From 5c4d55084f8c7cb2bb5ca5f81ecbd82afd1fdd18 Mon Sep 17 00:00:00 2001
From: laking <laking@ispconfig3>
Date: Sat, 2 Apr 2011 17:25:25 +0000
Subject: [PATCH] Implemented local CA certificate signing.
---
install/dist/conf/centos52.conf.php | 2 ++
install/dist/conf/centos53.conf.php | 2 ++
install/dist/conf/debian40.conf.php | 3 +++
install/dist/conf/debian60.conf.php | 3 +++
install/dist/conf/fedora9.conf.php | 2 ++
install/dist/conf/gentoo.conf.php | 3 +++
install/dist/conf/opensuse110.conf.php | 2 ++
install/dist/conf/opensuse112.conf.php | 2 ++
install/dist/lib/fedora.lib.php | 4 ++++
install/dist/lib/gentoo.lib.php | 4 ++++
install/dist/lib/opensuse.lib.php | 4 ++++
install/install.php | 13 ++++++++++++
install/tpl/config.inc.php.master | 4 ++++
install/update.php | 14 +++++++++++++
.../plugins-available/apache2_plugin.inc.php | 21 ++++++++++++++++---
15 files changed, 80 insertions(+), 3 deletions(-)
diff --git a/install/dist/conf/centos52.conf.php b/install/dist/conf/centos52.conf.php
index 8ff03ce603..3e4c28900e 100644
--- a/install/dist/conf/centos52.conf.php
+++ b/install/dist/conf/centos52.conf.php
@@ -186,4 +186,6 @@ $conf['cron']['init_script'] = 'crond';
$conf['cron']['crontab_dir'] = '/etc/cron.d';
$conf['cron']['wget'] = '/usr/bin/wget';
+$conf['CA-path'] = '/etc/pki/CA';
+
?>
diff --git a/install/dist/conf/centos53.conf.php b/install/dist/conf/centos53.conf.php
index 8ff03ce603..3e4c28900e 100644
--- a/install/dist/conf/centos53.conf.php
+++ b/install/dist/conf/centos53.conf.php
@@ -186,4 +186,6 @@ $conf['cron']['init_script'] = 'crond';
$conf['cron']['crontab_dir'] = '/etc/cron.d';
$conf['cron']['wget'] = '/usr/bin/wget';
+$conf['CA-path'] = '/etc/pki/CA';
+
?>
diff --git a/install/dist/conf/debian40.conf.php b/install/dist/conf/debian40.conf.php
index d176701644..5c62a416d6 100644
--- a/install/dist/conf/debian40.conf.php
+++ b/install/dist/conf/debian40.conf.php
@@ -190,5 +190,8 @@ $conf['vlogger']['config_dir'] = '/etc';
$conf['cron']['init_script'] = 'cron';
$conf['cron']['crontab_dir'] = '/etc/cron.d';
$conf['cron']['wget'] = '/usr/bin/wget';
+
+$conf['CA-path'] = '/etc/ssl';
+
?>
diff --git a/install/dist/conf/debian60.conf.php b/install/dist/conf/debian60.conf.php
index c1344d5098..6790fc6624 100644
--- a/install/dist/conf/debian60.conf.php
+++ b/install/dist/conf/debian60.conf.php
@@ -190,5 +190,8 @@ $conf['vlogger']['config_dir'] = '/etc';
$conf['cron']['init_script'] = 'cron';
$conf['cron']['crontab_dir'] = '/etc/cron.d';
$conf['cron']['wget'] = '/usr/bin/wget';
+
+$conf['CA-path'] = '/etc/ssl';
+
?>
diff --git a/install/dist/conf/fedora9.conf.php b/install/dist/conf/fedora9.conf.php
index ea1affa737..ac36a107d8 100644
--- a/install/dist/conf/fedora9.conf.php
+++ b/install/dist/conf/fedora9.conf.php
@@ -186,4 +186,6 @@ $conf['cron']['init_script'] = 'crond';
$conf['cron']['crontab_dir'] = '/etc/cron.d';
$conf['cron']['wget'] = '/usr/bin/wget';
+$conf['CA-path'] = '/etc/pki/CA';
+
?>
diff --git a/install/dist/conf/gentoo.conf.php b/install/dist/conf/gentoo.conf.php
index 1fd634ac3e..018ab8ff0b 100644
--- a/install/dist/conf/gentoo.conf.php
+++ b/install/dist/conf/gentoo.conf.php
@@ -202,4 +202,7 @@ $conf['cron']['init_script'] = 'vixie-cron';
$conf['cron']['crontab_dir'] = '/etc/cron.d';
$conf['cron']['group'] = 'cron';
$conf['cron']['wget'] = '/usr/bin/wget';
+
+$conf['CA-path'] = '/etc/ssl';
+
?>
diff --git a/install/dist/conf/opensuse110.conf.php b/install/dist/conf/opensuse110.conf.php
index 293c4d71bf..82467e5603 100644
--- a/install/dist/conf/opensuse110.conf.php
+++ b/install/dist/conf/opensuse110.conf.php
@@ -186,4 +186,6 @@ $conf['cron']['init_script'] = 'cron';
$conf['cron']['crontab_dir'] = '/etc/cron.d';
$conf['cron']['wget'] = '/usr/bin/wget';
+$conf['CA-path'] = '/etc/ssl';
+
?>
