rpms/sscg
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI sscg-4.0.3-2.el10

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-05-19 18:58:05 -04:00
parent 0d5aac35b5
commit 835fea3588
11 changed files with 234 additions and 1613 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
sscg-3.0.5.tar.gz
sscg-4.0.3.tar.gz

205
0001-Extend-maximum-DNS-name-to-255.patch
View File

@ -1,205 +0,0 @@
From d3a4452d7cc78589fb6077e98b228e09e9e76e3f Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Wed, 15 Feb 2023 15:49:38 -0500
Subject: [PATCH 1/3] Extend maximum DNS name to 255
The hostname part is still restricted to 63 characters
See RFC 1035, section 2.3.4
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
include/sscg.h | 3 +++
src/arguments.c | 35 +++++++++++++++++++++++++++--------
src/authority.c | 26 +++++++++++++++++++++++---
src/cert.c | 5 +++++
src/x509.c | 6 +++---
5 files changed, 61 insertions(+), 14 deletions(-)
diff --git a/include/sscg.h b/include/sscg.h
index 0f35631018dc2745e986cd1e7e094e3e37be8e54..f0c6d93b871e4bd3f2c805be8dfa7485ec34746a 100644
--- a/include/sscg.h
+++ b/include/sscg.h
@@ -313,6 +313,9 @@ enum sscg_cert_type
#define SSCG_MIN_KEY_PASS_LEN 4
#define SSCG_MAX_KEY_PASS_LEN 1023
+/* RFC 1035, section 2.3.4 (Size Limits) */
+#define MAX_HOST_LEN 63
+#define MAX_FQDN_LEN 255
int
sscg_handle_arguments (TALLOC_CTX *mem_ctx,
diff --git a/src/arguments.c b/src/arguments.c
index 0b7a060d31bed97130c7cb9b7feacf0876e25c0d..2f412bee1bee9620f28b6e84aed4aef17aee3a6a 100644
--- a/src/arguments.c
+++ b/src/arguments.c
@@ -786,10 +786,19 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx,
}
CHECK_MEM (options->hostname);
- if (strnlen (options->hostname, MAXHOSTNAMELEN + 1) > MAXHOSTNAMELEN)
+ if (strnlen (options->hostname, MAX_FQDN_LEN + 1) > MAX_FQDN_LEN)
{
- fprintf (
- stderr, "Hostnames may not exceed %d characters\n", MAXHOSTNAMELEN);
+ fprintf (stderr, "FQDNs may not exceed %d characters\n", MAX_FQDN_LEN);
+ ret = EINVAL;
+ goto done;
+ }
+
+ if ((strchr (options->hostname, '.') - options->hostname) > MAX_HOST_LEN + 4)
+ {
+ fprintf (stderr,
+ "Hostnames may not exceed %d characters in Subject "
+ "Alternative Names\n",
+ MAX_HOST_LEN);
ret = EINVAL;
goto done;
}
@@ -798,25 +807,35 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx,
options struct. It's not the most efficient approach, but
it's only done one time, so there is no sense in optimizing
it. */
+ size_t i = 0;
if (alternative_names)
{
- size_t i = 0;
while (alternative_names[i] != NULL)
{
options->subject_alt_names = talloc_realloc (
- options, options->subject_alt_names, char *, i + 2);
+ options, options->subject_alt_names, char *, i + 1);
CHECK_MEM (options->subject_alt_names);
options->subject_alt_names[i] =
talloc_strdup (options->subject_alt_names, alternative_names[i]);
CHECK_MEM (options->subject_alt_names[i]);
-
- /* Add a NULL terminator to the end */
- options->subject_alt_names[i + 1] = NULL;
i++;
}
}
+ /*
+ The hostname must always be listed in SubjectAlternativeNames as well.
+ Note that the realloc also adds an extra entry for the NULL terminator
+ */
+ options->subject_alt_names =
+ talloc_realloc (options, options->subject_alt_names, char *, i + 2);
+ CHECK_MEM (options->subject_alt_names);
+ options->subject_alt_names[i] =
