square / certstrap

Tools to bootstrap CAs, certificate requests, and signed certificates.

certstrap

A simple certificate manager written in Go, to bootstrap your own certificate authority and public key infrastructure. Adapted from etcd-ca.

certstrap is a very convenient app if you don't feel like dealing with openssl, its myriad of options or config files.

Common Uses

certstrap allows you to build your own certificate system:

1. Initialize certificate authorities
2. Create identities and certificate signature requests for hosts
3. Sign and generate certificates

Certificate architecture

certstrap can init multiple certificate authorities to sign certificates with. Users can make arbitrarily long certificate chains by using signed hosts to sign later certificate requests, as well.

Examples

Getting Started

Building

certstrap must be built with Go 1.18+. You can build certstrap from source:

$ git clone https://github.com/square/certstrap
$ cd certstrap
$ go build

This will generate a binary called certstrap under project root folder.

Initialize a new certificate authority:

$ ./certstrap init --common-name "CertAuth"
Created out/CertAuth.key
Created out/CertAuth.crt
Created out/CertAuth.crl

Note that the -common-name flag is required, and will be used to name output files.

Moreover, this will also generate a new keypair for the Certificate Authority, though you can use a pre-existing private PEM key with the -key flag.

If the CN contains spaces, certstrap will change them to underscores in the filename for easier use. The spaces will be preserved inside the fields of the generated files:

$ ./certstrap init --common-name "Cert Auth"
Created out/Cert_Auth.key
Created out/Cert_Auth.crt
Created out/Cert_Auth.crl

Request a certificate, including keypair:

$ ./certstrap request-cert --common-name Alice
Created out/Alice.key
Created out/Alice.csr

certstrap requires either -common-name or -domain flag to be set in order to generate a certificate signing request. The CN for the certificate will be found from these fields.

If your server has mutiple ip addresses or domains, use comma seperated ip/domain/uri list. eg: ./certstrap request-cert -ip $ip1,$ip2 -domain $domain1,$domain2 -uri $uri1,$uri2

If you do not wish to generate a new keypair, you can use a pre-existing private PEM key with the -key flag

Sign certificate request of host and generate the certificate:

$ ./certstrap sign Alice --CA CertAuth
Created out/Alice.crt from out/Alice.csr signed by out/CertAuth.key

PKCS Format:

If you'd like to convert your certificate and key to PKCS12 format, simply run:

$ openssl pkcs12 -export -out outputCert.p12 -inkey inputKey.key -in inputCert.crt -certfile CA.crt

inputKey.key and inputCert.crt make up the leaf private key and certificate pair of your choosing (generated by a sign command), with CA.crt being the certificate authority certificate that was used to sign it. The output PKCS12 file is outputCert.p12

Key Algorithms:

Certstrap supports curves P-224, P-256, P-384, P-521, and Ed25519. Curve names can be specified by name as part of the init and request_cert commands:

$ ./certstrap init --common-name CertAuth --curve P-256
Created out/CertAuth.key
Created out/CertAuth.crt
Created out/CertAuth.crl

$ ./certstrap request-cert --common-name Alice --curve P-256
Created out/Alice.key
Created out/Alice.csr

Retrieving Files

Outputted key, request, and certificate files can be found in the depot directory. By default, this is in out/

Project Details

Contributing

See CONTRIBUTING for details on submitting patches.

License

certstrap is under the Apache 2.0 license. See the LICENSE file for details.

certstrap's Issues

Cannot revoke cert if CA key protected by passphrase

Error

When attempted to revoke a certificate that was signed with a CA that is protected by passphrase, the following error is generated

/tmp # /usr/bin/certstrap revoke --CN Alice --CA CertAuth
could not get "CertAuth" private key: unmatched type or headers

Desc and Quick Analysis

It would seem that an error condition within revoke.go - Lines 115-118 is hit.

certstrap/cmd/revoke.go

Lines 115 to 118 in 1eaeef9

	priv, err := depot.GetPrivateKey(d, c.ca)
	if err != nil {
	return fmt.Errorf("could not get %q private key: %v", c.ca, err)
	}

I believe this stems from a direct call to depot.GetPrivateKey without a retry logic for depot.GetEncryptedPrivateKey

I'm not 100% sure, but I think the revoke.go should probably re-use logic similar to the sign.go - Lines 126-138

certstrap/cmd/sign.go

Lines 126 to 138 in ec28c5a

	key, err := depot.GetPrivateKey(d, formattedCAName)
	if err != nil {
	pass, err := getPassPhrase(c, "CA key")
	if err != nil {
	fmt.Fprintln(os.Stderr, "Get CA key error: ", err)
	os.Exit(1)
	}
	key, err = depot.GetEncryptedPrivateKey(d, formattedCAName, pass)
	if err != nil {
	fmt.Fprintln(os.Stderr, "Get CA key error: ", err)
	os.Exit(1)
	}
	}

Step to reproduce

/tmp # /usr/bin/certstrap init --common-name "CertAuth"
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Created out/CertAuth.key (encrypted by passphrase)
Created out/CertAuth.crt
Created out/CertAuth.crl

/tmp # /usr/bin/certstrap request-cert --common-name Alice
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Created out/Alice.key
Created out/Alice.csr

/tmp # /usr/bin/certstrap sign Alice --CA CertAuth
Enter passphrase for CA key (empty for no passphrase): 
Created out/Alice.crt from out/Alice.csr signed by out/CertAuth.key

/tmp # /usr/bin/certstrap revoke --CN Alice --CA CertAuth
could not get "CertAuth" private key: unmatched type or headers

Intermediate with OpenSSL: verify error:num=25:path length constraint exceeded

Could be a documentation issue - there is nothing in the README.md. I generated an Intermediate certificate using these steps:

./bin/certstrap-master-linux-amd64 init --common-name "Unit Test Server Root CA" --key-bits 1024 --expires "100 years"

./bin/certstrap-master-linux-amd64 request-cert --common-name "Unit Test Server Intermediate CA" --key-bits 1024
./bin/certstrap-master-linux-amd64 sign --expires "100 years" --CA "Unit Test Server Root CA" --intermediate "Unit Test Server Intermediate CA"

./bin/certstrap-master-linux-amd64 request-cert --common-name "localhost" --ip "127.0.0.1" --domain "localhost" --key-bits 1024
./bin/certstrap-master-linux-amd64 sign --expires "100 years" --CA "Unit Test Server Intermediate CA" "localhost"

I'm trying to debug it, but can't quite figure out what it this comment means:

// Not allow any non-self-issued intermediate CA, sets MaxPathLen=0

Should I generate my Intermediate CA differently?

Store files without spaces

Consider replaces spaces in output filenames with underscores. For example, instead of writing out/Some\ Certificate\ Authority.crt, write out/Some_Certificate_Authority.

Reconsider the "Depot" notion

I'm not a huge fan. Maybe we should just require explicit filenames everywhere. Seems more "normal unix tool".

Cut new release?

Original v1 was about a year ago. Perhaps cut a new release with the new extra commits since then?

xoxo

x509.(Encrypt|Decrypt)PEMBlock have been deprecated

From the linter:

  Error: SA1019: x509.DecryptPEMBlock has been deprecated since Go 1.16 because it shouldn't be used: Legacy PEM encryption as specified in RFC 1423 is insecure by design. Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.  (staticcheck)
  Error: SA1019: x509.EncryptPEMBlock has been deprecated since Go 1.16 because it shouldn't be used: Legacy PEM encryption as specified in RFC 1423 is insecure by design. Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.  (staticcheck)

-out flag

An -out flag as exists in openssl would be nice. Currently files need to be copied manually when the same common name is used.

etcd-release has the same issue https://github.com/cloudfoundry-incubator/etcd-release/blob/master/scripts/generate-certs

# CA
certstrap --depot-path . init --passphrase '' --common-name example.com --key-bits $SIZE
mv ./example.com.key ./ca.key
mv ./example.com.crt ./ca.crt
mv ./example.com.crl ./ca.crl

# Server
certstrap --depot-path . request-cert --passphrase '' --common-name example.com --domain 'example.com'  --key-bits $SIZE
mv ./example.com.key server.key
mv ./example.com.csr server.csr

certstrap --depot-path . sign server --CA ca
openssl pkcs8 -topk8 -nocrypt -in server.key -out server.pem

# Client
certstrap --depot-path . request-cert --passphrase '' --common-name example.com --domain 'example.com'  --key-bits $SIZE
mv ./example.com.key client.key
mv ./example.com.csr client.csr

#54

certstrap arm64/aarch64 release

Hello,

Can you please make a release for arm64/aarch64 ?