diff --git a/install/dist/conf/opensuse112.conf.php b/install/dist/conf/opensuse112.conf.php
index 88c1c6e697..0b89c5b7a8 100644
--- a/install/dist/conf/opensuse112.conf.php
+++ b/install/dist/conf/opensuse112.conf.php
@@ -186,4 +186,6 @@ $conf['cron']['init_script'] = 'cron';
$conf['cron']['crontab_dir'] = '/etc/cron.d';
$conf['cron']['wget'] = '/usr/bin/wget';
+$conf['CA-path'] = '/etc/ssl';
+
?>
diff --git a/install/dist/lib/fedora.lib.php b/install/dist/lib/fedora.lib.php
index eec9af6cc7..24ea083a63 100644
--- a/install/dist/lib/fedora.lib.php
+++ b/install/dist/lib/fedora.lib.php
@@ -695,6 +695,10 @@ class installer_dist extends installer_base {
$content = str_replace('{server_id}', $conf['server_id'], $content);
$content = str_replace('{ispconfig_log_priority}', $conf['ispconfig_log_priority'], $content);
$content = str_replace('{language}', $conf['language'], $content);
+
+ if (!$conf['CA-enabled']) $content = str_replace('$conf[\'CA', '//$conf[\'CA', $content);
+ $content = str_replace('{CA-path}', $conf['CA-path'], $content);
+ $content = str_replace('{CA-pass}', $conf['CA-pass'], $content);
wf("$install_dir/server/lib/$configfile", $content);
diff --git a/install/dist/lib/gentoo.lib.php b/install/dist/lib/gentoo.lib.php
index 428cb98ae9..17e10d1e61 100644
--- a/install/dist/lib/gentoo.lib.php
+++ b/install/dist/lib/gentoo.lib.php
@@ -667,6 +667,10 @@ class installer extends installer_base
$this->write_config_file("$install_dir/interface/lib/$configfile", $content);
+ if(!$conf['CA-enabled']) $content = str_replace('$conf[\'CA','//$conf[\'CA', $content);
+ $content = str_replace('{CA-path}', $conf['CA-path'], $content);
+ $content = str_replace('{CA-pass}', $conf['CA-pass'], $content);
+
//* Create the config file for ISPConfig server
$this->write_config_file("$install_dir/server/lib/$configfile", $content);
diff --git a/install/dist/lib/opensuse.lib.php b/install/dist/lib/opensuse.lib.php
index ec01255eb0..3bb66fc10c 100644
--- a/install/dist/lib/opensuse.lib.php
+++ b/install/dist/lib/opensuse.lib.php
@@ -708,6 +708,10 @@ class installer_dist extends installer_base {
$content = str_replace('{ispconfig_log_priority}', $conf['ispconfig_log_priority'], $content);
$content = str_replace('{language}', $conf['language'], $content);
+ if(!$conf['CA-enabled']) $content = str_replace('$conf[\'CA','//$conf[\'CA', $content);
+ $content = str_replace('{CA-path}', $conf['CA-path'], $content);
+ $content = str_replace('{CA-pass}', $conf['CA-pass'], $content);
+
wf("$install_dir/server/lib/$configfile", $content);
//* Create the config file for remote-actions (but only, if it does not exist, because
diff --git a/install/install.php b/install/install.php
index e5785fa744..7b7afed6cd 100644
--- a/install/install.php
+++ b/install/install.php
@@ -438,6 +438,19 @@ if($install_mode == 'standard') {
$inst->configure_firewall();
}
+ //** Configure CA
+ if(strtolower($inst->simple_query('Should this installation use a local CA to default-sign certificates?',array('y','n'),'n')) == 'y') {
+ $conf['CA-enabled'] = true;
+ $conf['CA-path'] = $inst->free_query('Path to the CA folder: ', $conf['CA-path']);
+ $conf['CA-pass'] = $inst->free_query('Root Certificate Passphrase', '');
+ if(!is_file($conf['CA-path'].'/openssl.cnf'))
+ {
+ swriteln('ERROR. '.$conf['CA-path'].'/openssl.cnf not found.');
+ $conf['CA-enabled'] = false;
+ }
+ //$inst->configure_ca();
+ } else {$conf['CA-enabled'] = false;};
+
//** Configure ISPConfig :-)
if(strtolower($inst->simple_query('Install ISPConfig Web Interface',array('y','n'),'y')) == 'y') {
swriteln('Installing ISPConfig');
diff --git a/install/tpl/config.inc.php.master b/install/tpl/config.inc.php.master
index 1ce1c888fb..e3e386e42c 100644
--- a/install/tpl/config.inc.php.master
+++ b/install/tpl/config.inc.php.master