+ talloc_strdup (options->subject_alt_names, options->hostname);
+ CHECK_MEM (options->subject_alt_names[i]);
+ /* Add a NULL terminator to the end */
+ options->subject_alt_names[i + 1] = NULL;
+
if (options->key_strength < options->minimum_key_strength)
{
fprintf (stderr,
diff --git a/src/authority.c b/src/authority.c
index 4efaa9e730964b9762b59d0e6698c1623901ccfe..f509fd4316c3b7b230f99de6464491c319fc5d45 100644
--- a/src/authority.c
+++ b/src/authority.c
@@ -56,6 +56,7 @@ create_private_CA (TALLOC_CTX *mem_ctx,
char *name_constraint;
char *san;
char *tmp;
+ char *dot;
tmp_ctx = talloc_new (NULL);
CHECK_MEM (tmp_ctx);
@@ -89,6 +90,26 @@ create_private_CA (TALLOC_CTX *mem_ctx,
ca_certinfo->cn = talloc_strdup (ca_certinfo, options->hostname);
CHECK_MEM (ca_certinfo->cn);
+ /* Truncate the CN at the first dot */
+ if ((dot = strchr (ca_certinfo->cn, '.')))
+ *dot = '\0';
+
+ if (options->subject_alt_names)
+ {
+ for (i = 0; options->subject_alt_names[i]; i++)
+ {
+ ca_certinfo->subject_alt_names = talloc_realloc (
+ ca_certinfo, ca_certinfo->subject_alt_names, char *, i + 2);
+ CHECK_MEM (ca_certinfo->subject_alt_names);
+
+ ca_certinfo->subject_alt_names[i] = talloc_strdup (
+ ca_certinfo->subject_alt_names, options->subject_alt_names[i]);
+ CHECK_MEM (ca_certinfo->subject_alt_names[i]);
+
+ /* Add a NULL terminator to the end */
+ ca_certinfo->subject_alt_names[i + 1] = NULL;
+ }
+ }
/* Make this a CA certificate */
@@ -106,10 +127,9 @@ create_private_CA (TALLOC_CTX *mem_ctx,
CHECK_MEM (ex);
sk_X509_EXTENSION_push (ca_certinfo->extensions, ex);
- /* Restrict signing to the hostname and subjectAltNames of the
- service certificate */
+ /* Restrict signing to the CN and subjectAltNames of the service certificate */
name_constraint =
- talloc_asprintf (tmp_ctx, "permitted;DNS:%s", options->hostname);
+ talloc_asprintf (tmp_ctx, "permitted;DNS:%s", ca_certinfo->cn);
CHECK_MEM (name_constraint);
if (options->subject_alt_names)
diff --git a/src/cert.c b/src/cert.c
index 99d9109f5981ef408aeb7d05a8327e1a38d5700a..e36de71e7ca9b34f87734542d5646b466cd61d4c 100644
--- a/src/cert.c
+++ b/src/cert.c
@@ -31,6 +31,7 @@
*/
+#include <string.h>
#include "include/sscg.h"
#include "include/cert.h"
#include "include/x509.h"
@@ -52,6 +53,7 @@ create_cert (TALLOC_CTX *mem_ctx,
struct sscg_x509_req *csr;
struct sscg_evp_pkey *pkey;
struct sscg_x509_cert *cert;
+ char *dot;
X509_EXTENSION *ex = NULL;
EXTENDED_KEY_USAGE *extended;
TALLOC_CTX *tmp_ctx = NULL;
@@ -87,6 +89,9 @@ create_cert (TALLOC_CTX *mem_ctx,
certinfo->cn = talloc_strdup (certinfo, options->hostname);
CHECK_MEM (certinfo->cn);
+ /* Truncate the CN at the first dot */
+ if ((dot = strchr (certinfo->cn, '.')))
+ *dot = '\0';
if (options->subject_alt_names)
{
diff --git a/src/x509.c b/src/x509.c
index 4f3f11cd3411f00cf6de3a72ba897adc97944e35..9f6f21b49c2dd70629fed67d327027374eb21b15 100644
--- a/src/x509.c
+++ b/src/x509.c
@@ -290,12 +290,12 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
}
CHECK_MEM (san);
- if (strnlen (san, MAXHOSTNAMELEN + 5) > MAXHOSTNAMELEN + 4)
+ if (strnlen (san, MAX_FQDN_LEN + 5) > MAX_FQDN_LEN + 4)
{
fprintf (stderr,
- "Hostnames may not exceed %d characters in Subject "
+ "FQDNs may not exceed %d characters in Subject "
"Alternative Names\n",
- MAXHOSTNAMELEN);
+ MAX_FQDN_LEN);
ret = EINVAL;
goto done;
}
--
2.49.0