Regards,
T.

Subject order

When creating a CA the subject does not appear in the standard order.

I get the following

C=US, O=Example Org, OU=Security, L=City Name, ST=State, CN=Example Org Root CA

Typically its formatted like so

C=US, ST=State, L=City Name, O=Example Org, OU=Security, CN=Example Org Root CA

Add cross-platform binaries to github releases

Would it be possible to add 64-bit binaries for darwin/linux (and any other platforms you want to support) to the github releases as artifacts? Both for past releases and future releases?

It would be really useful if we could just download the binary, and stick in our docker images, without having to install all of golang, just to go get this one utility.

Bazel integration

I've had some success in integrating certstrap into my Bazel builds to create test certificates. To do so I have to maintain the list of external dependencies within my own build. Would there be an appetite for including something like https://github.com/bazelbuild/bazel-gazelle/blob/master/deps.bzl in the repo to make it easier to import certstrap and list its dependencies with Bazel?

I don't mind doing this work, it's pretty straight forward by using https://github.com/bazelbuild/bazel-gazelle to generate the files. The main open question I have is about how we'd make sure it's kept up to date.

cc @mcpherrinm

Use of terminal.ReadPassword prevents windows compat

Use of the terminal package prevents certstrap from compiling on windows.

Would you mind not masking password entry or replacing it with something like the gopass package (https://github.com/howeyc/gopass)?

Depending on your goal, this may not be a great library. looks like it just quickly backspaces and overwrites with a space, which might still get logged by something you are trying to avoid.

Add support for SPIFFE workload API

It would be useful to have Certstrap able to implement the spiffe workload APIs, so that it can be used for local testing of software without needing a node agent

pkix package functions are not safe for concurrent use

We are using some of the functions in the pkix package to generate CAs, certs, and keys in tests. Running the tests with race detection and in parallel triggered failures as there are package level variables that are written to by different goroutines:

WARNING: DATA RACE
Write at 0x000000b8b598 by goroutine 7:
  github.com/square/certstrap/pkix.CreateCertificateAuthority()
      /tmp/build/80754af9/diego-release/src/github.com/square/certstrap/pkix/cert_auth.go:85 +0xb3
...

Previous write at 0x000000b8b598 by goroutine 10:
  github.com/square/certstrap/pkix.CreateCertificateAuthority()
      /tmp/build/80754af9/diego-release/src/github.com/square/certstrap/pkix/cert_auth.go:85 +0xb3
...

The pkix package seems to use a pattern that makes its functions unsafe for concurrent use, e.g.

certstrap/pkix/cert_auth.go

Line 85 in a0ea37d

authTemplate.SubjectKeyId = subjectKeyID

Is there an existing track of work to ensure the pkix package is safe for concurrency?

Add revoke command

It would be nice if there were a revoke command that could be used to populate the CRL.

Improve readme

The readme could use some improvement. E.g. explain the pros/cons of using certstrap vs openssl.

x509 API usage error

certstrap/pkix/cert_auth.go

Lines 62 to 63 in d84b22e

	// Not allow any non-self-issued intermediate CA
	MaxPathLen: 0,

This is an error in the use of the x509 API: MaxPathLenZero must be set to true if MaxPathLen is zero. http://godoc.org/crypto/x509#Certificate

(I'd submit a PR but don't think the CLA is worth the hassle for something so minor)

Support shortform (--ou, --o, --st, --l, --c, --cn, etc.) for setting subject.

How to create self signed certificate?

I'm trying to create a self signed certificate for cloud foundry consul server. could anyone help me?

Thanks

Add flag to take subject/SANs from existing cert

Sometimes you've already got a crt/key already, and you just want it reissued.

We've got a --key for certstrap request-cert to use an existing cert, maybe we should have a --cert too.

The exact semantics are a little tricky. Like, should we copy the extended-validation OIDs? (Generally, I think "no" because the CA should provide those). At very least we should take the normal subject stuff (CN, O, OU, L, ...) and SANs.

Bash autocompletion

For interactive users, it would be useful to provide shell completion.
GNU Bash is widespread and a good candidate for first implementation.

I can help by providing a PR, but would need to know if this is useful to spend time on or not.
If so I’ll sign the CLA and send the request.

Add support for URI SANs

We should have a flag to add URI sans, like the domain and IP flags today.

This is because SPIFFE uses URI sans in certificates

Allow cert expiration times < 1 year

Would you accept a pull request that changes the cert generation interface from representing expiration as integer number of years to a time.Duration? I would like to generate certs with shorter lifetimes.

Failed to create certificate

# build certstrap
git clone https://github.com/square/certstrap
cd certstrap
go build


# build rootca
./certstrap init --passphrase 123456 --expires "10 year" --organization "Google Trust Services LLC" --country "US" --common-name "BIG Web"

# build midca csr
./certstrap request-cert --passphrase 123456 --key-bits 4096 --organization "Google Trust Services LLC" --country "US" --common-name "GTS CA 1C3"

# sign mid crtt
./certstrap sign "GTS_CA_1C3" --passphrase 123456 --CA "Acunetix_Web" --intermediate true

# get server csr
./certstrap request-cert --passphrase 123456 --key-bits 4096 --common-name "awvs.lan" --domain "awvs.lan"

# sign server crt
./certstrap sign awvs.lan --passphrase 123456 --CA "GTS_CA_1C3"

BIG Web:  Trust certificate
GTS CA 1C3:  This certificate is valid
awvs.lan : "GTS CA 1C3" certificate does not meet the standard

