Skip to content

Commit c24237c

Browse files
omgslinuxomgslinux
committed
Merge branch 'feature/x509cert' into develop
2 parents 80c38a8 + 54e78f6 commit c24237c

28 files changed

+2012
-9
lines changed

‎public/custom/openssl.cnf

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
[ ca ]
2+
default_ca = CA_default # The default ca section
3+
4+
[ CA_default ]
5+
6+
default_days = 3650 # how long to certify for
7+
default_crl_days= 30 # how long before next CRL
8+
default_md = sha256 # use public key default MD
9+
preserve = no # keep passed DN ordering
10+
11+
x509_extensions = ca_extensions # The extensions to add to the cert
12+
13+
email_in_dn = no # Don't concat the email in the DN
14+
copy_extensions = copy # Required to copy SANs from CSR to cert
15+
16+
base_dir = .
17+
#certificate = $base_dir/cacert_rsa_4096_sha256.pem # The CA certifcate
18+
#private_key = $base_dir/cakey.pem # The CA private key
19+
new_certs_dir = $base_dir # Location for new certs after signing
20+
database = $base_dir/index.txt # Database index file
21+
serial = $base_dir/serial.txt # The current serial number
22+
23+
unique_subject = no # Set to 'no' to allow creation of
24+
# several certificates with same subject.
25+
policy = policy_c_o_match
26+
27+
####################################################################
28+
[ req ]
29+
default_bits = 4096
30+
default_keyfile = cakey.pem
31+
distinguished_name = ca_distinguished_name
32+
x509_extensions = ca_extensions
33+
string_mask = utf8only
34+
35+
####################################################################
36+
[ ca_distinguished_name ]
37+
countryName = Country Name (2 letter code)
38+
countryName_default = ES
39+
40+
stateOrProvinceName = State or Province Name (full name)
41+
stateOrProvinceName_default = Spain
42+
43+
localityName = Locality Name (eg, city)
44+
localityName_default = Madrid
45+
46+
organizationName = Organization Name (eg, company)
47+
organizationName_default = MyOrg
48+
49+
organizationalUnitName = Organizational Unit (eg, division)
50+
organizationalUnitName_default = My OU
51+
52+
commonName = Common Name (e.g. server FQDN or YOUR name)
53+
commonName_default = My Common Name
54+
55+
emailAddress = Email Address
56+
emailAddress_default = [email protected]
57+
58+
####################################################################
59+
[ ca_extensions ]
60+
61+
subjectKeyIdentifier=hash
62+
authorityKeyIdentifier=keyid:always, issuer
63+
basicConstraints = critical, CA:true
64+
keyUsage = keyCertSign, cRLSign
65+
66+
[policy_c_o_match]
67+
countryName = match
68+
stateOrProvinceName = optional
69+
organizationName = match
70+
organizationalUnitName = optional
71+
commonName = supplied
72+
emailAddress = optional
73+
74+
[ client_ext ]
75+
basicConstraints = CA:FALSE
76+
nsCertType = client, email
77+
nsComment = "OpenSSL Generated Client Certificate"
78+
subjectKeyIdentifier = hash
79+
authorityKeyIdentifier = keyid,issuer
80+
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
81+
extendedKeyUsage = clientAuth, emailProtection
82+
83+
[ server_ext ]
84+
# Extensions for server certificates (`man x509v3_config`).
85+
basicConstraints = CA:FALSE
86+
nsCertType = server
87+
nsComment = "OpenSSL Generated Server Certificate"
88+
subjectKeyIdentifier = hash
89+
authorityKeyIdentifier = keyid,issuer:always
90+
keyUsage = critical, digitalSignature, keyEncipherment
91+
extendedKeyUsage = serverAuth