119
0001-Restore-defaulting-to-dhparams.pem-creation.patch Normal file
View File

@ -0,0 +1,119 @@
From 771a7663bccbd360f017c4c22358a46abcdfa93f Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Mon, 27 Oct 2025 14:58:11 -0400
Subject: [PATCH] Restore defaulting to dhparams.pem creation
This was disabled upstream, but for backwards-compatibility in the RHEL
9 and RHEL 10 lifecycle, we'll continue to do so there.
This reverts commit 0e5e011acc2dc19f3c2fcb5699cf8fa662a2b135.
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
src/arguments.c | 4 ++--
src/sscg.c | 39 +++++++++++++++++++++++++---------
test/test_dhparams_creation.sh | 6 +-----
3 files changed, 32 insertions(+), 17 deletions(-)
diff --git a/src/arguments.c b/src/arguments.c
index 38c8740c1f159368d6fc92d51ba48d83700c3320..4ff75fdf86728592e7ca05db4cf4ac88bf79ca2e 100644
--- a/src/arguments.c
+++ b/src/arguments.c
@@ -682,7 +682,7 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx,
&options->dhparams_file,
0,
_("A file to contain a set of Diffie-Hellman parameters. "
- "(Default: not created)"),
+ "(Default: \"./dhparams.pem\")"),
NULL
},
@@ -692,7 +692,7 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx,
POPT_ARG_NONE | POPT_ARGFLAG_DOC_HIDDEN,
&options->skip_dhparams,
0,
- _ ("Deprecated: Retained for backwards compatibility. To be removed in SSCG 5.0."),
+ _ ("Do not create the dhparams file"),
NULL
},
diff --git a/src/sscg.c b/src/sscg.c
index b9b191f109300f6447262858f57a3a8321a14966..d2dce334cff1342d975e9867a2c82a222d76925e 100644
--- a/src/sscg.c
+++ b/src/sscg.c
@@ -166,19 +166,38 @@ main (int argc, const char **argv)
options->crl_mode);
CHECK_OK (ret);
- if (options->dhparams_file)
+ if (!options->skip_dhparams)
{
- dhparams_file = talloc_strdup (main_ctx, options->dhparams_file);
- CHECK_MEM (dhparams_file);
+ if (options->dhparams_file)
+ {
+ dhparams_file = talloc_strdup (main_ctx, options->dhparams_file);
+ CHECK_MEM (dhparams_file);
- ret = sscg_io_utils_add_output_file (options->streams,
- SSCG_FILE_TYPE_DHPARAMS,
- dhparams_file,
- options->overwrite,
- options->dhparams_mode);
- CHECK_OK (ret);
+ ret = sscg_io_utils_add_output_file (options->streams,
+ SSCG_FILE_TYPE_DHPARAMS,
+ dhparams_file,
+ options->overwrite,
+ options->dhparams_mode);
+ CHECK_OK (ret);
+ }
+ else
+ {
+ dhparams_file = talloc_strdup (main_ctx, "./dhparams.pem");
+ CHECK_MEM (dhparams_file);
+
+ ret = sscg_io_utils_add_output_file (options->streams,
+ SSCG_FILE_TYPE_DHPARAMS,
+ dhparams_file,
+ options->overwrite,
+ options->dhparams_mode);
+ SSCG_LOG (SSCG_VERBOSE,
+ "Could not open dhparams file %s: %s\n",
+ dhparams_file,
+ strerror (ret));
+ /* This is non-fatal if the file path was not explicitly passed */
+ ret = EOK;
+ }
}
-
/* Validate and open the file paths */
ret = sscg_io_utils_open_BIOs (options->streams);
CHECK_OK (ret);
diff --git a/test/test_dhparams_creation.sh b/test/test_dhparams_creation.sh
index d0b4cbb71f3cd1656f1422524c4da7b30fbf3e0a..49f2b08d23246c90663eb7d2e5078817eb42139b 100755
--- a/test/test_dhparams_creation.sh
+++ b/test/test_dhparams_creation.sh
@@ -42,10 +42,6 @@
# just warn and ignore it if it was not (returning 0). However, if it is
# explicitly requested on the command-line and cannot be written to that
# location, it should fail with an error code.
-#
-# Updated 2025-10-21: SSCG 4.0 no longer creates the dhparams file by default.
-# It should not attempt to create it unless explicitly requested using the
-# --dhparams-file option.
set -e
@@ -181,7 +177,7 @@ run_test \
"" \
0 \
"$WRITABLE_DIR/dhparams.pem" \
- "false" \
+ "true" \
"$WRITABLE_DIR"
# Test 2: No --dhparams-file, readonly directory, no existing file
--
2.52.0