BIG Web.crt

-----BEGIN CERTIFICATE-----
MIIFUDCCAzigAwIBAgIBATANBgkqhkiG9w0BAQsFADBIMQswCQYDVQQGEwJVUzEi
MCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEVMBMGA1UEAxMMQWN1
bmV0aXggV2ViMB4XDTIxMTEyNzE3MTk0OVoXDTMxMTEyNzE3MjkzOVowSDELMAkG
A1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxFTAT
BgNVBAMTDEFjdW5ldGl4IFdlYjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
ggIBAKykjbGBpBr7pBVgw268qSTtcdqJik+w0GxZ/ePc8FMz18r0KwGfAWKx/0eH
0EFrd1210Pa/5zTBvIeHyhhRZrc10nr3AgZwHOL45fbggFcwRl0C25cbTQ/17kAK
OTq+pmX7kaRODwE1KxF1F+PEKWImN08ZgeiwOXmDmgG8qVE8TNiyVNnBs23NNVG5
9iHbFRnaiKrWRWpOj6cHvUBPNe6oSHxLvZ0itVJFYvwZI98ka857Yk95FQKSWHLe
AET0rTfpgdsrKUMBDQeBXOAy3YyPzLAHH/RWTIlam1m0NQC9dLVpqz/tV8cML06A
RRpi2nKSJVxVRJj7OvOTPfwMVc0as95MYkjxcenE1SbFcIj2eA4d05pacuM/V1NJ
axRsPj5cXsoh4fJ6Zm0b/goxUMDbHCarYr5NT71l3MgCYHAK8kjaX3zzl/WoSOnz
z8IK9xKwhbitaH5rKq2Qlp1/dC5CcmE92Pzjdraqlu+gejC1fvYJGVlj/EFL16MR
A9qXkrd7r7hQSw2KqdnjsPYRVoh0sjanMd9wX1CfiJWyz6ffRsE5pgzcpBCvz5dR
poVEu5BLwQ/sYe6+xmYDjCzujIVDPTJ19EF+Tks3jFepnau1XvJkUZs8A9QkqMqQ
QN55fkExoch3aC4XftOUk5NejVPZRxpn54eDoX6iADa+7LUbAgMBAAGjRTBDMA4G
A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRSjWvQ
h4t6/hmXLBhh6uRbpWe2tjANBgkqhkiG9w0BAQsFAAOCAgEAaxeGzhru7s20zavm
f/dbYXLro/CsdhggybAUYPjXRUPZtrz6fMqlolLbl/Aqvta7Xneq5mTwLNJmn5c4
vb6lOC4BLJj6ci4PdkBVKFnqHv+vthn1pHiImNVRRkRJxj2/5kpNHpokK+9TKoPr
5Z0ohXNG9jGzL66bcWdUSxCL2a5Hmcky1xvw6GqkYJVOs/+6/ZHQCp+n6G7niPad
stwvWbgfv2UZ/N2qMfAawpd4O7MU/xQtEEyn29kutzpHv20JhMP02m0cJqEWzNta
6UHQqnoNcF6bxZYy94OLRuC/ZJYKErCvk5ZoqLcSBgEp5Txw2hzGLXwUzNGYWNMe
SMqLYiiSOb8RDAX8pK+ehX60i/tEWL22MFu3VT89kPVSdFNJwH6pv2+Q4+6pGsyI
AG+kz9HcVUd4nl8wIiO79NXIqQSUTYEHldiasjjHUtRRSUYgEB6w5c+/sWkngvb9
9Xhp10/vOKOcAzv7/nAsY4kb+xMw8WqAJdsaxHM9E810vcAZllT0bWWrP0tWIwJ1
cSjlXYcqXt5eHrJYPbFVSpGDhRKdr7gd8BaFieXyJ7BWaYTETrUu0I/VtsyV1Dm4
xeggXhDWQN8Cb5CFuyyH6Df4+5dUdQeRg3zP2BDiDdUBe2N4+FOqjZtssP3+BioW
EP0SMw3TL0mpJP3CIp/Kfck54I4=
-----END CERTIFICATE-----

BIG Web.key

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,6c30a0b90ae36952

14NBAQW8GTrH0ZaaTpX0MJuviXkm2cfzu1LPSoQptZ9bj9CDFSTZhsCam/4+9Sks
OWan7i0WovkDSIB5jGuckmtG382s4/MtwrfUYP7UwpZK6IGb6cFPlItf2e8PYJKe
hn5sdW7K1UV4W+eOxe9pbU6wnX2+Mkk975yMk6QJmhmRodxelk+5MMfi9qb25gaU
N6N81QXYTXmeJD6hWYjAZmRepWBYrNl8aK5dFy+VsHKesNNVpxz8nAKFijYVt2jg
AoQ63jpCPsI7YqHgCqQ3HI4MW1m0Wxb3cZxHfl4Qlm9//HFadki4eLvXWSWcbung
nyRRrrRIoJHSfwVvNCm8ez31XTlcr69RRPHCeR0P1mUHHlwDvI7KZJ2Xw2ChWlQi
ag616DCqGx0b2usfMFDTUxogxjYkGUmPA3bcKs6yxidCl6qzRSSy9T6atDkLsnPq
xhJO9o+CFDp+fx8nuuZfyjY6FIxXcnw799XDZy9V9hTNna/djWvGOr1lWHB1Mnj2
gLhOzXgxh2ZJdCbU1EXwOVZvBGJP0voZk0LIDMx8VvvIa1FAPh7sQNuYw041Y7KC
IrNRf8tx32BzNKVL2jJVixSpnttjT8jB/qMBSesEpQy3SRAqi/dJqRltdlFtB1Jo
zaoFqcg5PWragx8JWhxsvkhNeEZhv5OTWLbUyu5fVnOtKdPVuvRjFg7LH2+A28J7
blcDNZInXf1Tz+h9wtUyeS2hmCUSuvKASiRdqUWI18eHEuS+sixodjKJNC9vcMhC
WGvj0mI5hd2Jyqq+NzqQr3gKY1jWfS4ZXYbxRODwm+8aynltnBF4R256hA5IN9eU
3y3cSEA/e5H/SVsCiRl5OnSJklcix5e0gYs0DrzY0GfzgAegS9YtsP6ZV71t/9po
NtoQBXOOlUoF52NOxYJJoiyvxi5NXlZqfL3r40bPvguXEuX2+mTKqySyWldvgzFP
tUdmWL0QAuA5KjZCNR9xx7aX0f08gUl2r2qHj6YBwSgPwy+ObpTodWM59VQDZdXd
6QILv5zifnSuem5qluiGO003XhDTWdWYvMSNSEA2Dzntc0bZQlpw9JycbZInvqJY
W8FC3zd1S5XHeTUS1NG8yFmrVBlEBxwRSEG8ftmVR3gX6YtalHf6oFGwV/zZ1qcJ
9aCOTR8ZISlUxIQ5/jLpc0Mk5ZqKeBOknKBLEQA/f1JScYvHWVtg09x6W1UQqXPp
BNRCVRoQzSsODWjobwRjBY664RteyRbGAp1UKdjvyfa7sdd1bzkk3J12UD2sLzjf
bfP2u+pURstOS+f1iC/4BliU2a5nBt/VlsEIYsKr388Z1EKtRQymfWhmZYMolDUZ
WynYU9Z/lsrU2qv14pZb6syQ3UKhtCKgJgpfDTImonaGJPZEqiHnu43TkPLv3YYQ
PL7p8Bup7hVpBYb08rOU/mk7nTIIzQSmC5QP1RUikxy5ki3MUOIIPp/QWWNNw/Fw
O6fDt24B6xjHEe/dJIOn6lyY9SUa6NB3198CqL7j1OWtKu4A+AddMmt+2X8IVsVl
tSFvvT5sFjp2dEK4tNWuI2wmzsHmclN+nefO9nQLtjTZ45HCTObA47mUT2u4v47n
2G954CTUKcd6e+ifA5bw8KdkfcED2xXVsVrzWehWP5ns3wY1PDXUo+VI+HdoPU0S
o/uBIyB4OlqmQqRjbxTdPj9LBQ9iSW2kubd/MYVGxU3pCGK0xyqSDWB6AWG3FpKj
2xcjU7b4ik8xEZWWXzGSd7V900k5GVber9FITGDuPLreAd115Cp6mg87jX02fv58
I/W6npKVrAUjZpOpkgPwMN+Y5ghntlL9qOfbioKRWz8eiINgvah6nufyix4dxQxc
daCE1AnC/F19pVGFAIvV4H83AfhnFpRNHgqQp04iS3w1br43iSF1mMD1RWUKuWfz
vHYVuE/QwaA5tavGh2oLzUy4wVw92xyR9TPdKpVLcbuYx9TrD2QNbzCccRMkB0Z3
14ylWaYC26Os9mOPFHO49kgCT7NCbxenVSZT/qSQme2TjsPLWeUyy+tjQuOPk5+l
QV9IWMemahvz1/A6TeJYdKrz9c2nM4Xn8zv7pppRRXZHEUw4x4z81cJYrYhZRBGM
LpHxqfaPvKFprSs68AtGJPD9JO8irstC5Ntss7gHbSfMWphJnUAkHzJi4k1Cq+o5
rH1LR2kG6E3rwAA15noOPKZxkje4GtFge67tDrLa4xQtH8xeFAYTVL7zq+wLbDLA
ZE3AkWWP/nFTnZ/GiS7viPISuwhOAhjO5WT2YXNMJt+M6+kSfp3Aodc6XHiBPkTG
RrKTHF2tIYmhe4si0rS45PEO6aoDyN13su1ZzqV6N1Hz+CxGYNPtT+eYc4Jw1flP
4DMVxr+MOQLAKMBYvANWhSjtc079Upz36zd3JtqTGHoFgWn6Go8iG8ZKycMZF+9q
275SJiDmJKFjCG8kQjhpfnsIrACIrkkm7fzD4UgBBrt4VoKnp9dTWZYScE2058lZ
vfnvqydALNoIP1JUeLSniE0xnCPSRS29cXRnOtaJza6T2+CPE5I571jxde+ezTot
rQab3qRqAVqZe8s3cWfipQizcvR5Jgado0au69L6TLZTMBBhcMUmEbeCzoKHANQX
VkaRE4f+vxN2exAumRKmYZP7uuZAOYJxf/vM/qCCr8jHU1cofkfrhdTvrWK2tn8c
+D8PvILaVgFfFz8HUQyhKaRF0l3knJl82/XHk2KkTAOYSgtOVGfHkVoc8491JlAk
ro4zrSlX8xiO+5ZOojcwU3+mMT39uyJHRnpzOOYKDKKSfAiqkbuqJl/Ya9oYFAog
Kc7UArDO2hanmbyIywHETt3ohry46XvMeqlM18j9K3RU/Rodmb2OnkcM57Ay65Yw
r8CnUhGcn4s4lgTRdlTKOVzsKLjni0jelsF0KQgMI9F+2AVPrNs3P4grkCPt9XLk
vXWeJxM2zRbS4yPI2IGm89yW8IEJW/eAyd8L56Ak02EHu0Lwqr2Sp4R9kgzRK8bH
DdJwU/Ol9XQGEvBpDv0N51t1J3UHX2N2icKZ1B+eQOKAguh/ABKIaI+GtmmVP3bW
FY/zf5vs8o99lYfaZ2KLrYR1+qw8z8CfOkx+TLdKXc5K79wlgkMQEm99hzoh1koK
-----END RSA PRIVATE KEY-----

