From 3a89da18438cff6ab4b10dc6da96d1e061da4e4f Mon Sep 17 00:00:00 2001 From: majestick Date: Sun, 21 Jul 2013 11:24:22 +0200 Subject: [PATCH 1/8] added 2 new functions added is_ip and is_fqdn for alt_name check --- include/my_functions.php | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/include/my_functions.php b/include/my_functions.php index ee3f998..a381d1b 100644 --- a/include/my_functions.php +++ b/include/my_functions.php @@ -185,6 +185,30 @@ function is_email($v) { return (eregi('^[^@ ]+\@[^@ ]+\.[A-Z]{2,4}$',$v) ? true : false); } +# +# Returns True if the given string is a IP address +# +function is_ip( $ip = null ) { + if( !$ip or strlen(trim($ip)) == 0){ + return false; + } + $ip=trim($ip); + if(preg_match("/^[0-9]{1,3}(.[0-9]{1,3}){3}$/",$ip)) { + foreach(explode(".", $ip) as $block) + if($block<0 || $block>255 ) + return false; + return true; + } + return false; +} + +# +# Returns True if the given string is a valid FQDN +# +function is_fqdn($FQDN) { + return (!empty($FQDN) && preg_match('/(?=^.{1,254}$)(^(?:(?!\d|-)[a-z0-9\-]{1,63}(? 0); +} + # # Checks regexp in every element of an array, returns TRUE as soon # as a match is found. From bfd521a5fc0e7ffc88686dd73e9081c1e586fb36 Mon Sep 17 00:00:00 2001 From: majestick Date: Sun, 21 Jul 2013 11:31:44 +0200 Subject: [PATCH 2/8] added alt_names for ssl vert --- include/openssl_functions.php | 53 +++++++++++++++++++++++++++++------ 1 file changed, 44 insertions(+), 9 deletions(-) diff --git a/include/openssl_functions.php b/include/openssl_functions.php index cc1f69e..c22c0c2 100644 --- a/include/openssl_functions.php +++ b/include/openssl_functions.php @@ -5,11 +5,42 @@ // File name is placed in ./tmp with a random name. It lingers unless // removed manually. // -function CA_create_cnf($country='',$province='',$locality='',$organization='',$unit='',$common_name='',$email='',$keysize=4096) { +function CA_create_cnf($country='',$province='',$locality='',$organization='',$unit='',$common_name='',$email='',$keysize=4096,$dns_names='',$ip_addr='') { global $config, $PHPki_user; $issuer = $PHPki_user; + $count_dns = 0; + $count_ip = 0; + $alt_names = ""; + + if (! $dns_names == '') { + + $dns_n=explode("\n", $dns_names); + $count_dns = $count_dns + 1; + $alt_names .= "DNS.$count_dns = $common_name\n"; + + foreach ($dns_n as $value) { + $count_dns = $count_dns + 1; + $alt_names .= "DNS.$count_dns = ".trim($value)."\n"; + } + } + + if (! $ip_addr == '') { + $ip_ar=explode("\n", $ip_addr); + foreach ($ip_ar as $value) { + $count_dns = $count_dns + 1; + $count_ip = $count_ip + 1; + $alt_names .= "DNS.$count_dns = ".trim($value)."\n"; + $alt_names .= "IP.$count_ip = ".trim($value)."\n"; + } + } + if (($count_dns > 0) || ($count_ip > 0)) { + $server_altnames = "@alt_names"; + } else { + $server_altnames = "DNS:$common_name,email:copy"; + } + $cnf_contents = " HOME = $config[home_dir] RANDFILE = $config[random] @@ -104,7 +135,7 @@ subjectKeyIdentifier = hash subjectAltName = email:copy crlDistributionPoints = URI:$config[base_url]index.php?stage=dl_crl nsComment = \"PHPki/OpenSSL Generated Root Certificate\" -#nsCaRevocationUrl = ns_revoke_query.php? +#nsCaRevocationUrl = $config[base_url]ns_revoke_query.php?$config[serial] nsCaPolicyUrl = $config[base_url]policy.html [ email_ext ] @@ -119,7 +150,7 @@ issuerAltName = issuer:copy crlDistributionPoints = URI:$config[base_url]index.php?stage=dl_crl nsComment = \"PHPki/OpenSSL Generated Personal Certificate\" nsBaseUrl = $config[base_url] -nsRevocationUrl = ns_revoke_query.php? +nsRevocationUrl = $config[base_url]ns_revoke_query.php?$config[serial] nsCaPolicyUrl = $config[base_url]policy.html [ email_signing_ext ] @@ -134,7 +165,7 @@ issuerAltName = issuer:copy crlDistributionPoints = URI:$config[base_url]index.php?stage=dl_crl nsComment = \"PHPki/OpenSSL Generated Personal Certificate\" nsBaseUrl = $config[base_url] -nsRevocationUrl = ns_revoke_query.php? +nsRevocationUrl = $config[base_url]ns_revoke_query.php?