38
0002-Avoid-segfault-on-receiving-bad-CLI-arguments.patch Normal file
View File

@ -0,0 +1,38 @@
From f40d0070641543a140428d70211d53d36fd2c34b Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Tue, 2 Dec 2025 12:12:26 -0500
Subject: [PATCH 2/3] Avoid segfault on receiving bad CLI arguments
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
src/sscg.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/sscg.c b/src/sscg.c
index d2dce334cff1342d975e9867a2c82a222d76925e..070d567bb189d42a20fd0a80f8fe2f7caae4d9eb 100644
--- a/src/sscg.c
+++ b/src/sscg.c
@@ -59,7 +59,7 @@ int
main (int argc, const char **argv)
{
int ret, sret;
- struct sscg_options *options;
+ struct sscg_options *options = NULL;
bool build_client_cert = false;
char *dhparams_file = NULL;
@@ -361,7 +361,10 @@ main (int argc, const char **argv)
done:
if (ret != EOK)
{
- sscg_io_utils_delete_output_files (options->streams);
+ if (options)
+ {
+ sscg_io_utils_delete_output_files (options->streams);
+ }
}
talloc_zfree (main_ctx);
if (getenv ("SSCG_TALLOC_REPORT"))
--
2.52.0

109
0002-Update-README.md-with-latest-usage-information.patch
View File

@ -1,109 +0,0 @@
From 14df7d212d020f247587e2d850ec27dbd16add38 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Fri, 1 Sep 2023 08:19:01 -0400
Subject: [PATCH 2/3] Update README.md with latest usage information
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
README.md | 55 +++++++++++++++++++++++++------------------------------
1 file changed, 25 insertions(+), 30 deletions(-)
diff --git a/README.md b/README.md
index d15c3d955d03026e8a68c04870a5f97a20eb03d9..4d57138895443f228212a6c77209350432eecbd7 100644
--- a/README.md
+++ b/README.md
@@ -26,8 +26,8 @@ Usage of sscg:
Usage: sscg [OPTION...]
-q, --quiet Display no output unless there is an error.
-v, --verbose Display progress messages.
- -d, --debug Enable logging of debug messages. Implies verbose. Warning! This will print
- private key information to the screen!
+ -d, --debug Enable logging of debug messages. Implies verbose. Warning! This will print private key information to the
+ screen!
-V, --version Display the version number and exit.
-f, --force Overwrite any pre-existing files in the requested locations
--lifetime=1-3650 Certificate lifetime (days). (default: 398)
@@ -37,57 +37,52 @@ Usage: sscg [OPTION...]
--organization=My Company Certificate DN: Organization (O). (default: "Unspecified")
--organizational-unit=Engineering, etc. Certificate DN: Organizational Unit (OU).
--email=myname@example.com Certificate DN: Email Address (Email).
- --hostname=server.example.com The valid hostname of the certificate. Must be an FQDN. (default: current system
- FQDN)
- --subject-alt-name alt.example.com Optional additional valid hostnames for the certificate. In addition to hostnames,
- this option also accepts explicit values supported by RFC 5280 such as
- IP:xxx.xxx.xxx.xxx/yyy.yyy.yyy.yyy May be specified multiple times.
+ --hostname=server.example.com The valid hostname of the certificate. Must be an FQDN. (default: current system FQDN)
+ --subject-alt-name alt.example.com Optional additional valid hostnames for the certificate. In addition to hostnames, this option also accepts
+ explicit values supported by RFC 5280 such as IP:xxx.xxx.xxx.xxx/yyy.yyy.yyy.yyy May be specified multiple
+ times.
--package=STRING Unused. Retained for compatibility with earlier versions of sscg.
--key-strength=2048 or larger Strength of the certificate private keys in bits. (default: 2048)
--hash-alg={sha256,sha384,sha512} Hashing algorithm to use for signing. (default: "sha256")
--cipher-alg={des-ede3-cbc,aes-256-cbc} Cipher to use for encrypting key files. (default: "aes-256-cbc")
--ca-file=STRING Path where the public CA certificate will be stored. (default: "./ca.crt")
--ca-mode=0644 File mode of the created CA certificate.
- --ca-key-file=STRING Path where the CA's private key will be stored. If unspecified, the key will be
- destroyed rather than written to the disk.
+ --ca-key-file=STRING Path where the CA's private key will be stored. If unspecified, the key will be destroyed rather than written
+ to the disk.
--ca-key-mode=0600 File mode of the created CA key.
- --ca-key-password=STRING Provide a password for the CA key file. Note that this will be visible in the
- process table for all users, so it should be used for testing purposes only. Use
