adding crl and ca-issuers url

diff --git a/src/config.cpp b/src/config.cpp
index acdaafbe8faea60a58b97ccb8d6b8178edd817eb..4440d09f267e4fc81cf2cfc67f506aac5b21dd6b 100644 (file)
--- a/src/config.cpp
+++ b/src/config.cpp
@@ -13,6 +13,8 @@ std::unordered_map<std::string, Profile> profiles;
 std::unordered_map<std::string, std::shared_ptr<CAConfig>> CAs;
 std::string sqlHost, sqlUser, sqlPass, sqlDB;
 std::string serialPath;
+std::string crlPrefix;
+std::string crtPrefix;
 
 std::shared_ptr<std::unordered_map<std::string, std::string>> parseConf( std::string path ) {
     auto map = std::make_shared<std::unordered_map<std::string, std::string>>();
@@ -138,6 +140,8 @@ int parseConfig( std::string path ) {
     sqlPass = masterConf->at( "sql.password" );
     sqlDB = masterConf->at( "sql.database" );
     serialPath = masterConf->at( "serialPath" );
+    crlPrefix = masterConf->at( "crlPrefix" );
+    crtPrefix = masterConf->at( "crtPrefix" );
 
     if( keyDir == "" ) {
         logger::error( "Missing config property key.directory" );

diff --git a/src/crypto/X509.cpp b/src/crypto/X509.cpp
index 06a3fd5f181abd5327b6c6a6175cad0240de07b5..51f206b7cb63fcc7181ff2620104b73a200f72ac 100644 (file)
--- a/src/crypto/X509.cpp
+++ b/src/crypto/X509.cpp
@@ -174,15 +174,15 @@ merr:
     throw "memerr";
 }
 
-void X509Cert::setExtensions( std::shared_ptr<X509> caCert, std::vector<std::shared_ptr<SAN>>& sans, Profile& prof ) {
+void X509Cert::setExtensions( std::shared_ptr<X509> caCert, std::vector<std::shared_ptr<SAN>>& sans, Profile& prof, std::string crlURL, std::string crtURL ) {
     add_ext( caCert, target, NID_basic_constraints, "critical,CA:FALSE" );
     add_ext( caCert, target, NID_subject_key_identifier, "hash" );
     add_ext( caCert, target, NID_authority_key_identifier, "keyid,issuer:always" );
     std::string ku = std::string( "critical," ) + prof.ku;
     add_ext( caCert, target, NID_key_usage, ku.c_str() );
     add_ext( caCert, target, NID_ext_key_usage, prof.eku.c_str() );
-    add_ext( caCert, target, NID_info_access, "OCSP;URI:http://ocsp.cacert.org" );
-    add_ext( caCert, target, NID_crl_distribution_points, "URI:http://crl.cacert.org/class3-revoke.crl" );
+    add_ext( caCert, target, NID_info_access, ("OCSP;URI:http://ocsp.cacert.org,caIssuers;URI:" + crtURL).c_str() );
+    add_ext( caCert, target, NID_crl_distribution_points, ("URI:" + crlURL).c_str() );
 
     if( sans.empty() ) {
         return;

diff --git a/src/crypto/X509.h b/src/crypto/X509.h
index ac0e3d3791baa28a813029b2c2b914d3873dd040..71b0de1efc58306a2e9fe270482d66e9d81e63ec 100644 (file)
--- a/src/crypto/X509.h
+++ b/src/crypto/X509.h
@@ -32,7 +32,7 @@ public:
     void setIssuerNameFrom( std::shared_ptr<X509> ca );
     void setPubkeyFrom( std::shared_ptr<X509Req> r );
     void setSerialNumber( BIGNUM* num );
-    void setExtensions( std::shared_ptr<X509> caCert, std::vector<std::shared_ptr<SAN>>& sans, Profile& prof );
+    void setExtensions( std::shared_ptr<X509> caCert, std::vector<std::shared_ptr<SAN>>& sans, Profile& prof, std::string crlURL, std::string crtURL );
     void setTimes( uint32_t before, uint32_t after );
     std::shared_ptr<SignedCertificate> sign( std::shared_ptr<EVP_PKEY> caKey, std::string signAlg );
 };

diff --git a/src/crypto/simpleOpensslSigner.cpp b/src/crypto/simpleOpensslSigner.cpp
index b332818291f2e28b751e51fd1d1fc2dd0f34dcc2..98c5f1fd0b83ee4ad80d90ae3d67ca7801b553d7 100644 (file)
--- a/src/crypto/simpleOpensslSigner.cpp
+++ b/src/crypto/simpleOpensslSigner.cpp
@@ -223,7 +223,7 @@ std::shared_ptr<SignedCertificate> SimpleOpensslSigner::sign( std::shared_ptr<TB
     }
 
     logger::note( "INFO: Setting extensions:" );
-    c.setExtensions( ca->ca, cert->SANs, prof );
+    c.setExtensions( ca->ca, cert->SANs, prof, ca->crlURL, ca->crtURL );
     logger::note( "FINE: Setting extensions successful." );
 
     logger::note( "INFO: Generating next Serial Number ..." );

diff --git a/src/crypto/sslUtil.cpp b/src/crypto/sslUtil.cpp
index 81db0ba4f1d55db3dcdfd713b8c6cce12917d751..05689c05aaed8dc8f5a34bc71ee62d2663072863 100644 (file)
--- a/src/crypto/sslUtil.cpp
+++ b/src/crypto/sslUtil.cpp
@@ -188,11 +188,24 @@ std::shared_ptr<BIO> openSerial( const std::string& name ) {
         } );
 }
 
+extern std::string crlPrefix;
+extern std::string crtPrefix;
+
 CAConfig::CAConfig( const std::string& name ) : path( "ca/" + name ), name( name ) {
     ca = loadX509FromFile( path + "/ca.crt" );
     caKey = loadPkeyFromFile( path + "/ca.key" );
     ASN1_TIME* tm = X509_get_notBefore( ca );
     notBefore = std::shared_ptr<ASN1_TIME>( tm, ASN1_TIME_free );
+    std::size_t pos = name.find("_");
+    if (pos == std::string::npos) {
+        throw new std::invalid_argument("ca name: " + name + " is malformed.");
+    }
+    std::size_t pos2 = name.find("_", pos + 1);
+    if (pos2 == std::string::npos) {
+        throw new std::invalid_argument("ca name: " + name + " is malformed.");
+    }
+    crlURL = crlPrefix + "/g2/" + name.substr(pos+1, pos2-pos - 1) + "/" + name.substr(0,pos) + "-" + name.substr(pos2+1) + ".crl";
+    crtURL = crtPrefix + "/g2/" + name.substr(pos+1, pos2-pos - 1) + "/" + name.substr(0,pos) + "-" + name.substr(pos2+1) + ".crt";
 }
 
 std::string timeToString( std::shared_ptr<ASN1_TIME> time ) {

diff --git a/src/crypto/sslUtil.h b/src/crypto/sslUtil.h
index 6ecb536cd5cac1ca479239da1411d042595d5925..4a451b3a1903aae6d251c1579f5e71efbe89c79a 100644 (file)
--- a/src/crypto/sslUtil.h
+++ b/src/crypto/sslUtil.h
@@ -13,6 +13,8 @@
 struct CAConfig {
     std::string path;
     std::string name;
+    std::string crlURL;
+    std::string crtURL;
 
     std::shared_ptr<X509> ca;
     std::shared_ptr<EVP_PKEY> caKey;