@@ -157,6 +157,10 @@ $conf['interface_logout_url'] = ''; // example: http://www.domain.tld/
$conf['start_db'] = true;
$conf['start_session'] = true;
+//** CA-configuration
+$conf['CA-path'] = '{CA-path}';
+$conf['CA-pass'] = '{CA-pass}';
+
//** Constants
define('LOGLEVEL_DEBUG',0);
diff --git a/install/update.php b/install/update.php
index 17f6c3c3ca..f5b2380f1e 100644
--- a/install/update.php
+++ b/install/update.php
@@ -303,6 +303,20 @@ if($reconfigure_services_answer == 'yes') {
//}
}
+ //** Configure CA
+ if(strtolower($inst->simple_query('Should this installation use a local CA to default-sign certificates?',array('y','n'),'n')) == 'y') {
+ $conf['CA-enabled'] = true;
+ $conf['CA-path'] = $inst->free_query('Path to the CA folder: ', $conf['CA-path']);
+ $conf['CA-pass'] = $inst->free_query('Root Certificate Passphrase', '');
+ if(!is_file($conf['CA-path'].'/openssl.cnf'))
+ {
+ swriteln('ERROR. '.$conf['CA-path'].'/openssl.cnf not found.');
+ $conf['CA-enabled'] = false;
+ }
+ //$inst->configure_ca();
+ } else {$conf['CA-enabled'] = false;};
+
+
//** Configure ISPConfig
swriteln('Updating ISPConfig');
diff --git a/server/plugins-available/apache2_plugin.inc.php b/server/plugins-available/apache2_plugin.inc.php
index f6161b9c48..41ee397450 100644
--- a/server/plugins-available/apache2_plugin.inc.php
+++ b/server/plugins-available/apache2_plugin.inc.php
@@ -137,8 +137,18 @@ class apache2_plugin {
$crt_file = escapeshellcmd($crt_file);
if(is_file($ssl_cnf_file)) {
- exec("openssl genrsa -des3 -rand $rand_file -passout pass:$ssl_password -out $key_file 2048 && openssl req -new -passin pass:$ssl_password -passout pass:$ssl_password -key $key_file -out $csr_file -days $ssl_days -config $config_file && openssl req -x509 -passin pass:$ssl_password -passout pass:$ssl_password -key $key_file -in $csr_file -out $crt_file -days $ssl_days -config $config_file && openssl rsa -passin pass:$ssl_password -in $key_file -out $key_file2");
- $app->log('Creating SSL Cert for: '.$domain,LOGLEVEL_DEBUG);
+
+ exec("openssl genrsa -des3 -rand $rand_file -passout pass:$ssl_password -out $key_file 2048");
+ exec("openssl req -new -passin pass:$ssl_password -passout pass:$ssl_password -key $key_file -out $csr_file -days $ssl_days -config $config_file");
+ if(isset($conf['CA-path']) && isset($conf['CA-pass']) )
+ {
+ exec("openssl ca -batch -out $crt_file -config ".$conf['CA-path']."/openssl.cnf -passin pass:".$conf['CA-pass']." -in $csr_file");
+ $app->log("Creating CA-signed SSL Cert for: $domain",LOGLEVEL_DEBUG);
+ } else{
+ exec("openssl req -x509 -passin pass:$ssl_password -passout pass:$ssl_password -key $key_file -in $csr_file -out $crt_file -days $ssl_days -config $config_file ");
+ $app->log("Creating self-signed SSL Cert for: $domain",LOGLEVEL_DEBUG);
+ };
+ exec("openssl rsa -passin pass:$ssl_password -in $key_file -out $key_file2");
}
exec('chmod 400 '.$key_file2);
@@ -178,6 +188,11 @@ class apache2_plugin {
$csr_file = $ssl_dir.'/'.$domain.'.csr';
$crt_file = $ssl_dir.'/'.$domain.'.crt';
$bundle_file = $ssl_dir.'/'.$domain.'.bundle';
+ if(isset($conf['CA-path']) && isset($conf['CA-pass']) )
+ {
+ exec("openssl ca -batch -config ".$conf['CA-path']."/openssl.cnf -passin pass:".$conf['CA-pass']." -revoke $crt_file");
+ $app->log("Revoking CA-signed SSL Cert for: $domain",LOGLEVEL_DEBUG);
+ };
unlink($csr_file);
unlink($crt_file);
unlink($bundle_file);
@@ -597,7 +612,7 @@ class apache2_plugin {
$crt_file = $ssl_dir.'/'.$domain.'.crt';
$bundle_file = $ssl_dir.'/'.$domain.'.bundle';
- if($data['new']['ssl'] == 'y' && @is_file($crt_file) && @is_file($key_file)) {
+ if($data['new']['ssl'] == 'y' && @is_file($crt_file) && @is_file($key_file) && (@filesize($crt_file)>0) && (@filesize($key_file)>0)) {
$vhost_data['ssl_enabled'] = 1;
$app->log('Enable SSL for: '.$domain,LOGLEVEL_DEBUG);
} else {
--
GitLab