asterisk

Commit Graph

Author	SHA1	Message	Date
Naveen Albert	0bfbabee41	ast_tls_cert: Add option to skip passphrase for CA private key. Currently, the ast_tls_cert file is hardcoded to use the -des3 option for 3DES encryption, and the script needs to be manually modified to not require a passphrase. Add an option (-e) that disables encryption of the CA private key so no passphrase is required. Resolves: #1064	4 months ago
Sean Bright	de6919f339	ast_tls_cert: Allow private key size to be set on command line The default size in release branches will be 1024 but we'll use 2048 in master. ASTERISK~28750 Change-Id: I435cea18bdd58824ed2b55259575c7ec7133842a	5 years ago
Sean Bright	fd0ca1c3f9	Remove as much trailing whitespace as possible. Change-Id: I873c1c6d00f447269bd841494459efccdd2c19c0	7 years ago
Tzafrir Cohen	51c54ddf8d	ast_tls_cert: don't recreate generated files Don't regenrate cat.cfg, ca.crt and ca.key if they were already created on a previous run. (closes issue ASTERISK-21932) git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@393383 65c4cc65-6c06-0410-ace0-fbb531ad65f3	12 years ago
Jonathan Rose	2c3638df98	ast_tls_cert script: Better response for various exit conditions to openssl (closes issue ASTERISK-20260) Reported by: Daniel O'Connor Patches: ast_tls_cert-update.diff uploaded by Daniel O'Connor (license 6419) ........ Merged revisions 375325 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 375326 from http://svn.asterisk.org/svn/asterisk/branches/10 ........ Merged revisions 375327 from http://svn.asterisk.org/svn/asterisk/branches/11 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@375328 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Terry Wilson	43e8c7df2b	Merged revisions 294049 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.8 ........ r294049 \| twilson \| 2010-11-05 09:05:50 -0700 (Fri, 05 Nov 2010) \| 2 lines Corret spelling and example ........ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@294050 65c4cc65-6c06-0410-ace0-fbb531ad65f3	15 years ago
Terry Wilson	98c363a5ac	Merged revisions 294047 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.8 ........ r294047 \| twilson \| 2010-11-05 08:36:20 -0700 (Fri, 05 Nov 2010) \| 2 lines Tell people to use the correct common name for clients as well ........ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@294048 65c4cc65-6c06-0410-ace0-fbb531ad65f3	15 years ago
Terry Wilson	8ea287b0c0	Merged revisions 292825 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.8 ........ r292825 \| twilson \| 2010-10-22 15:35:29 -0700 (Fri, 22 Oct 2010) \| 4 lines Don't create directories without at least o+x Also, making files that you are going to modify read-only is dumb. ........ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@292826 65c4cc65-6c06-0410-ace0-fbb531ad65f3	15 years ago
Terry Wilson	3d658dce9b	Merged revisions 292794 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.8 ........ r292794 \| twilson \| 2010-10-22 15:18:36 -0700 (Fri, 22 Oct 2010) \| 2 lines Make files readable only by the owner ........ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@292808 65c4cc65-6c06-0410-ace0-fbb531ad65f3	15 years ago
Terry Wilson	89a16f9c81	Merged revisions 292740 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.8 ........ r292740 \| twilson \| 2010-10-22 09:49:34 -0700 (Fri, 22 Oct 2010) \| 45 lines Add TLS cert helper script This script is useful for quickly generating self-signed CA, server, and client certificates for use with Asterisk. It is still recommended to obtain certificates from a recognized Certificate Authority and to develop an understanding how SSL certificates work. Real security is hard work. OPTIONS: -h Show this message -m Type of cert "client" or "server". Defaults to server. -f Config filename (openssl config file format) -c CA cert filename (creates new CA cert/key as ca.crt/ca.key if not passed) -k CA key filename -C Common name (cert field) For a server cert, this should be the same address that clients attempt to connect to. Usually this will be the Fully Qualified Domain Name, but might be the IP of the server. For a CA or client cert, it is merely informational. Make sure your certs have unique common names. -O Org name (cert field) An informational string (company name) -o Output filename base (defaults to asterisk) -d Output directory (defaults to the current directory) Example: To create a CA and a server (pbx.mycompany.com) cert with output in /tmp: ast_tls_cert -C pbx.mycompany.com -O "My Company" -d /tmp This will create a CA cert and key as well as asterisk.pem and the the two files that it is made from: asterisk.crt and asterisk.key. Copy asterisk.pem and ca.crt somewhere (like /etc/asterisk) and set tlscertfile=/etc/asterisk.pem and tlscafile=/etc/ca.crt. Since this is a self-signed key, many devices will require you to import the ca.crt file as a trusted cert. To create a client cert using the CA cert created by the example above: ast_tls_cert -m client -c /tmp/ca.crt -k /tmp/ca.key -C "Joe User" -O \ "My Company" -d /tmp -o joe_user This will create client.crt/key/pem in /tmp. Use this if your device supports a client certificate. Make sure that you have the ca.crt file set up as a tlscafile in the necessary Asterisk configs. Make backups of all .key files in case you need them later. ........ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@292743 65c4cc65-6c06-0410-ace0-fbb531ad65f3	15 years ago

10 Commits (20)