GTS_CA_1C3.crt

-----BEGIN CERTIFICATE-----
MIIFfDCCA2SgAwIBAgIRAKdxUP86/3upKORWU1q0i5MwDQYJKoZIhvcNAQELBQAw
SDELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBM
TEMxFTATBgNVBAMTDEFjdW5ldGl4IFdlYjAeFw0yMTExMjcxNzQ4NDVaFw0yMzEx
MjcxNzU4NDVaMEYxCzAJBgNVBAYTAlVTMSIwIAYDVQQKExlHb29nbGUgVHJ1c3Qg
U2VydmljZXMgTExDMRMwEQYDVQQDEwpHVFMgQ0EgMUMzMIICIjANBgkqhkiG9w0B
AQEFAAOCAg8AMIICCgKCAgEAq7AONRzJf0L4v9lJGiSKo/5irwUAsQA1KGIqeF1C
iDp7utbrg0ePgKDVm+GkZC2ylwKe6EP6KoeTOSknWXOhoaHrEjy7OvgeqdosOT8c
vXOG6WMJUsO31S+Ty2a+M0UJLvIcGV3WFnHQ6+iz2Ri76SFP7ObUTRGygb+MeKKO
diupc2nzd4q3pG/MluqBpiDheUDXJs1WLPLp8SvgW1CH2jab1JtkZS5Sie8A1BZu
IgRtO/vYTGSvxwSJ1wRN7J6Yzlvqz03x+jGrN7ryQDN91Gzvg3/lYYm63rEvUNzq
iISQAV+4SF0FXGCQl4wuZp7rFMpmen6/4dg6R0dKCk1z+9lEpRG3f5C8CtBMO/HB
dCAJJV7gHgLpRh6Cwd803bTa7FD6pQXl9Fx8KXRyIHcbVBuqfehYCEL6JYD0Q8yP
WLQ07tD4hLG5v4pM8XdVTZCLWAUTrpSXEO3JvNJQ0g35CNUBbAQXmfyzxxDNd78l
8oUBB+5hqGKa4WasXkFmUKHUkYqyvYblrDEDkhdJiJ0xl+RFxMkZQd+Y4+NZ3tKW
8TJPTtAXdEt6rzAjj3qGlcbFUh97I7KgFa3kky4mrzKjxQfGQRxYc5Yqd/VUVdnv
tdLgBbjuI5mzz3e+yVqbSfQq9JSycLU/0r7HnOXb4KEFFtdOkfI/4EIQw+biUnuH
JykCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYD
VR0OBBYEFEIjFyR2S2CcwjvUhItZKUFHhECVMB8GA1UdIwQYMBaAFFKNa9CHi3r+
GZcsGGHq5FulZ7a2MA0GCSqGSIb3DQEBCwUAA4ICAQCLpTQ3nNIqghP4bkab4xc6
87yGAisbpy+nKm6oK/uuo/Xo8Zo9NjbZsBen4go6dJPlU4yffcj7aLRP+86QmsVs
89ws4Dy0BIp6uFYF65K9kU1ZuX++s1DsN52eeGzIkb4tKhBneCXPEu0xFMWY8w0R
W/aCJjVXssPv7h5KngZDFjpmXLDy1MDm74sWuvAOy2N7N8bU0r0AHmbWEW6HcCRB
oFEaTSfQAbihTa2iKrdKubNHHIL8ZfidRYco4jJOQVcmm+Nyh1mPxFlIBRuwJMAb
IeN+b66hnzABVTiRoYKixzaKubehrTBt8plQf1CC+P0+jKNk/ThqSBUdsBXwSP8u
8evNlAEsLXEqaeLo2DnuKiXdS6bhX/UW4EMzOZUQbyaWslwFnmWFh/2Wu/4SiTCP
3H0ilAMITAebmwgT1/klx4eDGo5aCFtgprfFzXCUB6OUgOhW0+gxDH5TRq6ddiAh
+Wce3wsnOVij0XZP5TQByny3S4ltImJ6Ofjm49AbDRet7kyW0vc/w4Z8gA5erRF8
/H4GcoXJSF/9HP2Xtst6oL9X66pKDelKysIQ/KqXO46pSikJcuVbVBIQolXgBI9U
3uCuGmiCq+Ot6ReIieRNMnr4J1VLXaiLnauCaAM9kBMt7IxH8KVxMp42QcV5Gc1v
ZiecFs6BUTKxtwyYVWjZhA==
-----END CERTIFICATE-----

