cmd = [certtool, "--generate-privkey", "--outfile", cakey]
if swtpm_rootca_password:
# neither env. variable nor template file work...
cmd.extend(["--password", swtpm_rootca_password])
try:
@ -234,11 +235,12 @@ def create_localca_cert(lockfile, statedir, signkey, signkey_password, issuercer
temp = tempfile.NamedTemporaryFile()
try:
temp.write(
"cn=swtpm-localca-rootca\n"
"ca\n"
"cert_signing_key\n"
"expiration_days = 3650\n".encode())
filecontent = \
"cn=swtpm-localca-rootca\n" \
"ca\n" \
"cert_signing_key\n" \
"expiration_days = 3650\n"
temp.write(filecontent.encode())
temp.seek(0)
cmd = [certtool,
"--generate-self-signed",
@ -251,7 +253,6 @@ def create_localca_cert(lockfile, statedir, signkey, signkey_password, issuercer
}
if swtpm_rootca_password:
certtool_env["GNUTLS_PIN"] = swtpm_rootca_password
cmd.extend(["--password", swtpm_rootca_password]) # older GnuTLS
try:
proc = subprocess.Popen(cmd, env=certtool_env,
@ -292,11 +293,14 @@ def create_localca_cert(lockfile, statedir, signkey, signkey_password, issuercer
temp = tempfile.NamedTemporaryFile()
try:
temp.write(
"cn=swtpm-localca\n"
"ca\n"
"cert_signing_key\n"
"expiration_days = 3650\n".encode())
filecontent = \
"cn=swtpm-localca\n" \
"ca\n" \
"cert_signing_key\n" \
"expiration_days = 3650\n"
if swtpm_rootca_password and signkey_password:
filecontent += "password = %s\n" % swtpm_rootca_password
temp.write(filecontent.encode())
temp.seek(0)
cmd = [certtool,
@ -310,15 +314,10 @@ def create_localca_cert(lockfile, statedir, signkey, signkey_password, issuercer
certtool_env = {
"PATH": os.getenv("PATH")
}
if signkey_password and swtpm_rootca_password:
if signkey_password:
certtool_env["GNUTLS_PIN"] = signkey_password
cmd.extend(["--password", swtpm_rootca_password]) # older GnutLS
elif signkey_password:
certtool_env["GNUTLS_PIN"] = signkey_password
cmd.extend(["--password", signkey_password]) # older GnuTLS
elif swtpm_rootca_password:
certtool_env["GNUTLS_PIN"] = swtpm_rootca_password
cmd.extend(["--password", swtpm_rootca_password]) # older GnuTLS
try:
proc = subprocess.Popen(cmd, env=certtool_env,