$config[serial] nsCaPolicyUrl = $config[base_url]policy.html [ server_ext ] @@ -144,12 +175,12 @@ nsCertType = critical, server extendedKeyUsage = critical, serverAuth subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always, issuer:always -subjectAltName = DNS:$common_name,email:copy +subjectAltName = $server_altnames issuerAltName = issuer:copy crlDistributionPoints = URI:$config[base_url]index.php?stage=dl_crl nsComment = \"PHPki/OpenSSL Generated Server Certificate\" nsBaseUrl = $config[base_url] -nsRevocationUrl = ns_revoke_query.php? +nsRevocationUrl = $config[base_url]ns_revoke_query.php?$config[serial] nsCaPolicyUrl = $config[base_url]policy.html [ time_stamping_ext ] @@ -163,7 +194,7 @@ issuerAltName = issuer:copy crlDistributionPoints = URI:$config[base_url]index.php?stage=dl_crl nsComment = \"PHPki/OpenSSL Generated Time Stamping Certificate\" nsBaseUrl = $config[base_url] -nsRevocationUrl = ns_revoke_query.php? +nsRevocationUrl = $config[base_url]ns_revoke_query.php?$config[serial] [ vpn_client_ext ] basicConstraints = critical, CA:false @@ -191,8 +222,12 @@ nsCertType = critical, server, client subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always, issuer:always subjectAltName = DNS:$common_name,email:copy + +[alt_names] +$alt_names "; + # Write out the config file. $cnf_file = tempnam('./tmp','cnf-'); $handle = fopen($cnf_file,"w"); @@ -466,7 +501,7 @@ function CA_revoke_cert($serial) { // // Returns an array containing the output of failed openssl commands. // -function CA_create_cert($cert_type='email',$country,$province,$locality,$organization,$unit,$common_name,$email,$expiry,$passwd,$keysize=1024) { +function CA_create_cert($cert_type='email',$country,$province,$locality,$organization,$unit,$common_name,$email,$expiry,$passwd,$keysize=1024,$dns_names,$ip_addr) { global $config; # Wait here if another user has the database locked. @@ -484,7 +519,7 @@ function CA_create_cert($cert_type='email',$country,$province,$locality,$organiz $expiry_days = round($expiry * 365.25, 0); - $cnf_file = CA_create_cnf($country,$province,$locality,$organization,$unit,$common_name,$email,$keysize); + $cnf_file = CA_create_cnf($country,$province,$locality,$organization,$unit,$common_name,$email,$keysize,$dns_names,$ip_addr); # Escape certain dangerous characters in user input $email = escshellcmd($email); From 8f4697e67f0492aac5cd47beca5e2132ca232b34 Mon Sep 17 00:00:00 2001 From: majestick Date: Sun, 21 Jul 2013 11:33:38 +0200 Subject: [PATCH 3/8] Update common.php --- include/common.php | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/include/common.php b/include/common.php index 1352cdc..1f2f8a5 100644 --- a/include/common.php +++ b/include/common.php @@ -38,6 +38,23 @@ function printHeader($withmenu="default") { PHPki: <?php echo $title?> + Date: Sun, 21 Jul 2013 11:35:17 +0200 Subject: [PATCH 4/8] added alt_names added alt_names for ssl server certificates. --- ca/request_cert.php | 61 +++++++++++++++++++++++++++++++++------------ 1 file changed, 45 insertions(+), 16 deletions(-) diff --git a/ca/request_cert.php b/ca/request_cert.php index 5e2d1b5..03aeb5d 100644 --- a/ca/request_cert.php +++ b/ca/request_cert.php @@ -25,7 +25,8 @@ $passwdv = gpvar('passwdv'); $expiry = gpvar('expiry'); $keysize = gpvar('keysize'); $cert_type = gpvar('cert_type'); - +$dns_names = gpvar('dns_names'); +$ip_addr = gpvar('ip_addr'); # To repopulate form after error. $hidden_fields = ' @@ -41,6 +42,8 @@ $hidden_fields = ' + + '; @@ -72,10 +75,21 @@ case 'validate': if ( $email && ! is_email($email) ) $er .= 'E-mail address ('. htvar($email) . ') may be invalid.