GTS CA 1C3.key

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,8db6d5d509ae7ec2

rGCO1ELgzKCQFH0IOxKlA26NFcm+Omu5TOH5SilP6T/mdlB73W2necyzCyXL0r80
e+veljXHbQHq6Tt+168Hqk3LWgX84cHxcquVEF2rZyVQPmNBO/zz2wXFVxacKFEg
Yt6BR6OFIIZ7/dr+NFc01OznwXMlCqoWaRSTPuOU6F04G4bXQLoOK0EV/xA/UBLa
luxcEt7cXCLijRW5VP6zF7Twq6vyChEWWixu80LMeuUMHxDFJxejZ91DEglwVL0r
NuhSDVyCCt7sySFy70adgZZG1a0RE1J40ruSemShTF/R1FN8Mqn2d6HoSZuU0iIA
1Lu7i0WV6b4IyRoRmpPon5QIah9hbm+cjvROPhEwg0LHlnyC8LEoh7n6cQwstqmx
7/chLk4ikjA9K0AVypnfxHQqPNOedSzGxrlJKggur6gpDhMwJVaVALGC0bdwEsoZ
qsXcwynw/20zMwnqlEOR3tUnZw/vpw5sHy6F+e/Kt3BSGnQbk68gB9Fy3nNFxRfF
HteOYqLBwnt7F/ZJU8TwbVAII/T8IW/+vY5fEJvH+ks5Ea73PXxOZ8PeYc1osF2j
cE/fzkwgddqL+ULmxKkZZPtSGuumzJKqNj0Prl/xQCA6oOCuBwNUWE3RlP7J/xoH
+lN/6tZ40fR+S4EwOryHiBM6HvqBkTBO8oRqhr0BjR3x6aE8KNlyZlX6zLdmnU14
4hVt4eVMFCndjmkFAvFRJuGvdG53E2/uqPs+0DC7vvYovY2mMAotaeN3Ve7+6z9i
3UteU8+ys9o6ve4HorS3Rvri7WhEOknyqxfD+sMuD99QkwDhUFVAOeyTOAAMIogH
K3GKT1BLXv9Q++DEmVESn0idN3BLuaDDvfkdPK9EO2HOgK+zuSbZ0QlfLdbDBTfY
zEKFlaY2w4LVVWnas4GkOQH9me96ud4tdh38PlnAhgXgqLvAUcrPkUgqnn0TdqQU
QMOXYyCvrahfX/a2eH/BSZcVeSHdnSg0FmgYJXJE/v45ViAscbKfTDMAZy2YFUOD
3fv2yL8fz8LpnVB969KOAW/ik8jKjBJTdSwZWMxaspLs9yXLOAKnZo1dTFEnlFr9
J8ajNmtrCG/SUMRO0wILoc08lZzMbObL8AK4z62e+mVpJjk9o01NOdsvV1WTs4Z6
aokLM5jyUNEJ0iMusYdVS8WrrHaoj9z3BTCmE7JFpdc97t+ZKhF9GI5ehzxOQlVi
KDcrbTnyDTOcvD6x2qnw/v58CFsD+SZHovF6eLAimmF0HbdCiK0W3kHtr9dDONto
iSzRpOG+hb8ZFTfohlOlK99mv8CzS7cOiEjTeUmzFUda/n2IIwzj3d48yZoVx/+v
WZK620XBRclyopxq4wfasj+Z9136zTgAoE15QI1aHCqbKA6afkQj3vF9KfOuOZW+
XNtHdj3mQ8mgvN9eOHLXa48RHvOseNDU6GfDOuGdLxuNGWKbbYOnwlpCpJy4vTAW
Qu/OhssgiECVOG34cte+ux1AUyBl/f1xe8fme8QHXe+3vqOUKi5GBDdnUjbczG6s
Llc1rOjaQERZ8FBXft/3CSoSA544pfjWTtpX3btNMSRvN5oa8EOQgo97yb6WPpxQ
lqF9LkQZ4oqKm4pe0ixkYUFaSKbNYxvRZ30nKqqT2/7WOh93lo0gWq9J9L5wWj5c
8CV9uiwikdhEff8NHv1/Ad81Y95yH/CtT45bMwkiaIOwcD/S6xsLMyYlFvJcG3pz
MaCnUhDXL+tv3xJ+VFrwlliC8Cof0Xvj/EQiwZecCvjGrzhwNohFYkPrRpEtk3BC
yW/gmMvF/V+yXh46BLroARSMqEgV7JixweQhwhkaWUIudz7x3H3ZeoQAOR6qFaRs
b/VALlFHndp8hakS2IKpv1aeBaJ+yEMjN42BaVKTTl69MJ1PqwlLWr8OfOjXhLoQ
uTUTZNNSx9l5lhOQy7ij/Zg6yczlV/lo46XGXlwxRXLqE3TdxxFjsGdtCexzqiUZ
4EwYC7bmmrTuLPuvZk/iF15ljFpfr9xNl3MMGNsVH8XjH8c4ERJ28+lZXCe5tFWl
cJ13tTYYtItx9Weh31tWMcNSeCO689YjL/nku0e0buNlJA/TQszx/kFsg2BgwN8b
hW/JzSZUSQum5Rr8BmmeGoqHsY9h9rhXxJ2aaDcJepHxiWBAzWVwbGoVlgcpkpZ9
6V33VyGKt1sz6GHqdMr3vV8FXB3Y9UlLtDiwJ2TLleoiOW6tvabYjrMXSFKX17PF
tNV55/e5kND4fQ3oTU7NeqXGmcrnml6hkHajg9RQQp9hHV5Q7Pj3N1iCu5+VLyIH
2QtlqekOUmd5mNQf7d3XAE6XByVokxmrYXtGPumOibsPLoVhpoITDxCulkqnL03U
HJR7jPSSHR/M4bDfgnYC3mhwsoroygm7GJ4THGekTLV1qDmD6lN8y03tGp5s0RSN
hq6wolkfslrJyPEX4e0y2GN6QelWlDWQJFetIGxD91AQ57EIDaOLvzEjrxbTsuJA
cIgVIMrTBwefr+1Dy8VIIzr1oZKLS/Sxyhxvd8pMcidkTfnjm4zsksOlNTbngQdy
9UdJOjQRVbhfMCe6tfs32tW3rDficn39HZqLsRZeu42XQig9ffqG+jXU4nXifPni
7zKYTcLNVAFkYN2IejDeK6J+GCp5wFXjT78bIswgHaQ1iv6QKr/Una+p2iVXrUJb
uCwh1FM/EckSrHEyJSn/ccKxd5EBtEk9ZeYkrx10QUK30cYc0Xn5yQwG+/mjTfgu
qU5xFuMyvc/aRCLZc7s8uoJntDcYFgJWOAnSWTQT8H+QPDD5Vlq1T0qJus1ixD4w
1dNM2mcyZk0KKXZczabiBLLNw2bUMCKXB8Jo1t5M6FN0ufUBoniuJrdJyth6Pq6l
UmlPavm5mzyC5mMqL1Ow9FLs+pwoJYi39i8l0UkbgxwslpvKDgIR5i5/Iw37I/Gg
cEns9P82+bCFTr9UQce4h9vCIMuTZQkOW7XwxyIHU3aHNw3L71LEmINaRpnkXYXm
iH88Jn5827y38cFLYbuV9Aj2gGQTNPqncus/70JlglG8pHGozABCjUmoa/Z4hfyD
3cyTqICe09lf+H5POEs1aWIwVu9aNSYoZQENaCxmEybiv40fA1tBaJVYEfaEGBh3
-----END RSA PRIVATE KEY-----