- --ca-keypassfile or --ca-key-password-prompt for secure password entry.
+ --ca-key-password=STRING Provide a password for the CA key file. Note that this will be visible in the process table for all users, so
+ it should be used for testing purposes only. Use --ca-keypassfile or --ca-key-password-prompt for secure
+ password entry.
--ca-key-passfile=STRING A file containing the password to encrypt the CA key file.
-C, --ca-key-password-prompt Prompt to enter a password for the CA key file.
- --crl-file=STRING Path where an (empty) Certificate Revocation List file will be created, for
- applications that expect such a file to exist. If unspecified, no such file will
- be created.
+ --crl-file=STRING Path where an (empty) Certificate Revocation List file will be created, for applications that expect such a
+ file to exist. If unspecified, no such file will be created.
--crl-mode=0644 File mode of the created Certificate Revocation List.
--cert-file=STRING Path where the public service certificate will be stored. (default "./service.pem")
--cert-mode=0644 File mode of the created certificate.
--cert-key-file=STRING Path where the service's private key will be stored. (default "service-key.pem")
--cert-key-mode=0600 File mode of the created certificate key.
- -p, --cert-key-password=STRING Provide a password for the service key file. Note that this will be visible in the
- process table for all users, so this flag should be used for testing purposes
- only. Use --cert-keypassfile or --cert-key-password-prompt for secure password
- entry.
+ -p, --cert-key-password=STRING Provide a password for the service key file. Note that this will be visible in the process table for all users,
+ so this flag should be used for testing purposes only. Use --cert-keypassfile or --cert-key-password-prompt for
+ secure password entry.
--cert-key-passfile=STRING A file containing the password to encrypt the service key file.
-P, --cert-key-password-prompt Prompt to enter a password for the service key file.
--client-file=STRING Path where a client authentication certificate will be stored.
--client-mode=0644 File mode of the created certificate.
--client-key-file=STRING Path where the client's private key will be stored. (default is the client-file)
--client-key-mode=0600 File mode of the created certificate key.
- --client-key-password=STRING Provide a password for the client key file. Note that this will be visible in the
- process table for all users, so this flag should be used for testing purposes
- only. Use --client-keypassfile or --client-key-password-prompt for secure password
- entry.
+ --client-key-password=STRING Provide a password for the client key file. Note that this will be visible in the process table for all users,
+ so this flag should be used for testing purposes only. Use --client-keypassfile or --client-key-password-prompt
+ for secure password entry.
--client-key-passfile=STRING A file containing the password to encrypt the client key file.
--client-key-password-prompt Prompt to enter a password for the client key file.
--dhparams-file=STRING A file to contain a set of Diffie-Hellman parameters. (Default: "./dhparams.pem")
- --dhparams-named-group=STRING Output well-known DH parameters. The available named groups are: ffdhe2048,
- ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, modp_2048, modp_3072, modp_4096,
- modp_6144, modp_8192, modp_1536, dh_1024_160, dh_2048_224, dh_2048_256. (Default:
- "ffdhe4096")
- --dhparams-prime-len=INT The length of the prime number to generate for dhparams, in bits. If set to
- non-zero, the parameters will be generated rather than using a well-known group.
- (default: 0)
+ --no-dhparams-file Do not create the dhparams file
+ --dhparams-named-group=STRING Output well-known DH parameters. The available named groups are: ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144,
+ ffdhe8192, modp_2048, modp_3072, modp_4096, modp_6144, modp_8192, modp_1536, dh_1024_160, dh_2048_224,
+ dh_2048_256. (Default: "ffdhe4096")
+ --dhparams-prime-len=INT The length of the prime number to generate for dhparams, in bits. If set to non-zero, the parameters will be
+ generated rather than using a well-known group. (default: 0)
--dhparams-generator={2,3,5} The generator value for dhparams. (default: 2)
Help options:
--
2.49.0

