[debian-edu-commits] [Git][debian-edu/debian-edu-config][mr/fix-root-ca-cert-openssl-v3] 2 commits: tools/create-debian-edu-certs: Fix script to apply correct configurations

[Daniel Teichmann (@dzatoah)]

Daniel Teichmann pushed to branch mr/fix-root-ca-cert-openssl-v3 at Debian Edu / debian-edu-config


Commits:
326e8533 by Daniel Teichmann at 2026-03-11T13:02:09+01:00
tools/create-debian-edu-certs: Fix script to apply correct configurations

1. It failed to apply the $V3_CA_CONF extensions when generating the Root CA,
   resulting in a CA missing its basic constraints.

2. It erroneously used the CA configuration ($SSL_CA_CONF) instead of the
   server configuration ($SSL_CONF) when generating the server CSR.
   This caused the Root CA and the Server Certificate to share identical
   Subject DNs, confusing the OpenSSL 3 validation chain.

This commit corrects the openssl req invocations to use the appropriate
configuration and extension files.

- - - - -
72fc0d7c by Daniel Teichmann at 2026-03-11T13:05:18+01:00
tools/create-server-cert: Add OpenSSL 3 extensions and fix base config

* Injects missing `keyUsage` and `extendedKeyUsage` into the generated
  v3.conf to satisfy OpenSSL 3 strict validation requirements.
* Switches the template from `sslCA.cnf` to `ssl.cnf` so server
  certificates do not inherit the Root CA's Organizational Unit.

NOTE: These are fixes, which come from previous commits.
      See history of create-debian-edu-certs for more info.

- - - - -


2 changed files:

- share/debian-edu-config/tools/create-debian-edu-certs
- share/debian-edu-config/tools/create-server-cert


Changes:

=====================================
share/debian-edu-config/tools/create-debian-edu-certs
=====================================
@@ -33,10 +33,11 @@ SERVER_KEY="$KEY_DIR/debian-edu-server.key"
 generate() {
     # Generate Debian Edu root CA private key.
     openssl genrsa -out $CA_KEY 2048
-    # Request rootCA certificate.
-    openssl req -x509 -new -nodes -key $CA_KEY -days 3650 -out $CA_CERT -config $SSL_CA_CONF
+    # Request rootCA CSR and self-sign it to apply v3 extensions.
+    openssl req -new -nodes -key $CA_KEY -out $TMP/ca.csr -config $SSL_CA_CONF
+    openssl x509 -req -in $TMP/ca.csr -signkey $CA_KEY -days 3650 -out $CA_CERT -extfile $V3_CA_CONF
     # Request web server key.
-    openssl req -new -nodes -out $TMP/server.csr -newkey rsa:2048 -keyout $SERVER_KEY -config $SSL_CA_CONF
+    openssl req -new -nodes -out $TMP/server.csr -newkey rsa:2048 -keyout $SERVER_KEY -config $SSL_CONF
     # Request web server certificate.
     openssl x509 -req -in $TMP/server.csr -CA $CA_CERT -CAkey $CA_KEY -CAcreateserial -out $SERVER_CERT -days 3650 -extfile $V3_CONF
     # Adjust owner and rights.


=====================================
share/debian-edu-config/tools/create-server-cert
=====================================
@@ -135,20 +135,23 @@ csrfile="${certname}.csr"
 
 tempdir=$(mktemp -d)
 
+# Same as in /usr/share/debian-edu-config/tools/create-debian-edu-certs
 cat > "${tempdir}/v3.conf"  <<EOF
 # v3.ext
 authorityKeyIdentifier=keyid,issuer
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
 subjectAltName = @alt_names
 
 [alt_names]
 $(for item in ${SANs[*]}; do echo $item; done)
 EOF
 
-# same as in /usr/share/debian-edu-config/tools/create-debian-edu-certs
-SSL_CA_CONF="/usr/share/debian-edu-config/sslCA.cnf"
+# Same as in /usr/share/debian-edu-config/tools/create-debian-edu-certs
+SSL_CONF="/usr/share/debian-edu-config/ssl.cnf"
 
 # tweak the common name to match our FQDN
-cp "${SSL_CA_CONF}" "${tempdir}/ssl.cnf"
+cp "${SSL_CONF}" "${tempdir}/ssl.cnf"
 sed -r -i "${tempdir}/ssl.cnf" -e "s/(commonName\s+=\s+)(.*)/\1${server_name}.${server_domain}/"
 
 if [ -f "${keydir}/${keyfile}" ]; then



View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/1ca689bd5fcd5f58bb1ed995ecfe05e018f90c31...72fc0d7c07873a669291ab9602504906abc92a98

-- 
View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/1ca689bd5fcd5f58bb1ed995ecfe05e018f90c31...72fc0d7c07873a669291ab9602504906abc92a98
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-edu-commits/attachments/20260311/4e22881f/attachment-0001.htm>