awvs.lan.crt

-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIQDPu5IIEBo6WvVcIV9apIojANBgkqhkiG9w0BAQsFADBG
MQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExM
QzETMBEGA1UEAxMKR1RTIENBIDFDMzAeFw0yMTExMjcxNzQ5MTVaFw0yMzExMjcx
NzU4NDRaMBMxETAPBgNVBAMTCGF3dnMubGFuMIICIjANBgkqhkiG9w0BAQEFAAOC
Ag8AMIICCgKCAgEAnUzrZ8ZvN97CLARkdkPAB+/4sm1/YIV6VWIDcaRuMdS2Sc1L
q9Yke5l4UsJX775how+ugUYdcRMGJRkZ7BbdUeN08aop1NSR2+CiAr4HqUYkUt2K
lzz2PWYb5ECoWWvuYsqa6nDgOE+cRotL/digWl1A014W2q2Dw7iRoC6wq3L0jkTN
1cjBvO7pdgMbkPgoxeNPkBKftVS5c6G/GVb0NaT8s6ny453CzpIUDxH+8Jf6XUWe
mE6kJeYvxwtYoUmhH85LN0r0x6WS759kE2biWlKkxqHrAEMgc+hut3Idg/XZSdiK
vgKECEgbdhw03jQ67LcrNJrB+5Me1pa13jDtuZQQ2oE0HaERzQVLJE1AM6qVuAW4
91T1tZNFPcbVw8Re/M1xEnc/Tp9LKZd0HrPWMVNRkGdIul7bcipQNdA7rv5HKBqu
wIGYikv3A5fXnjfsiE1Ft9QVRs+j5iMKLRaguVNEAmqVoy+eAL6bopyWMLU/286p
dfslBMRPaHik+Rq5HSMsv6jGdwfYleOm7z8cfZRXDOLMRbb100n++fKKPjDJyQ/t
Ba1lXhCK7SLxND+5jy0lqLvIbh7PUPtmiH+TTOQco15cc96XgfTn6Uddovu7NkKG
k2/YfTKoRO/7EIi/WVanSpaK/JH4t2Gtc2WEOuqF5uc34nbSDYwfpRnW4ucCAwEA
AaOBhzCBhDAOBgNVHQ8BAf8EBAMCA7gwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
AQUFBwMCMB0GA1UdDgQWBBR4GuaZv0EUBnkU4o3CDzb1RWcNODAfBgNVHSMEGDAW
gBRCIxckdktgnMI71ISLWSlBR4RAlTATBgNVHREEDDAKgghhd3ZzLmxhbjANBgkq
hkiG9w0BAQsFAAOCAgEAkFhJ24z9fRs8ylh0XbbBlfe/BKwEpsAM/Y/BQwxFIazz
u8IDoD9m1OgPkdtnbnK0x+GdRTC0sC4yhPl5m+lqhdsOmV+gnu+ntcqPd2N8rHCX
R+EddMcUUhUaHouRxc+LRl1L0QryWLt99yj0nITq0e+64VcHy0Dq3p3x8L9LZj0I
+Y4D4lTS/QE8MaP52+LWV5LEkHyvUrSihnqp6QsBVaItrH0zjXNtZwNjk6owQzFt
8FdgszpFPAviTHtxqPgKALf9QQTMoCkF1xU2FUtB42Fwzks5O8Lalphe5Ko9v5aT
2bkFE8bnO+UeKBzHXT0asPG2goUus7kuZmzQMGv/11QdMw4UoFfhGR6l4edxb5X7
MA9BttYM9NKWmvlD/VJ5ledhFnQWMciRX4sfx0alA1xrqCtRGLi6tM4bHAbsGL4v
9SmmdirXXhXoUYxVqiYyj7qrn9mHC1M0hBmuM3xYetylpN/7duV1jYDxujwSr70n
j2ecRsEk3xHmh6RKlAlJxEBKsZ0Z5tPMW7q73vxalkLU599TN9bUpH/LKXHfAJU2
BdDdhBFKr/bmzsiDmwSwrJyD2JmWiEhirt3/0/UuE8q9BPp0LmVaPvZSu0++XZiP
fEvfHZRYLEBxD+ms6KllVY5xmQ3u5CrbsG+xmT4j6OiltQ9Lp1oBK9jJKjreCbs=
-----END CERTIFICATE-----

awvs.lan.key

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,8b7fd496652f5334

m+M6Ir5Iz2njlIv9u9eQD9svNSVSL0WA6191Nw8bq1ive9vCHbhP+nIj14tzXLih
+/AWv+mNyNvN7rW8lGb2QApipg3TUsxiEB03Qf1Ldpmo/R7lcBc8VuZWVddNSMxV
fCMYVrBAaS94DfTorvj/DB9IIjvMNsErYawFeubEq0DTcLyd6h7xm792O7n8AtFc
y+/4nFapkxWmgfBhnI6n/KFIx0ScftdqlzEu6TslgSKXdfYrpo7oa6LzanmLav8c
CR0Cyg68QRDU3apNlYBhd6c/7kcuUEg//nxi6QB0ir9bNJDphpZwhh8D0Q52Of6F
OOZrqC+tgNiqKaNOP+y6wehwFWiR6W4zdfRIkv89nDyiaWkyjy0ilf50oicJFc88
/QrzQtu9ntbu6BHyc4lDRxjQgHnrHvxVwYmncoB2iycXcug4OLjFEKAdFeEPFvoM
eT6MfewPm1P/MXP0Y7Sj7qpBd+xxsZpviKGr1LjumFxZEAej06eLeeicUD3toSJ6
df7isJHG1Kbn5YIhQ6Ycz3pxy3gK6MM0iI/6m+Az18mNAlPRglxDFEOuTpntpa51
6UPTdHyBz1h9tsXKTYklh03YTgQMKqPsGuF9yyIuGgpZMpb/AoTAfHW4Vc4WGPyh
2mGvaauJf6VmrypwR81RF2VBu92NL5PvnI5Mc5pd8af2k40D2mxKXFJ7EjrosfA4
XYxsEje+TabUv0KxdfatbVE+qG6lxeSpjikj64trkBUbJTe3sk7l4WVgO/o6GtVQ
EQlSMSPXa7q8WSFJKsV5zNPgaq04aCIaVC9KMcZqIo5EKfIpG8BMZrDE+kdgwSxR
nE3B39ea57YF8mtL4Dwg0mIvtVVCJUL9aks1U7f7HR7TD9gidW0AwKQOflBAfjrg
Sh5ij2Q8jbG1h4kIIju/H2Nti6+Un1XZrZbx4Fb0a2Bq9rB6BUNDQc5jD2EATZKz
B0/G+5EXg1MJIpmv+5bnjroozqR5XB+6RlZRAzdtf7cIrh+3KkYLeAnLpNiqsdzj
QrI/GnADh1JXxF3UMdgP+AzDjHhxF+7AedauVqP/9LNgprs5ISYIziIcW0C0MnUA
adD5hBLu8QW2GIpO4g0t6gCeOKoRlySh4CBPIuyaG4ATrf7YBAUMgpag3yeSMzUF
Eos+BYyEekqc90G5bb7uhcylsJwFz0V8IKCCFI1zOMyI9jGn63bMbTUil+jTfG6y
Foi1xenSzLid8LBUwGuu+99IfPsIQoRME1ZZB769IjXBS9EKh50bu2d//5U9oJtX
y4zUWAPwPPnJRHs83Nf24sH8Qo39PtZztDa0hNT8XvG+ZMKboEXf8753SORdfSUa
QJs4N87qtewNRBNwogKjttsF0RdvG+bWvfYNIoIzWgB1u1edmwe0LovDvgy9nBEB
IFekNSgh4dfvevUqr+trkiNug+RNE9HDyRB2XB4dvUg9jOVRzNwQEor+5oa2QylL
Qe0RuXQ1w6DZpC0OUkqVUHrOS063tN13lzcV475a3LOcg3d/iZZTkJ+WyQvhNS1V
xpEwDIhw7fLS/L8zamtpW6/r263XF1faBTq5gnFRvPrnBdtHaEVIKmpcSiK5AMw/
eOhKlzwTAU8vurjsibRyer0P7UuwiMJ4vdq5GZNdZV20ULkVmIssxarz+q2TJhJJ
9l3AN1rCtceaS+jdKyEmBpE+Iz4c3H70xB9zrP9VDD4PthXvELm2P+Z2cMmTEF7+
EWx2kJCI9cZWRgemswDkH/zYpMRqB6mqQHdEXqTqOna9bfwYtLNbn0WQoZ+1u75Y
OqvEd/Zh0CbLJ+tTp4+2nLQ6QUzRzPjervA+I8zDCbg/JlXoRhV7mRmt6ndRoBDk
5OXdthPUxbn16UPzGjL4OmpM+VtSq3BlvqiHZ3vg/VA1Lm/LIFSRMOeruMVaRNBz
6/DrwPP7wNVDb/B2590dHnPEgv4Cpnj/ddmEStshkLBhy2jFTwJXo9wYxQioF3L+
UL9THzdz23VR9+SIVBnDmNUAFuH7WOJw/e6eYdQTMAyntpZXBHF7wVBmmU/dsz2F
XMoq7LGnbtRW5dzr1DiG0zGZNbF8MDxpcsUMNP9pj1A33hskkpqumQXi39JOkKOy
VG6SCuuF/70ImTKU8MWsf8v/iMrABD1e8VqTUpKPLAtSo0PjBaWAqlXOO6Y0F8Jy
jDzAECMmfIT9uY0trEX1EUScP8qVYQCTih81r75YtGELlb5KfGweYxoGsVC+cya0
6K3bAKPC/UE+xlIzR665gbSjvglMhArrL5PT0OmL4UaIyoe423q3JR47p1OofWAI
ZQiEGkWyEV40u/8IMZyx31yL7T0esrw/sZHOjYIVg+E1rrPEZ+xEl7WCC0TE3Kjb
/jDLejYXxM5ZDaa1EHiY2aDSgF4M7C50bXnIXf+EHX+2SECzaMk1ZedzxpoSN1Op
iABOThxflzpxHIwcsDSbZcLfLuimkpPBuLHxm2wp3932iVKRo1wHT57qb78nnPgr
1bTq/29JiBsmUu28Syfb80XZillwtAoa+5mK3Wz3tfuStttiDM3qpsYvmDo1mOIf
Ps3JevCKq3jPDhbMJcOUHmaAWWb2Z7rlJhrz32bYxdE44tf98DBCeg/gE1rM793R
Xz1S7khhqah3dfeUAyAjpInUHdlRMO56Q4eNQKjwh//GfEo5T6Zd+fpd7pRGIkwT
jFUU8+99AallHxnoC2PXYPWSvJiRi6LX/w9t3l3fxy/LJ9OHkAaJKAJEuobsJb4w
WZiIfwbeuUE/tWa9xPw5/ocgOm+nctmHJsxBY+4q0uca/Uroi4URQclvTX6W/tUE
hIiZZctbfQ2j+ERdgM/NXruiA1Ba4MXT7dE+4imD+VKCcvPxVhI5hbLZVvY1LnwE
BSdiqQAIoXaW1Cutpp5Kmw+PM4/OfzONBjNx3Q0Ri075VJLAIJWtBZPsgDu+AbS7
ntioxiqQDtyZj7rVxVP7QYupHd8RAl1r9qllFQEDhmp2aHqjOSGAnZPB19vtiRM7
6i6oAm3JHi7XWnFwAaBFnRUQoDVbYcBUWAh7L1XdKe3ySoV/SxiGNxU/YFViS0oX
52goBia/8RmHpupKeZx4l9kLOUOc9Lmdy9shJlAXmPdHSo67f6xjsMg1hLvU54lq
-----END RSA PRIVATE KEY-----