‎src/Controller/Admin/CertificateController.php

+274
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,274 @@
1+
<?php
2+
3+
namespace App\Controller\Admin;
4+
5+
use Symfony\Component\HttpFoundation\Request;
6+
use Symfony\Component\HttpFoundation\Response;
7+
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
8+
use Symfony\Component\Routing\Annotation\Route;
9+
use App\Entity\Domain;
10+
use App\Entity\ServerCertificate;
11+
use App\Entity\User;
12+
use App\Form\CertType;
13+
//use App\Form\CertCommonType;
14+
use App\Utils\Certificate;
15+
use App\Repository\DomainRepository as REPO;
16+
use App\Repository\UserRepository as UR;
17+
18+
/**
19+
* Domain controller.
20+
*/
21+
#[Route(path: '/admin/certificate', name: 'admin_certificate_')]
22+
class CertificateController extends AbstractController
23+
{
24+
25+
const TABS = [
26+
[
27+
'n' => 'ca',
28+
't' => 'CA',
29+
],
30+
[
31+
'n' => 'client',
32+
't' => 'Client',
33+
],
34+
[
35+
'n' => 'server',
36+
't' => 'Server',
37+
],
38+
];
39+
40+
const VARS = [
41+
'modalSize' => 'modal-md',
42+
'PREFIX' => 'admin_certificate_',
43+
'included' => 'certificates/_form',
44+
'tdir' => 'certificates',
45+
'BASEDIR' => 'certificates/',
46+
'modalId' => 'certs',
47+
];
48+
49+
private $util;
50+
51+
private REPO $repo;
52+
53+
public function __construct(Certificate $util, REPO $repo)
54+
{
55+
$this->util = $util;
56+
$this->repo = $repo;
57+
}
58+
59+
/**
60+
* Lists all domain entities.
61+
*/
62+
#[Route(path: '/', name: 'index', methods: ['GET', 'POST'])]
63+
public function index(Request $request): Response
64+
{
65+
66+
$form = $this->createForm(CertType::class, null, ['duration' => '10 years']);
67+
$form->handleRequest($request);
68+
69+
/*if ($form->isSubmitted() && $form->isValid()) {
70+
71+
return $this->redirectToRoute(self::VARS['PREFIX'] . 'index');
72+
}*/
73+
74+
return $this->render('certificates/index.html.twig',
75+
[
76+
'title' => 'Certificates management',
77+
'form' => $form->createView(),
78+
'entities' => $this->repo->findAll(),
79+
'VARS' => self::VARS,
80+
]
81+
);
82+
}
83+
84+
#[Route(path: '/{id}/ca', name: 'ca', methods: ['GET', 'POST'])]
85+
public function ca(Request $request, Domain $domain): Response
86+
{
87+
$certSubject = $certInterval = null;
88+
if (null!=$certData=$domain->getCertData()) {
89+
$certout = $certData['certdata']['cert'];
90+
$cert = openssl_x509_parse($certout, false);
91+
$certSubject = $cert['subject'];
92+
$certInterval = [
93+
'NotBefore' => $this->util::convertUTCTime2Date($cert['validFrom']),
94+
'NotAfter' => $this->util::convertUTCTime2Date($cert['validTo']),
95+
];
96+
//dump($certData, $cert, $certInterval);
97+
}
98+
$form = $this->createForm(CertType::class, null, ['domain' => $domain, 'subject' => $certSubject, 'certtype' => 'ca', 'interval' => $certInterval, 'duration' => '10 years']);
99+
$form->handleRequest($request);
100+
101+
if ($form->isSubmitted() && $form->isValid()) {
102+
$files = $request->files->all();
103+
$csvcontents = null;
104+
foreach ($files as $file) {
105+
$csvfile = $file['common']['customFile'];
106+
if (null!=$csvfile) {
107+
$csvcontents = file_get_contents($csvfile);
108+
}
109+
}
110+
$formData = $form->getData();
111+
$certData = $this->util->createCACert($formData, $csvcontents);
112+
//dd($certData);
113+
if (!empty($certData['error'])) {
114+
$this->addFlash('error', $certData['error']);
115+
} else {
116+
$domain->setCertData($certData);
117+
$this->repo->add($domain, true);
118+
$this->addFlash('success', 'Se creó el certificado');
119+
}
120+
return $this->redirectToRoute(self::VARS['PREFIX'] . 'index');
121+
}
122+
123+
return $this->render('certificates/_form.html.twig',
124+
[
125+
'title' => 'Create CA certificate',
126+
'form' => $form->createView(),
127+
'entity' => $domain,
128+
]
129+
);
130+
}
131+
132+
#[Route(path: '/{id}/client/new', name: 'client_new', methods: ['GET', 'POST'])]
133+
public function clientNew(Request $request, UR $userRepo, Domain $domain): Response
134+
{
135+
$certSubject = null;
136+
if (null!=$certData=$domain->getCertData()) {
137+
$certout = $certData['certdata']['cert'];
138+
$cert = openssl_x509_parse($certout, false);
139+
$certSubject = $cert['subject'];
140+
}
141+
142+
$form = $this->createForm(CertType::class, null, ['domain' => $domain->getId(), 'subject' => $certSubject, 'certtype' => 'client', 'duration' => '5 years']);
143+
$form->handleRequest($request);
144+
145+
if ($form->isSubmitted() && $form->isValid()) {
146+
$formData = $form->getData();
147+
$this->util->setDomain($domain);
148+
$user = $formData['common']['emailAddress'];
149+
$certData = $this->util->createClientCert($formData);
150+
$indexData = $this->util->addToIndex($certData['certdata']['cert']);
151+
