Update OpenSSL certificates set up
Resolves: RHEL-118292
This commit is contained in:
Vitezslav Crhonek
parent
409baa6473
commit
5cdfb579c0
103
openwsman-2.6.8-ssl-certs-gen-changes.patch
Normal file
103
openwsman-2.6.8-ssl-certs-gen-changes.patch
Normal file
@ -0,0 +1,103 @@
|
||||
diff -up openwsman-2.6.8/etc/owsmangencert.sh.cmake.orig openwsman-2.6.8/etc/owsmangencert.sh.cmake
|
||||
--- openwsman-2.6.8/etc/owsmangencert.sh.cmake.orig 2025-10-14 10:05:22.966137046 +0200
|
||||
+++ openwsman-2.6.8/etc/owsmangencert.sh.cmake 2025-10-14 10:09:39.142759545 +0200
|
||||
@@ -1,10 +1,74 @@
|
||||
-#!/bin/sh
|
||||
-
|
||||
#!/bin/sh -e
|
||||
|
||||
CERTFILE=@WSMANCONF_DIR@/servercert.pem
|
||||
KEYFILE=@WSMANCONF_DIR@/serverkey.pem
|
||||
CNFFILE=@WSMANCONF_DIR@/ssleay.cnf
|
||||
+CAFILE=@WSMANCONF_DIR@/ca.crt
|
||||
+DAYS=365
|
||||
+
|
||||
+function create_ssl_cnf
|
||||
+{
|
||||
+ # Get minimum RSA key length at current security level
|
||||
+ # This workarounds openssl not enforcing min. key length enforced by current security level
|
||||
+ KEYSIZE=`grep min_rsa_size /etc/crypto-policies/state/CURRENT.pol | cut -d ' ' -f 3`
|
||||
+
|
||||
+ # Create OpenSSL configuration files for generating certificates
|
||||
+ echo "[ req ]" > $CNFFILE
|
||||
+ echo "default_bits = $KEYSIZE" >> $CNFFILE
|
||||
+ echo "default_keyfile = privkey.pem" >> $CNFFILE
|
||||
+ echo "distinguished_name = req_distinguished_name" >> $CNFFILE
|
||||
+
|
||||
+ echo "[ req_distinguished_name ]" >> $CNFFILE
|
||||
+ echo "countryName = Country Name (2 letter code)" >> $CNFFILE
|
||||
+ echo "countryName_default = GB" >> $CNFFILE
|
||||
+ echo "countryName_min = 2" >> $CNFFILE
|
||||
+ echo "countryName_max = 2" >> $CNFFILE
|
||||
+
|
||||
+ echo "stateOrProvinceName = State or Province Name (full name)" >> $CNFFILE
|
||||
+ echo "stateOrProvinceName_default = Some-State" >> $CNFFILE
|
||||
+
|
||||
+ echo "localityName = Locality Name (eg, city)" >> $CNFFILE
|
||||
+
|
||||
+ echo "organizationName = Organization Name (eg, company; recommended)" >> $CNFFILE
|
||||
+ echo "organizationName_max = 64" >> $CNFFILE
|
||||
+
|
||||
+ echo "organizationalUnitName = Organizational Unit Name (eg, section)" >> $CNFFILE
|
||||
+ echo "organizationalUnitName_max = 64" >> $CNFFILE
|
||||
+
|
||||
+ echo "commonName = server name (eg. ssl.domain.tld; required!!!)" >> $CNFFILE
|
||||
+ echo "commonName_max = 80" >> $CNFFILE
|
||||
+
|
||||
+ echo "emailAddress = Email Address" >> $CNFFILE
|
||||
+ echo "emailAddress_max = 85" >> $CNFFILE
|
||||
+}
|
||||
+
|
||||
+function selfsign_sscg()
|
||||
+{
|
||||
+ sscg --quiet \
|
||||
+ --lifetime "${DAYS}" \
|
||||
+ --cert-key-file "${KEYFILE}" \
|
||||
+ --cert-file "${CERTFILE}" \
|
||||
+ --ca-file "${CAFILE}"
|
||||
+}
|
||||
+
|
||||
+function selfsign_openssl()
|
||||
+{
|
||||
+
|
||||