Add cli parameter to enable extendedKeyUsage

I'm setting up a Consul cluster that requires rolling my own CA. That's how I found this awesome project. However, another requirement is the usage of extendedKeyUsage to enable client/server-authentication using the CA-signed certificates.

I've found references to extKeyUsage in the code but no way of configuring certstrap to actually create certificates with these parameters. It would be awesome if certstrap could support this.

Release a version

Thanks for an awesome project! In order to have stability (and include a package in Homebrew), could you please consider releasing a version of certstrap, e.g. v1.0.0 or v0.0.1?

Version the build on dockerhub

The build on docker hub is tagged as latest which could cause issues if the build is ever updated. I suggest another adding another tag for each release.

e.g
squareup/certstrap:1.2.0

Awesome project btw, has saved me a lot of headache, thank you.

Reconsider prompting for passwords by default

Certainly we almost never use password-protected private keys (that's what Keywhiz is for, after all). We should require a flag.

Consider using cfssl internally

There's no particular reason to implement most of the things we've got in this codebase if cfssl can do it

New release

20 commits since last release 1.1.1, homebrew version outdated. Maybe it's time to new release?

Throw an error if IP is invalid

certstrap request-cert --common-name "blah" --ip "foo" ends up ignoring the invalid ip. We should instead display an error message.

Getting unknown URIs field error on ./build

Here is the full error description:

gopath/src/github.com/square/certstrap/pkix/cert_auth.go:147:14: authTemplate.URIs undefined (type x509.Certificate has no field or method URIs)
gopath/src/github.com/square/certstrap/pkix/cert_auth.go:147:28: rawCsr.URIs undefined (type *x509.CertificateRequest has no field or method URIs)
gopath/src/github.com/square/certstrap/pkix/cert_host.go:98:14: hostTemplate.URIs undefined (type x509.Certificate has no field or method URIs)
gopath/src/github.com/square/certstrap/pkix/cert_host.go:98:28: rawCsr.URIs undefined (type *x509.CertificateRequest has no field or method URIs)
gopath/src/github.com/square/certstrap/pkix/csr.go:118:7: unknown field 'URIs' in struct literal of type x509.CertificateRequest

Release version and app version don't match.

Checked-out and built tag v1.0.0.

$ certstrap --version
certstrap version 0.1.0

This should be fixed for the next release.

CLI option for empty passphrase

I would vote for implementing the feature to explicitly set empty passwords for certificate requests request-cert.
This would allow automated creation of password-less keys to be used i.e. for web servers.

Maybe implementing another flag --empty-passphrase and internally setting empty byte array.

Improve error message when file permissions deny access to a file

right now, we end up with Read Key error: cannot find the next PEM formatted block. We should instead show something like: permission denied try to open FILENAME

Support pkcs8 private keys

The tool should be smart enough to support reading pkcs8 private keys.

Ideally, we should support writing pkcs8 private keys if the user desires.

Wildcard ssl certificate

Hello,
very nice and conveninent tools. Is it also able to generate certs for wildcard domains ?
thks

Must provide Common Name or domain

First,I use the next cmd:

git clone https://github.com/square/certstrap
$ cd certstrap
$ ./build

2.I got certstrap-dev-25ea708a-darwin-amd64 in ./bin,and I exec:

./certstrap-dev-25ea708a-darwin-amd64 request-cert --ip 10.29.113.5

But, I got the error: Must provide Common Name or domain

Dependabot can't resolve your Go dependency files

Dependabot can't resolve your Go dependency files.

As a result, Dependabot couldn't update your dependencies.

The error Dependabot encountered was:

If you think the above is an error on Dependabot's side please don't hesitate to get in touch - we'll do whatever we can to fix it.

View the update logs.

Add a flag to choose between PKCS1v1.5 and PSS.

As we migrate towards RSA-PSS, it might be useful to have a tool to easily generate such certs in order to test various pieces of software.

Publish docker image

Hi,
Would you be open to publishing an official docker image for certstrap?

Couldn't find any on Docker Hub:
https://hub.docker.com/search/?isAutomated=0&isOfficial=0&page=1&pullCount=0&q=certstrap&starCount=0

Add name constraints to CA cert?

Hi,

thanks a lot for this handy tool! About the only thing I'm missing is adding name constraints to a CA when the certificate is created, so that the newly created CA is only valid for certain hierarchies. In openssl config syntax this would look as follows:

nameConstraints=critical,permitted;DNS:.example.com, permitted;DNS:.otherexample.com

A CA created with this constraint (which must be marked as critical) can only sign certificates below example.com or otherexample.com. This attribute can also contain IP addresses and many other features (you know, the whole x509 stuff), but being able to restrict a CA to some domains is the only thing I need.

Is there interest in adding a basic version of this feature? Like, not supporting the whole x509 madness, but being able to specify a list of domains and maybe IP ranges a new CA should be valid for?

If so, I'm willing to add the code (and tests) needed for this feature. Let me know what you think!

Finer Expiry Control

Hello,
I find that I often need to create expired certificates for testing related validation and it would be extremely helpful if the --expires option was extended to allow passing minutes and even seconds.

Certificate expiry clarity

This is more of a clarification than an issue, Is there a way to pass the custom expiry to the module, the expiry defaults to a year currently.

openssl x509 -enddate -noout -in test.crt
notAfter=May 23 06:26:00 2022 GM

Commend the Incredible work to simplify cert generation!!

