unsupported certificate purpose when using one-step request/sign of ssl-admin 1.2.1_2

[dlangille]

I created a new cert today, with a CA I haven't used in a while.

I used option 4) Perform a one-step request/sign

Bacula complains about this cert: ERR=26:unsupported certificate purpose

Comparing that cert with one that works, created with the same CA, I notice this difference. The non-working cert contains this section just before the Signature Algorithm section:

        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: 
                Digital Signature, Non Repudiation, Key Encipherment, Key Agreement
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://CRL_URI

What's up with that?

[dlangille]

My past notes on this, and why option 4 is the one I use.

• similar problem, same cause, openvpn: https://dan.langille.org/2021/06/17/openvpn-unsupported-certificate-purpose/
• SSL client vs server certificates and bacula-fd
  : https://dan.langille.org/2019/11/29/ssl-client-vs-server-certificates-and-bacula-fd/

[dlangille]

This patch, ssl-admin.txt, copied below, seems to work, at least for option 4. I have done no further testing. It creates the right type of client cert my my needs.

It removes references to -extensions v3_req

[mydev dan /usr/local/etc/ssl-admin/csr] % diff -ruN /usr/local/bin/ssl-admin ~/tmp/ssl-admin
--- /usr/local/bin/ssl-admin	2022-07-16 12:15:55.000000000 +0000
+++ /usr/home/dan/tmp/ssl-admin	2023-02-25 00:38:55.582286000 +0000
@@ -141,9 +141,9 @@
 		chomp($yn = <>);
 	} until $yn =~ m/^[yn]$/;
 	if ($yn eq "y") {
-		system("cd $working_dir && openssl req -new -keyout $cn.key -out $cn.csr -config $key_config -batch -extensions v3_req");
+		system("cd $working_dir && openssl req -new -keyout $cn.key -out $cn.csr -config $key_config -batch");
 	} elsif ($yn eq "n") {
-		system("cd $working_dir && openssl req -nodes -new -keyout $cn.key -out $cn.csr -config $key_config -batch -extensions v3_req");
+		system("cd $working_dir && openssl req -nodes -new -keyout $cn.key -out $cn.csr -config $key_config -batch");
 	}
 }
 
@@ -153,7 +153,7 @@
 
 	if ($intermediate eq "NO"){
 		print "=========> Signing request for $cn\n";
-		`cd $working_dir && openssl ca -config $key_config -days $key_days -out $cn.crt -in $cn.csr -batch -extensions v3_req`;
+		`cd $working_dir && openssl ca -config $key_config -days $key_days -out $cn.crt -in $cn.csr -batch`;
 	} elsif ($intermediate eq "YES"){
 		print "=========> Signing new Intermediate CA request for $cn\n";
 		`cd $working_dir && openssl ca -config $key_config -policy policy_new_ca -out $cn.crt -extensions v3_ca -infiles $cn.csr -batch`;

[dlangille]

I don't know how to reconcile the problems from #1 with this issue.

[ecrist]

i haven't had the time or inclination to work on this project for a while. Maintaining EasyRSA is enough work as it is, and I originally wrote ssl-admin because EasyRSA wasn't maintained well at the time. Funny how that works.

The ssl-admin script hasn't been vetted with modern/current perl modules and base perl, nor has it been vetted with the latest incantations of OpenSSL. I probably last tested it with any vigor on 0.9.7c or something.

All this said, it doesn't mean I don't want to work on this. I'm not going to right now (it's a cool 49ºF on a sunny friday morning and I'm off work). I will work on this soon, maybe even this evening. Keep poking me here and via email and I'll get it working. I can resolve all the open issues, it's going to take several hours to setup a workable dev environment and re-wrap my head around my perl code.

Poke me again, even today in 8 hours and I might sit down and work on this.

[dlangille]

Ironically, easy-rsa seems like it's getting updated on a regular basis.

I also have stuff I no longer work on. Interests change.

[ecrist]

Keep poking me. I'll get to it. 😎 Eric F Crist

…

________________________________ From: Dan Langille ***@***.***> Sent: Friday, August 18, 2023 12:02:14 PM To: ecrist/ssl-admin ***@***.***> Cc: Eric F Crist ***@***.***>; Comment ***@***.***> Subject: Re: [ecrist/ssl-admin] unsupported certificate purpose when using one-step request/sign of ssl-admin 1.2.1_2 (Issue #5) Ironically, easy-rsa seems like it's getting updated on a regular basis. I also have stuff I no longer work on. Interests change. — Reply to this email directly, view it on GitHub<#5 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AANXQP35CJTPACR7GY6MCKTXV6NZNANCNFSM6AAAAAAVF7EEGM>. You are receiving this because you commented.Message ID: ***@***.***>

[ecrist]

Ok, please let me know if this is still happening in v1.3.0.

[dlangille]

This works here for me.

When I compare the ssl-admin-1.3.0 cert with the one created with my patches, the following is present in the former, but not the latter.

        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: 
                Digital Signature, Non Repudiation, Key Encipherment, Key Agreement
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://CRL_URI

Which makes sense to me.

Now I need to specify the CRL_URI.

Thank you @ecrist - I hope this was enjoyable/satisfactory for you. I know how it feels.

[dlangille]

OH, I just saw the note: 'you need to use the included make file and configure script, too!' I haven't been building with this.

EDIT: Oh, wait, I think "FreeBSD port maintainer - you need to use the included make file and configure script, too!" is not a new instruction. I thought it meant things had changed. They haven't. Any Makefile inside the tarball is 7 years old.

