acavella / trustedcore-ra Goto Github PK

Receive signed certificate from CA.

Add OpenSSL configuration to support RSA.

printf lines have visible carriage return at end of line \n

2022-12-31T17:09:59Z 166414 [info] Trusted Core: RA v0.9.1 started\n
2022-12-31T17:09:59Z 166414 [info] Configuration file loaded sucessfully, /home/acavella/test2/trustedcore-ra-develop/conf/local.conf
2022-12-31T17:09:59Z 166414 [info] Input file is valid\n
2022-12-31T17:09:59Z 166414 [info] Completed reading input file, 54 bytes, input/input-example.txt\n

Describe the problem as it relates to the enhancement:
echo acts inconsistently across distributions and shells.

Describe the solution:
Replace echo statements with printf throughout.

Additional context:
n/a

Versions

TrustedCore-RA ver. 1.0.0

Platform

• OS and version: CentOS 7.9
• Additional: OpenSSL 1.0.2k-fips

Expected behavior

Generate CSR from private key.

Actual behavior / bug

OpenSSL errors during CSR process.

Additional context

2023-01-03T23:22:15Z 24352 [info] Generated RSA private key, /home/acavella/trustedcore-ra/output/YXAVJJ4OPQ/YXAVJJ4OPQ.key with a subject YXAVJJ4OPQ
unable to find 'distinguished_name' in config
problems making Certificate Request
139865373415312:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:324:group=req name=distinguished_name

Describe the problem as it relates to the enhancement:
Collecting version information and output necessary for debugging requires the user to provide these details based on their own knowledge/understanding.

Describe the solution:
Add "--debug" argument to command.

Debug output should provide:

• TrustedCore-RA Version
• Operating System and Version
• Requirement Versions
  • OpenSSL
  • sed
  • etc...

Additional context:
n/a

Is your feature request related to a problem? Please describe.
Current operation of curl requires encrypted PKCS12 be decrypted and presented as PEM to authenticate to RAMI API, leaving the private key exposed on the system.

Describe the solution you'd like
Utilize PKCS12 for curl client authentication, decrypt PKCS12 on the fly. Either prompt user for PKCS12 password or store secret securely.

Additional context

• Newer versions of curl support PKCS12: curl https://<api-endpoint> --cert-type P12 --cert <cert-file-here.p12>:<password>
• Utilize Hashicorp Vault to secure secrets
• https://stackoverflow.com/questions/32253909/curl-with-a-pkcs12-certificate-in-a-bash-script
• https://devops.stackexchange.com/questions/4503/access-vault-secret-from-bash-script

2022-12-31T17:08:28Z 166367 [info] Generating private key and csr for each subject\n
./tcra.sh: line 113: i: unbound variable

./tcra.sh: line 96: 0: command not found
2022-12-31T17:05:44Z 166089 [error] Command openssl was not found, exiting\n

Add ECDH OpenSSL configuration

CSR generates CN as utf8string and remaining parameter's as printablestring. CertAgent CA subject is printableString and therefore expects submitted CN to be printableString

Transmits PKCS#10 to CA