Golang 1.17 broke Tests with crypto/x509

CreateCertificate now returns an error if the provided private key doesn't match the parent's public key.
https://go-review.googlesource.com/c/go/+/224157/

Test Logs

?       github.com/square/certstrap     [no test files]                                                                                                                                                        
=== RUN   TestParseExpiryWithSeconds                                                                                                                                                                           
--- PASS: TestParseExpiryWithSeconds (0.00s)                                                                                                                                                                   
=== RUN   TestParseExpiryWithMinutes                                                                                                                                                                           
--- PASS: TestParseExpiryWithMinutes (0.00s)                                                                                                                                                                   
=== RUN   TestParseExpiryWithHours                                                                                                                                                                             
--- PASS: TestParseExpiryWithHours (0.00s)                                                                                                                                                                     
=== RUN   TestParseExpiryWithDays                                                                                                                                                                              
--- PASS: TestParseExpiryWithDays (0.00s)                                                                                                                                                                      
=== RUN   TestParseExpiryWithMonths                                                                                                                                                                            
--- PASS: TestParseExpiryWithMonths (0.00s)                                                                                                                                                                    
=== RUN   TestParseExpiryWithYears                                                                                                                                                                             
--- PASS: TestParseExpiryWithYears (0.00s)                                                                                                                                                                     
=== RUN   TestParseExpiryWithMixed                                                                                                                                                                             
--- PASS: TestParseExpiryWithMixed (0.00s)                                                                                                                                                                     
=== RUN   TestParseInvalidExpiry                                                                                                                                                                               
--- PASS: TestParseInvalidExpiry (0.00s)                                                                                                                                                                       
=== RUN   TestRevokeCmd                                                                                                                                                                                        
    revoke_test.go:118: could not create cert host: x509: provided PrivateKey doesn't match parent's PublicKey                                                                                                 
--- FAIL: TestRevokeCmd (0.12s)                                                                                                                                                                                
FAIL                                                                                                                                                                                                           
FAIL    github.com/square/certstrap/cmd 0.122s                                                                                                                                                                 
=== RUN   TestDepotCRUD                                                                                                                                                                                        
--- PASS: TestDepotCRUD (0.01s)                                                                                                                                                                                
=== RUN   TestDepotPutNil                                                                                                                                                                                      
--- PASS: TestDepotPutNil (0.01s)                                                                                                                                                                              
=== RUN   TestDepotCheckFailure                                                                                                                                                                                
--- PASS: TestDepotCheckFailure (0.01s)                                                                                                                                                                        
=== RUN   TestDepotGetFailure                                                                                                                                                                                  
--- PASS: TestDepotGetFailure (0.01s)                                                                                                                                                                          
=== RUN   TestDepotList                                                                                                                                                                                        
--- PASS: TestDepotList (0.01s)                                                                                                                                                                                
=== RUN   TestDepotGetFile
--- PASS: TestDepotGetFile (0.01s)
PASS                                               
ok      github.com/square/certstrap/depot       0.047s
=== RUN   TestCreateCertificateAuthority
--- PASS: TestCreateCertificateAuthority (0.01s)
=== RUN   TestCreateCertificateHost
--- PASS: TestCreateCertificateHost (0.00s)
=== RUN   TestCertificateAuthorityInfo
--- PASS: TestCertificateAuthorityInfo (0.00s)
=== RUN   TestCertificateAuthorityInfoFromJSON
--- PASS: TestCertificateAuthorityInfoFromJSON (0.00s)
=== RUN   TestCertificateAuthority
--- PASS: TestCertificateAuthority (0.00s)
=== RUN   TestWrongCertificate
--- PASS: TestWrongCertificate (0.00s)
=== RUN   TestBadCertificate
--- PASS: TestBadCertificate (0.00s)
=== RUN   TestCertificateVerify
--- PASS: TestCertificateVerify (0.00s)
=== RUN   TestCreateCertificateRevocationList                                                                                                                                                        [299/1166]
--- PASS: TestCreateCertificateRevocationList (0.02s)
=== RUN   TestCertificateRevocationList
--- PASS: TestCertificateRevocationList (0.00s)
=== RUN   TestCreateCertificateSigningRequest
--- PASS: TestCreateCertificateSigningRequest (0.03s)
=== RUN   TestCertificateSigningRequest
--- PASS: TestCertificateSigningRequest (0.00s)
=== RUN   TestOldStyleCertificateSigningRequest
--- PASS: TestOldStyleCertificateSigningRequest (0.00s)
=== RUN   TestWrongCertificateSigningRequest
--- PASS: TestWrongCertificateSigningRequest (0.00s)
=== RUN   TestBadCertificateSigningRequest
--- PASS: TestBadCertificateSigningRequest (0.00s)
=== RUN   TestCreateRSAKey
--- PASS: TestCreateRSAKey (0.03s)
=== RUN   TestRSAKey                               
--- PASS: TestRSAKey (0.00s)
=== RUN   TestWrongRSAKey
--- PASS: TestWrongRSAKey (0.00s)
=== RUN   TestBadRSAKey                            
--- PASS: TestBadRSAKey (0.00s)
=== RUN   TestRSAKeyExport
--- PASS: TestRSAKeyExport (0.00s)
=== RUN   TestRSAKeyExportEncrypted
--- PASS: TestRSAKeyExportEncrypted (0.00s)
=== RUN   TestRSAKeyGenerateSubjectKeyID
--- PASS: TestRSAKeyGenerateSubjectKeyID (0.00s)
PASS                                               
ok      github.com/square/certstrap/pkix        0.092s
=== RUN   TestVersion                          
--- PASS: TestVersion (0.08s)
=== RUN   TestIp                                   
--- PASS: TestIp (0.26s)                           
=== RUN   TestNotCA                                
--- PASS: TestNotCA (2.07s)
=== RUN   TestURI                                  
--- PASS: TestURI (0.28s)
=== RUN   TestWorkflow                             
--- PASS: TestWorkflow (1.21s)
PASS                                               
ok      github.com/square/certstrap/tests       3.907s
FAIL

System
Go version: go version go1.17.1 linux/amd64
Certstrap version: 1768704
Linux version: Arch linux

Revoke command should allow CRL validity specification

Revoke command creates expired CRL. I've found this out when tried to use certstrap-produced CRL with nginx which performs expiry check on CRL.

Fix codegansta github redirect

See golang/dep#1761

A simple dep/link change in certstrap would help.

Build Breakage on Master

@mbyczkowski The latest commit from 2 days ago has broken the master branch. Just wanted to call it to your attention. Thanks.

Support old-style certificate request header in CSR

It looks like there are two possible values for the PEM header in CSRs.

Certstrap currently expects the new style (used by OpenSSL) of "CERTIFICATE REQUEST".

The Microsoft certreq tool generates certificate requests with the old style "NEW CERTIFICATE REQUEST" (see https://stackoverflow.com/questions/28628744/is-there-a-spec-for-csr-begin-headers for a discussion of this).

Would it be possible for certstrap to support the style used by certreq so these do not need to be modified prior to use?

--ip flag for request-cert command fails to create key and csr

Hi, it looks like using just the --ip flag to the request-cert command fails:

jchen@rousseau-(master|✔)> certstrap --depot-path ./secrets/tls request-cert --ip 10.2.1.48 --organization nerdrage --country US --passphrase '' --locality San Francisco --organizational-unit ops --province CA
Created ./secrets/tls/��
0.key
Create certificate request error: asn1: string not valid UTF-8
[1] jchen@rousseau-(master|✔)> certstrap --depot-path ./secrets/tls request-cert --ip '10.2.1.48' --organization nerdrage --country US --passphrase '' --locality San Francisco --organizational-unit ops --province CA
Created ./secrets/tls/��
0.key
Create certificate request error: asn1: string not valid UTF-8
[1] jchen@rousseau-(master|✔)> certstrap --depot-path ./secrets/tls request-cert --common-name 10.2.1.48 --organization nerdrage --country US --passphrase '' --locality San Francisco --organizational-unit ops --province CA
Created ./secrets/tls/10.2.1.48.key
Created ./secrets/tls/10.2.1.48.csr