[gentoo-dev] RFC: Generating initial/testing SSL certificates

[Max Kalika]

Greetings.

There are several ebuilds currently that would benefit from having an
initial self-signed certificate.  Whether this is used for testing, or
simple home servers or what-have-you.

Some of these ebuilds (postfix, apache, cyrus-imspd) contain a
gentestcrt.sh script to do this.  This script resides in ${FILESDIR} and
takes some
effort to run from the ebuild.  Here's a snippet from postfix:

        if [ "`use ssl`" ] ; then
                einfo "Generating self-signed test certificate."
                (yes "" | "${FILESDIR}/gentestcrt.sh") &>/dev/null
                (cat server.key && echo && cat server.crt) > server.pem
                insinto /etc/ssl/postfix
                doins server.{key,crt,pem}
                fowners postfix:root /etc/ssl/postfix/server.{key,crt,pem}
                fperms 0400 /etc/ssl/postfix/server.{key,crt,pem}
        fi

Another limitation of this script is that you don't get a CSR that you can
use to request a "real" certificate.

To alleviate some of these issues, I threw together an ssl-cert.eclass. The
code and docs are available here:

  <http://dev.gentoo.org/~max/ebuilds/eclass/ssl-cert.eclass>
  <http://dev.gentoo.org/~max/ebuilds/eclass/ssl-cert.5.txt>
  <http://dev.gentoo.org/~max/ebuilds/eclass/ssl-cert.5>

So the above mess from postfix can be rewritten like so:

  inherit ssl-cert
  ...
  	if [ "`use ssl`" ] ; then
		insinto /etc/ssl/postfix
		docert server
		fowners postfix /etc/ssl/postfix/server.{key,crt,pem}
	then

This also gives you a csr and there's no need for the gentestcrt.sh script
in ${FILESDIR}.

Would this be a worthy candidate for inclusion?  Criticism welcome. :-)

--mk

--
gentoo-dev@g.o mailing list