29
0003-Restore-error-message.patch Normal file
View File

@ -0,0 +1,29 @@
From 08dacb632cc331027f39dcfa0b782aeb6f2f893a Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Tue, 2 Dec 2025 12:19:04 -0500
Subject: [PATCH 3/3] Restore error message
This was dropped in 4.0, but should be retained in RHEL 9 and 10 for
compatibility, particularly with existing tests that look for specific
messages.
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
src/sscg.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/sscg.c b/src/sscg.c
index 070d567bb189d42a20fd0a80f8fe2f7caae4d9eb..9f46cd622a4d55bd634a370ccc81ff063422b5af 100644
--- a/src/sscg.c
+++ b/src/sscg.c
@@ -361,6 +361,7 @@ main (int argc, const char **argv)
done:
if (ret != EOK)
{
+ SSCG_ERROR ("%s\n", strerror (ret));
if (options)
{
sscg_io_utils_delete_output_files (options->streams);
--
2.52.0

31
0003-x509-Use-proper-version-for-CSR.patch
View File

@ -1,31 +0,0 @@
From 70b0a4742a67616a5223a0cdc2067effccf081e9 Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Sat, 19 Oct 2024 15:43:20 +0200
Subject: [PATCH 3/3] x509: Use proper version for CSR.
RFC 2986 only defines a single version for CSRs: X509_VERSION_1 (0).
OpenSSL starting with 3.4 rejects everything else.
Use X509_VERSION_1 as version for X509_REQ_set_version.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
---
src/x509.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/x509.c b/src/x509.c
index 9f6f21b49c2dd70629fed67d327027374eb21b15..503b7b1b51ed45909104d1b5e593129ee9e8dee2 100644
--- a/src/x509.c
+++ b/src/x509.c
@@ -169,7 +169,7 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
talloc_set_destructor ((TALLOC_CTX *)csr, _sscg_csr_destructor);
/* We will generate only x509v3 certificates */
- sslret = X509_REQ_set_version (csr->x509_req, 2);
+ sslret = X509_REQ_set_version (csr->x509_req, X509_VERSION_1);
CHECK_SSL (sslret, X509_REQ_set_version);
subject = X509_REQ_get_subject_name (csr->x509_req);
--
2.49.0