//dd($certData, $indexData);
152+
$user->setCertData($certData);
153+
$userRepo->add($user, true);
154+
$this->repo->updateCAIndex($domain, $indexData);
155+
$this->addFlash('success', 'Se creo el certificado');
156+
return $this->redirectToRoute(self::VARS['PREFIX'] . 'index');
157+
}
158+
159+
return $this->render('certificates/_form.html.twig',
160+
[
161+
'title' => 'Create client certificate',
162+
'form' => $form->createView(),
163+
'entity' => $domain,
164+
]
165+
);
166+
}
167+
168+
#[Route(path: '/{id}/client/download/{dtype}', name: 'client_download', methods: ['GET', 'POST'])]
169+
public function clientDownload(Request $request, User $user, $dtype='pcks12'): Response
170+
{
171+
if (($dtype == 'pkcs12') || ($dtype == 'certkey')) {
172+
$this->addFlash('success', 'Se creo el certificado');
173+
return $this->util
174+
->certDownload('client', [$user, $dtype]);
175+
176+
} else {
177+
$this->addFlash('error', "Opción incorrecta $dtype");
178+
}
179+
return $this->redirectToRoute(self::VARS['PREFIX'] . 'index');
180+
}
181+
182+
#[Route(path: '/{id}/server/new', name: 'server_new', methods: ['GET', 'POST'])]
183+
public function serverNew(Request $request, Domain $domain): Response
184+
{
185+
$certSubject = null;
186+
if (null!=$certData=$domain->getCertData()) {
187+
$certout = $certData['certdata']['cert'];
188+
$cert = openssl_x509_parse($certout, false);
189+
$certSubject = $cert['subject'];
190+
// Eliminamos el commonName
191+
unset($certSubject['commonName']);
192+
}
193+
194+
$form = $this->createForm(CertType::class, null, ['domain' => $domain, 'subject' => $certSubject, 'certtype' => 'server', 'duration' => '5 years']);
195+
$form->handleRequest($request);
196+
197+
if ($form->isSubmitted() && $form->isValid()) {
198+
$formData = $form->getData();
199+
$this->util->setDomain($domain);
200+
$certData = $this->util->createServerCert($formData);
201+
//dump($formData, $certData);
202+
$d = $formData['common']['commonName'];
203+
$serverCertificate = new ServerCertificate();
204+
$serverCertificate->setDomain($domain)
205+
->setDescription($d!='*'?$d:'wildcard')
206+
->setCertData($certData);
207+
$domain->addServerCertificate($serverCertificate);
208+
$indexData = $this->util->addToIndex($certData['certdata']['cert']);
209+
//dd($indexData);
210+
//$this->repo->add($domain, true);
211+
$this->repo->updateCAIndex($domain, $indexData);
212+
$this->addFlash('success', 'Se creo el certificado');
213+
return $this->redirectToRoute(self::VARS['PREFIX'] . 'index');
214+
}
215+
216+
return $this->render('certificates/_form.html.twig',
217+
[
218+
'title' => 'Create server certificate',
219+
'form' => $form->createView(),
220+
'entity' => $domain,
221+
]
222+
);
223+
}
224+
225+
#[Route(path: '/{id}/server/show', name: 'server_show', methods: ['GET', 'POST'])]
226+
public function serverShow(Request $request, Domain $domain): Response
227+
{
228+
$entities = [];
229+
foreach ($domain->getServerCertificates() as $certificate) {
230+
if (null!=$certData=$domain->getCertData()) {
231+
$certout = $certData['certdata']['cert'];
232+
$cert = openssl_x509_parse($certout, false);
233+
$certInterval = [
234+
'notBefore' => $this->util::convertUTCTime2Date($cert['validFrom']),
235+
'notAfter' => $this->util::convertUTCTime2Date($cert['validTo']),
236+
];
237+
//dump($certData, $cert, $certInterval);
238+
$data = [
239+
'description' => $certificate->getDescription(),
240+
'domain' => $certificate->getDomain(),
241+
'certdata' => $this->util->extractX509Data($certificate),
242+
'interval' => $certInterval,
243+
'entity' => $certificate,
244+
];
245+
$entities[] = $data;
246+
}
247+
}
248+
//dump($entities);
249+
250+
return $this->render('certificates/server_show.html.twig',
251+
[
252+
'title' => 'Show server certificate',
253+
'domain' => $domain,
254+
'entities' => $entities,
255+
'VARS' => self::VARS,
256+
]
257+
);
258+
}
259+
260+
#[Route(path: '/{id}/server/download/{dtype}', name: 'server_download', methods: ['GET', 'POST'])]
261+
public function serverDownload(Request $request, ServerCertificate $certificate, $dtype): Response
262+
{
263+
if (($dtype == 'chain') || ($dtype == 'certkey')) {
264+
$this->addFlash('success', 'Se creo el certificado');
265+
return $this->util
266+
->certDownload('server', [$certificate, $dtype]);
267+
268+
} else {
269+
$this->addFlash('error', "Opción incorrecta $dtype");
270+
}
271+
return $this->redirectToRoute(self::VARS['PREFIX'] . 'index');
272+
}
273+
274+
}

‎src/Controller/Admin/DomainController.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ class DomainController extends AbstractController
2626
const TABS = [
2727
[
2828
'n' => 'users',
29-
't' => 'Usuarios',
29+
't' => 'Users',
3030
],
3131
[
3232
'n' => 'aliases',

0 commit comments

Comments
 (0)