'; + $ip_ar=explode("\n", $ip_addr); + foreach ($ip_ar as $value){ + if ( $value && ! is_ip($value) ) + $er .= 'IP address ('. htvar($value) . ') may be invalid.
'; + } + + $dns_n=explode("\n", $dns_names); + foreach ($dns_n as $value){ + if ( $value && ! is_fqdn(trim($value)) ) + $er .= 'DNS Name ('. htvar($value) . ') may be invalid.
'; + } + if ( $er ) $er = '

ERROR(S) IN FORM:

' . $er . '

'; - if ($email && ($serial = CAdb_in($email,$common_name))) { $er = ''; $certtext = CA_cert_text($serial); @@ -119,6 +133,8 @@ case 'confirm': Certificate Life
Key Size
Certificate Use
+ IP Addresses
+ DNS Alt Names
@@ -133,6 +149,8 @@ case 'confirm': print htvar($expiry). ' Year'.($expiry == 1 ? '' : 's').'
'; print htvar($keysize). ' bits
'; print htvar($cert_type). '
'; + print htvar($dns_names). '
'; + print htvar($ip_addr). '
'; ?> @@ -168,7 +186,7 @@ case 'confirm': case 'final': if ($submit == "Yes! Create and Download") { if (! $serial = CAdb_in($email,$common_name)) { - list($ret,$errtxt) = CA_create_cert($cert_type,$country, $province, $locality, $organization, $unit, $common_name, $email, $expiry, $passwd, $keysize); + list($ret,$errtxt) = CA_create_cert($cert_type,$country, $province, $locality, $organization, $unit, $common_name, $email, $expiry, $passwd, $keysize,$dns_names,$ip_addr); if (! $ret) { printHeader(); @@ -227,6 +245,8 @@ default: if (! $expiry) $expiry = 1; if (! $keysize) $keysize = 1024; if (! $cert_type) $cert_type = 'email'; + if (! $dns_names) $dns_names = ""; + if (! $ip_addr) $ip_addr = ""; printHeader(); ?> @@ -236,44 +256,44 @@ default:

Certificate Request Form

- Common Name
(i.e. User real name or computer hostname) + Common Name*
(i.e. User real name or computer hostname) - E-mail Address + E-mail Address * - Organization (Company/Agency) + Organization (Company/Agency)* - Department/Unit + Department/Unit* - Locality (City/County) + Locality (City/County)* - State/Province + State/Province* - Country + Country* - Certificate Password + Certificate Password*    Again - Certificate Life + Certificate Life* - Certificate Use: - E-mail, SSL Client'; print ''; @@ -317,8 +338,16 @@ default: + + Alternative DNS Names
(only one per Line) + + + + IP's
(only one per Line) + + -
* All fields are required +
* Fields are required From d13be16a798d19b32d034120c790d109b5ed712b Mon Sep 17 00:00:00 2001 From: majestick Date: Mon, 22 Jul 2013 06:24:54 +0200 Subject: [PATCH 5/8] fixed nsRevocationUrl fixed nsRevocationUrl. fixed Empty DNS Names Strings --- include/openssl_functions.php | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/include/openssl_functions.php b/include/openssl_functions.php index c22c0c2..62ca07b 100644 --- a/include/openssl_functions.php +++ b/include/openssl_functions.php @@ -5,7 +5,7 @@ // File name is placed in ./tmp with a random name. It lingers unless // removed manually. // -function CA_create_cnf($country='',$province='',$locality='',$organization='',$unit='',$common_name='',$email='',$keysize=4096,$dns_names='',$ip_addr='') { +function CA_create_cnf($country='',$province='',$locality='',$organization='',$unit='',$common_name='',$email='',$keysize=4096,$dns_names='',$ip_addr='',$serial='') { global $config, $PHPki_user; $issuer = $PHPki_user; @@ -18,20 +18,23 @@ function CA_create_cnf($country='',$province='',$locality='',$organization='',$u $dns_n=explode("\n", $dns_names); $count_dns = $count_dns + 1; $alt_names .= "DNS.$count_dns = $common_name\n"; - foreach ($dns_n as $value) { + if (! $value == '') { $count_dns = $count_dns + 1; $alt_names .= "DNS.$count_dns = ".trim($value)."