You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
132 lines
4.5 KiB
132 lines
4.5 KiB
package NGCP::Panel::Model::CA;
|
|
use Sipwise::Base;
|
|
use MIME::Base64 qw(decode_base64);
|
|
use Path::Tiny qw();
|
|
use Time::HiRes qw();
|
|
use Types::Path::Tiny qw(AbsDir);
|
|
use Sys::Hostname qw(hostname);
|
|
extends 'Catalyst::Component';
|
|
|
|
has('ca_selfsign_template', is => 'ro', isa => 'Str', default => sub { <<'' });
|
|
organization = "Sipwise GmbH"
|
|
unit = "Dept. of Issuing Snakeoil Certificates"
|
|
locality = "Brunn am Gebirge"
|
|
state = "Niederösterreich"
|
|
country = AT
|
|
cn = "*.sipwise.com"
|
|
expiration_days = 1000
|
|
ca
|
|
cert_signing_key
|
|
|
|
has('server_signingrequest_template', is => 'ro', isa => 'Str', default => sub { <<"" });
|
|
cn = "@{[ hostname ]}"
|
|
expiration_days = 365
|
|
tls_www_server
|
|
signing_key
|
|
encryption_key
|
|
|
|
has('server_signing_template', is => 'ro', isa => 'Str', default => sub { <<'' });
|
|
expiration_days = 365
|
|
honor_crq_extensions
|
|
|
|
sub client_signing_template {
|
|
my ($self, $serial) = @_;
|
|
return <<"";
|
|
cn = "Sipwise NGCP API client certificate"
|
|
expiration_days = 365
|
|
serial = $serial
|
|
tls_www_client
|
|
signing_key
|
|
encryption_key
|
|
|
|
}
|
|
|
|
has('log', is => 'rw', isa => 'Log::Log4perl::Catalyst',);
|
|
has('prefix', is => 'ro', isa => AbsDir, coerce => 1, default => '/etc/ssl/ngcp/api');
|
|
|
|
sub COMPONENT {
|
|
my ($class, $app, $args) = @_;
|
|
$args = $class->merge_config_hashes($class->config, $args);
|
|
my $self = $class->new($app, $args);
|
|
no autobox::Core; # wonky initialisation order
|
|
$self->log($app->log);
|
|
return $self;
|
|
}
|
|
|
|
sub make_ca {
|
|
my ($self) = @_;
|
|
my $command = sprintf 'certtool -p --bits 3248 --outfile %s 1>&- 2>&-', $self->prefix->child('ca-key.pem');
|
|
warn "$command\n";
|
|
system $command;
|
|
my $ca_selfsign_template = Path::Tiny->tempfile;
|
|
$ca_selfsign_template->spew_utf8($self->ca_selfsign_template);
|
|
$command = sprintf 'certtool -s --load-privkey %s --outfile %s --template %s 1>&- 2>&-',
|
|
$self->prefix->child('ca-key.pem'), $self->prefix->child('ca-cert.pem'), $ca_selfsign_template->stringify;
|
|
warn "$command\n";
|
|
system $command;
|
|
return;
|
|
}
|
|
|
|
sub make_server {
|
|
my ($self) = @_;
|
|
my $command = sprintf 'certtool -p --bits 3248 --outfile %s 1>&- 2>&-', $self->prefix->child('server-key.pem');
|
|
warn "$command\n";
|
|
system $command;
|
|
my $server_signingrequest_template = Path::Tiny->tempfile;
|
|
$server_signingrequest_template->spew($self->server_signingrequest_template);
|
|
$command = sprintf 'certtool -q --load-privkey %s --outfile %s --template %s 1>&- 2>&-',
|
|
$self->prefix->child('server-key.pem'), $self->prefix->child('server-csr.pem'),
|
|
$server_signingrequest_template->stringify;
|
|
warn "$command\n";
|
|
system $command;
|
|
my $server_signing_template = Path::Tiny->tempfile;
|
|
$server_signing_template->spew($self->server_signing_template);
|
|
$command = sprintf 'certtool -c --load-request %s --outfile %s --load-ca-certificate %s --load-ca-privkey %s ' .
|
|
'--template %s 1>&- 2>&-', $self->prefix->child('server-csr.pem'), $self->prefix->child('server-cert.pem'),
|
|
$self->prefix->child('ca-cert.pem'), $self->prefix->child('ca-key.pem'), $server_signing_template->stringify;
|
|
warn "$command\n";
|
|
system $command;
|
|
return;
|
|
}
|
|
|
|
sub make_client {
|
|
my ($self, $serial) = @_;
|
|
my $client_key = Path::Tiny->tempfile;
|
|
my $command = sprintf 'certtool -p --bits 3248 --outfile %s 1>&- 2>&-', $client_key->stringify;
|
|
$self->log->debug($command);
|
|
system $command;
|
|
my $client_signing_template = Path::Tiny->tempfile;
|
|
$client_signing_template->spew($self->client_signing_template($serial));
|
|
my $client_cert = Path::Tiny->tempfile;
|
|
$command = sprintf 'certtool -c --load-privkey %s --outfile %s --load-ca-certificate %s --load-ca-privkey %s ' .
|
|
'--template %s 1>&- 2>&-', $client_key->stringify, $client_cert->stringify, $self->prefix->child('ca-cert.pem'),
|
|
$self->prefix->child('ca-key.pem'), $client_signing_template->stringify;
|
|
$self->log->debug($command);
|
|
system $command;
|
|
my $cert_file = $self->client_cert_file($serial);
|
|
$cert_file->spew($client_cert->slurp . $client_key->slurp =~ s/.*(?=-----BEGIN RSA PRIVATE KEY-----)//mrs);
|
|
return;
|
|
}
|
|
|
|
sub client_cert_file {
|
|
my ($self, $serial) = @_;
|
|
return $self->prefix->child("NGCP-API-client-certificate-$serial.pem");
|
|
}
|
|
|
|
__END__
|
|
|
|
=encoding UTF-8
|
|
|
|
=head1 NAME
|
|
|
|
NGCP::Panel::Model::CA - certificate management model
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
=head2 Generating prerequisite root certificates
|
|
|
|
perl -mNGCP::Panel::Model::CA -e'
|
|
NGCP::Panel::Model::CA->new->make_ca;
|
|
NGCP::Panel::Model::CA->new->make_server;
|
|
'
|