43
0004-Ensure-critical-basicConstraint-for-CA-cert.patch
View File

@ -1,43 +0,0 @@
From 276698d206e9bad55d628eb2db8a71ba469a2eaf Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Tue, 22 Apr 2025 13:09:32 -0400
Subject: [PATCH 4/4] Ensure 'critical' basicConstraint for CA cert
Fixes: https://github.com/sgallagher/sscg/issues/74
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
src/authority.c | 3 ++-
test/test_cert_validity.sh | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/authority.c b/src/authority.c
index f509fd4316c3b7b230f99de6464491c319fc5d45..68000c5e695460abd65c9641b44c187f4aa617e3 100644
--- a/src/authority.c
+++ b/src/authority.c
@@ -123,7 +123,8 @@ create_private_CA (TALLOC_CTX *mem_ctx,
sk_X509_EXTENSION_push (ca_certinfo->extensions, ex);
/* Mark it as a CA */
- ex = X509V3_EXT_conf_nid (NULL, NULL, NID_basic_constraints, "CA:TRUE");
+ ex = X509V3_EXT_conf_nid (
+ NULL, NULL, NID_basic_constraints, "critical,CA:TRUE");
CHECK_MEM (ex);
sk_X509_EXTENSION_push (ca_certinfo->extensions, ex);
diff --git a/test/test_cert_validity.sh b/test/test_cert_validity.sh
index 1e4df5ce57a45981878cec017f710b9699b77c6a..e20e02a384156a1a481e2560308f10a82258986e 100755
--- a/test/test_cert_validity.sh
+++ b/test/test_cert_validity.sh
@@ -204,7 +204,7 @@ key_strength=$(openssl pkey -text -noout -in service-key.pem -passin pass:mypass
test "$key_strength" -eq "$_arg_key_strength"
# Validate the certificates
-openssl verify -CAfile ca.crt service.pem
+openssl verify -x509_strict -CAfile ca.crt service.pem
popd # $TMPDIR
--
2.49.0

1204
0005-Fix-IP-address-handling-in-CA-certificate-SAN-constr.patch
View File

File diff suppressed because it is too large Load Diff

2
sources
View File

@ -1 +1 @@
SHA512 (sscg-3.0.5.tar.gz) = da4db537096608683726084ea342cf3e06ec25da16c4475a29e83a466486a4ace8b58253520034eb263d8cefde14e21f3fe69d23fa75686cab5e3a7f8e170442
SHA512 (sscg-4.0.3.tar.gz) = f629cf7e32d4d4e7c1f58c4a53be925b96980e6fb3106e3a36a72f85c723bd79fba6aecdbf092b50f915a8833297bc7c6c1ccbe04fef488db38bbdc1e3a95b96