\n"; + } } } if (! $ip_addr == '') { $ip_ar=explode("\n", $ip_addr); foreach ($ip_ar as $value) { + if (! $value == '') { $count_dns = $count_dns + 1; $count_ip = $count_ip + 1; $alt_names .= "DNS.$count_dns = ".trim($value)."\n"; $alt_names .= "IP.$count_ip = ".trim($value)."\n"; + } } } @@ -44,7 +47,7 @@ function CA_create_cnf($country='',$province='',$locality='',$organization='',$u $cnf_contents = " HOME = $config[home_dir] RANDFILE = $config[random] -dir = $config[ca_dir] +dir = $config[ca_dir] certs = $config[cert_dir] crl_dir = $config[crl_dir] database = $config[index] @@ -135,7 +138,7 @@ subjectKeyIdentifier = hash subjectAltName = email:copy crlDistributionPoints = URI:$config[base_url]index.php?stage=dl_crl nsComment = \"PHPki/OpenSSL Generated Root Certificate\" -#nsCaRevocationUrl = $config[base_url]ns_revoke_query.php?$config[serial] +#nsCaRevocationUrl = $config[base_url]ns_revoke_query.php?$serial nsCaPolicyUrl = $config[base_url]policy.html [ email_ext ] @@ -150,7 +153,7 @@ issuerAltName = issuer:copy crlDistributionPoints = URI:$config[base_url]index.php?stage=dl_crl nsComment = \"PHPki/OpenSSL Generated Personal Certificate\" nsBaseUrl = $config[base_url] -nsRevocationUrl = $config[base_url]ns_revoke_query.php?$config[serial] +nsRevocationUrl = $config[base_url]ns_revoke_query.php?$serial nsCaPolicyUrl = $config[base_url]policy.html [ email_signing_ext ] @@ -165,7 +168,7 @@ issuerAltName = issuer:copy crlDistributionPoints = URI:$config[base_url]index.php?stage=dl_crl nsComment = \"PHPki/OpenSSL Generated Personal Certificate\" nsBaseUrl = $config[base_url] -nsRevocationUrl = $config[base_url]ns_revoke_query.php?$config[serial] +nsRevocationUrl = $config[base_url]ns_revoke_query.php?$serial nsCaPolicyUrl = $config[base_url]policy.html [ server_ext ] @@ -180,7 +183,7 @@ issuerAltName = issuer:copy crlDistributionPoints = URI:$config[base_url]index.php?stage=dl_crl nsComment = \"PHPki/OpenSSL Generated Server Certificate\" nsBaseUrl = $config[base_url] -nsRevocationUrl = $config[base_url]ns_revoke_query.php?$config[serial] +nsRevocationUrl = $config[base_url]ns_revoke_query.php?$serial nsCaPolicyUrl = $config[base_url]policy.html [ time_stamping_ext ] @@ -194,7 +197,7 @@ issuerAltName = issuer:copy crlDistributionPoints = URI:$config[base_url]index.php?stage=dl_crl nsComment = \"PHPki/OpenSSL Generated Time Stamping Certificate\" nsBaseUrl = $config[base_url] -nsRevocationUrl = $config[base_url]ns_revoke_query.php?$config[serial] +nsRevocationUrl = $config[base_url]ns_revoke_query.php?$serial [ vpn_client_ext ] basicConstraints = critical, CA:false @@ -519,11 +522,11 @@ function CA_create_cert($cert_type='email',$country,$province,$locality,$organiz $expiry_days = round($expiry * 365.25, 0); - $cnf_file = CA_create_cnf($country,$province,$locality,$organization,$unit,$common_name,$email,$keysize,$dns_names,$ip_addr); + $cnf_file = CA_create_cnf($country,$province,$locality,$organization,$unit,$common_name,$email,$keysize,$dns_names,$ip_addr,$serial); # Escape certain dangerous characters in user input $email = escshellcmd($email); - $_passwd = escshellarg($passwd); + $_passwd = escshellarg($passwd); $friendly_name = escshellarg($common_name); $extensions = escshellarg($cert_type.'_ext'); From b74ad34404aae58a7e2dd3636803fbb95c31de66 Mon Sep 17 00:00:00 2001 From: majestick Date: Mon, 22 Jul 2013 22:26:36 +0200 Subject: [PATCH 6/8] Set default Charset --- include/common.php | 1 + 1 file changed, 1 insertion(+) diff --git a/include/common.php b/include/common.php index 1f2f8a5..4713dd3 100644 --- a/include/common.php +++ b/include/common.php @@ -36,6 +36,7 @@ function printHeader($withmenu="default") { ?> + PHPki: <?php echo $title?>