+ echo
|
||||
+ echo creating selfsigned certificate
|
||||
+ echo "replace it with one signed by a certification authority (CA)"
|
||||
+ echo
|
||||
+ echo enter your ServerName at the Common Name prompt
|
||||
+ echo
|
||||
+
|
||||
+ # use special .cnf, because with normal one no valid selfsigned
|
||||
+ # certificate is created
|
||||
+
|
||||
+ openssl req -days $DAYS $@ -config $CNFFILE \
|
||||
+ -new -x509 -nodes -out $CERTFILE \
|
||||
+ -keyout $KEYFILE
|
||||
+ chmod 600 $KEYFILE
|
||||
+}
|
||||
|
||||
if [ "$1" != "--force" -a -f $KEYFILE ]; then
|
||||
echo "$KEYFILE exists! Use \"$0 --force.\""
|
||||
@@ -15,19 +79,7 @@ if [ "$1" = "--force" ]; then
|
||||
shift
|
||||
fi
|
||||
|
||||
-echo
|
||||
-echo creating selfsigned certificate
|
||||
-echo "replace it with one signed by a certification authority (CA)"
|
||||
-echo
|
||||
-echo enter your ServerName at the Common Name prompt
|
||||
-echo
|
||||
-
|
||||
-# use special .cnf, because with normal one no valid selfsigned
|
||||
-# certificate is created
|
||||
-
|
||||
-export RANDFILE=/dev/random
|
||||
-openssl req -days 365 $@ -config $CNFFILE \
|
||||
- -new -x509 -nodes -out $CERTFILE \
|
||||
- -keyout $KEYFILE
|
||||
-chmod 600 $KEYFILE
|
||||
+create_ssl_cnf
|
||||
|
||||
+# If sscg fails, try openssl
|
||||
+selfsign_sscg || selfsign_openssl
|
||||
@ -3,7 +3,7 @@
|
||||
|
||||
Name: openwsman
|
||||
Version: 2.6.8
|
||||
Release: 23%{?dist}
|
||||
Release: 24%{?dist}
|
||||
Summary: Open source Implementation of WS-Management
|
||||
|
||||
License: BSD
|
||||
@ -24,6 +24,7 @@ Patch6: openwsman-2.6.8-CVE-2019-3816.patch
|
||||
Patch7: openwsman-2.6.8-CVE-2019-3833.patch
|
||||
Patch8: openwsman-2.6.8-update-ssleay-conf.patch
|
||||
Patch9: openwsman-2.6.8-http-unauthorized-improve.patch
|
||||
Patch10: openwsman-2.6.8-ssl-certs-gen-changes.patch
|
||||
BuildRequires: make
|
||||
BuildRequires: swig
|
||||
BuildRequires: libcurl-devel libxml2-devel pam-devel sblim-sfcc-devel
|
||||
@ -137,6 +138,7 @@ You can use it to send shell commands to a remote Windows hosts.
|
||||
%patch -P7 -p1 -b .CVE-2019-3833
|
||||
%patch -P8 -p1 -b .update-ssleay-conf
|
||||
%patch -P9 -p1 -b .http-unauthorized-improve
|
||||
%patch -P10 -p1 -b .ssl-certs-gen-changes
|
||||
|
||||
%build
|
||||
# Removing executable permissions on .c and .h files to fix rpmlint warnings.
|
||||
@ -290,6 +292,10 @@ rm -f /var/log/wsmand.log
|
||||
%{_bindir}/winrs
|
||||
|
||||
%changelog
|
||||
* Tue Oct 14 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.8-24
|
||||
- Update OpenSSL certificates set up
|
||||
Resolves: RHEL-118292
|
||||
|
||||
* Thu Nov 24 2022 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.8-23
|
||||
- Improve handling of HTTP 401 Unauthorized
|
||||
Resolves: #2127415
|
||||
|
||||
Loading…
Reference in New Issue
Block a user