65
sscg.spec
View File

@ -1,8 +1,8 @@
## START: Set by rpmautospec
## (rpmautospec version 0.6.5)
## (rpmautospec version 0.8.3)
## RPMAUTOSPEC: autorelease, autochangelog
%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
release_number = 12;
release_number = 2;
base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
print(release_number + base_release_number - 1);
}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@ -19,36 +19,34 @@
%{!?meson_test: %global meson_test %{__meson} test -C %{_vpath_builddir} --num-processes %{_smp_build_ncpus} --print-errorlogs}
Name: sscg
Version: 3.0.5
Version: 4.0.3
Release: %autorelease
Summary: Simple SSL certificate generator
Summary: Simple Signed Certificate Generator
License: GPL-3.0-or-later WITH cryptsetup-OpenSSL-exception
URL: https://%{provider_prefix}
Source0: sscg-3.0.5.tar.gz
# Extend maximum DNS name to 255
# Author: Stephen Gallagher <sgallagh@redhat.com>
Patch: 0001-Extend-maximum-DNS-name-to-255.patch
# Update the README documentation
Patch: 0002-Update-README.md-with-latest-usage-information.patch
# Set Certificate Signing Request version to 1 instead of 3(which doesn't exist)
Patch: 0003-x509-Use-proper-version-for-CSR.patch
# Ensure 'critical' basicConstraint for CA cert
Patch: 0004-Ensure-critical-basicConstraint-for-CA-cert.patch
# Handle IP addresses with and without CIDR netmasks in subject alt names
Patch: 0005-Fix-IP-address-handling-in-CA-certificate-SAN-constr.patch
Source0: %{URL}/archive/refs/tags/sscg-%{version}.tar.gz
BuildRequires: gcc
BuildRequires: libtalloc-devel
BuildRequires: openssl
BuildRequires: openssl-devel
BuildRequires: popt-devel
BuildRequires: libpath_utils-devel
BuildRequires: meson
BuildRequires: ninja-build
BuildRequires: help2man
# For backwards-compatibility in RHEL, revert the 4.0 patch that disables
# dhparam file generation by default.
Patch: 0001-Restore-defaulting-to-dhparams.pem-creation.patch
# Upstream patch to avoid segfault when receiving bad CLI arguments
Patch: 0002-Avoid-segfault-on-receiving-bad-CLI-arguments.patch
# Downstream patch to restore error message at the end of execution that is
# checked by certain tests
Patch: 0003-Restore-error-message.patch
%description
A utility to aid in the creation of more secure "self-signed"
certificates. The certificates created by this tool are generated in a
@ -58,7 +56,7 @@ up a full PKI environment and without exposing the machine to a risk of
false signatures from the service certificate.
%prep
%autosetup -p1 -n sscg-3.0.5
%autosetup -p1 -n sscg-sscg-%{version}
%build
@ -79,6 +77,35 @@ false signatures from the service certificate.
%changelog
## START: Generated by rpmautospec
* Tue Dec 02 2025 Stephen Gallagher <sgallagh@redhat.com> - 4.0.3-2
- Fix issues discovered by OSCI tests
* Tue Dec 02 2025 Stephen Gallagher <sgallagh@redhat.com> - 4.0.3-1
- Update to SSCG 4.0.3
* Tue Dec 02 2025 Stephen Gallagher <sgallagh@redhat.com> - 4.0.1-1
- Update to SSCG 4.0.1
* Mon Oct 27 2025 Stephen Gallagher <sgallagh@redhat.com> - 4.0.0-2
- Restore creation of dhparams file by default
* Mon Oct 27 2025 Stephen Gallagher <sgallagh@redhat.com> - 4.0.0-1
- Release SSCG 4.0.0
- Support for ML-DSA keys for post-quantum cryptography (PQC) when built
against OpenSSL 3.5 or later
- Support for EC-DSA keys for elliptic curves
- RSA certificate authority is now created with a minimum key strength of
4096 bits
- Improved --help output
- Deprecated support for generating custom DH parameters
- Stopped producing the DH parameter file by default (it may be requested
explicitly with the --dhparams-file argument)
- Minimum OpenSSL version is now 3.0
- Drop upstreamed patches
* Wed Aug 13 2025 Zdenek Dohnal <zdohnal@redhat.com> - 3.0.5-13
- Migrate FMF tests into metadata format used in rhel-stacks
* Mon Aug 11 2025 Stephen Gallagher <sgallagh@redhat.com> - 3.0.5-12
- Fix IP address handling in CA certificate SAN constraints
- Add automatic single-IP subnet mask to IP addresses in CA name