I'll commit what I have (i.e. update the FreeBSD port) and get more feedback.

[ecrist]

That's why version numbers and paths aren't set properly. When I build the tarball I run the build script, and that sets up a few things. The configure script then sets paths based on OS. Finally, the Makefile replaced version strings, paths, and installs files to appropriate places based on OS. The FreeBSD port should be using these scripts as well. Eric F Crist

…

________________________________ From: Dan Langille ***@***.***> Sent: Saturday, August 19, 2023 9:30:16 PM To: ecrist/ssl-admin ***@***.***> Cc: Eric F Crist ***@***.***>; Mention ***@***.***> Subject: Re: [ecrist/ssl-admin] unsupported certificate purpose when using one-step request/sign of ssl-admin 1.2.1_2 (Issue #5) OH, I just saw the note: 'you need to use the included make file and configure script, too!' I haven't been building with this. — Reply to this email directly, view it on GitHub<#5 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AANXQPZ3ABSACHMKEQ2PGELXWFZDRANCNFSM6AAAAAAVF7EEGM>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[dlangille]

Understood.

When comparing the faulty build (in FreeBSD as 1.3.0) and the build using the asset tarball, here are the differences I see:

• Copyright
• VERSION
• this is moved down about 13 lines print "This program will walk you through requesting, signing,\norganizing and revoking SSL certificates.\n\n";
• The bottom 20 lines are different (mostly related to CRL I think).

Edit: attached a diff:

[13:46 mydev dan ~] % diff -ruN ~/tmp/ssl-admin-1.3.0 /usr/local/bin/ssl-admin 
--- /usr/home/dan/tmp/ssl-admin-1.3.0	2023-08-20 13:31:48.654068000 +0000
+++ /usr/local/bin/ssl-admin	2023-08-20 13:32:12.000000000 +0000
@@ -1,6 +1,6 @@
 #!/usr/local/bin/perl
 #
-# Copyright (c) 2007, Eric F Crist
+# Copyright (c) 2007-2023 Eric F Crist
 #
 # All rights reserved.
 #
@@ -27,7 +27,7 @@
 # NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 # SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #
-# VERSION: 1.2.1
+# VERSION: 1.3.0
 
 use strict;
 use warnings;
@@ -258,7 +258,7 @@
 sub main_menu {
 	update_serial();
 	print "\n\n=====================================================\n";
-	print '#               SSL-ADMIN v1.2.1                    #';
+	print '#               SSL-ADMIN v1.3.0                    #';
 	print "\n=====================================================\n";
 	print "Please enter the menu option from the following list:\n";
 	print "1) Update run-time options:\n";
@@ -527,7 +527,6 @@
 	print "$working_dir doesn't exist.  Is the variable set correctly?\n";
 	exit 1;
 }
-print "This program will walk you through requesting, signing,\norganizing and revoking SSL certificates.\n\n";
 if ($> != 0){
 	if ($build eq "devel"){
 		print "\n\nRunning devel build - this isn't secure!\n\n";
@@ -540,6 +539,7 @@
 
 	if ( ! -e "$working_dir/active"){
 		my $yn;
+		print "This program will walk you through requesting, signing,\norganizing and revoking SSL certificates.\n\n";
 		print "Looks like this is a new install, installing...\n";
 		do {
 			print "You will first need to edit the /usr/local/etc/ssl-admin/ssl-admin.conf\n";
@@ -624,6 +624,15 @@
 	print "===> Creating initial CRL.";
 	system("cd $working_dir/active && openssl ca -gencrl -batch -config $key_config -out $crl");
 }
+
+if ($#ARGV >= 0){
+	if ($ARGV[0] eq "crl"){
+		# generate a CRL and exit
+		`cd $working_dir/active && openssl ca -gencrl -out $crl -config $key_config 2>&1 > /dev/null`;
+		exit 0;
+	}
+}
+
 my $install_date = `cat $working_dir/prog/install`;
 print "ssl-admin installed $install_date";
 update_serial();
@@ -633,6 +642,7 @@
 if ( ! -e "$working_dir/packages/client.ovpn"){
 	print "OPTIONAL: I can't find your OpenVPN client config.  Please copy your config to\n$working_dir/packages/client.ovpn";
 }
+
 while ($menu_item ne "q"){
 	main_menu();
 }
[13:46 mydev dan ~] % 

[dlangille]

committed to the FreeBSD ports tree as 1.3.0_1

[ecrist]

The tag and release tarballs are a little wacky since I did the git commit locally and forgot to push before tagging. That's my fault. I'll probably spend some time tonight fixing a few things. I won't push another release for a while though. Now is the time to put in those feature requests! Eric F Crist

…

________________________________ From: Dan Langille ***@***.***> Sent: Sunday, August 20, 2023 8:53:57 AM To: ecrist/ssl-admin ***@***.***> Cc: Eric F Crist ***@***.***>; Mention ***@***.***> Subject: Re: [ecrist/ssl-admin] unsupported certificate purpose when using one-step request/sign of ssl-admin 1.2.1_2 (Issue #5) committed to the FreeBSD ports tree as 1.3.0_1 — Reply to this email directly, view it on GitHub<#5 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AANXQP34T6QKBOSNBP7OON3XWIJHLANCNFSM6AAAAAAVF7EEGM>. You are receiving this because you were mentioned.Message ID: ***@***.***>