denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cert-enroll: certificate checking and enrollment

Browse Source 
The cert-enroll script handles the initial enrollment of an X.509
host certificate with a PKI server via the EST or SCEP protocols.

Run as a systemd timer or via a crontab entry the script daily
checks the expiration date of the host certificate. When a given
deadline is reached, the host certificate is automatically renewed
via EST or SCEP re-enrollment based on the possession of the old
private key and the matching certificate.
This commit is contained in:
Andreas Steffen
2023-10-03 08:45:22 +02:00
parent 80e27fe9fd
commit cbfc12b330
16 changed files with 1142 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configure.ac
+13 -1
View File
@@ -307,6 +307,7 @@ ARG_ENABL_SET([svc], [enable charon Windows service.])
ARG_ENABL_SET([systemd], [enable systemd specific IKE daemon charon-systemd.])
ARG_DISBL_SET([swanctl], [disable swanctl configuration and control tool.])
ARG_ENABL_SET([tkm], [enable Trusted Key Manager support.])
ARG_ENABL_SET([cert-enroll], [enable automatic certificate enrollment via EST or SCEP.])
# optional features
ARG_ENABL_SET([bfd-backtraces], [use binutils libbfd to resolve backtraces for memory leaks and segfaults.])
ARG_ENABL_SET([dbghelp-backtraces],[use dbghlp.dll on Windows to create and print backtraces for memory leaks and segfaults.])
@@ -325,6 +326,7 @@ ARG_ENABL_SET([perl-cpan-install],[enable installation of provided CPAN module.]
ARG_ENABL_SET([selinux], [enable SELinux support for labeled IPsec.])
ARG_ENABL_SET([tss-trousers], [enable the use of the TrouSerS Trusted Software Stack])
ARG_ENABL_SET([tss-tss2], [enable the use of the TSS 2.0 Trusted Software Stack])
ARG_ENABL_SET([cert-enroll-timer],[enable installation of cert-enroll as a systemd timer.])
# compile options
ARG_ENABL_SET([asan], [enable build with AddressSanitizer (ASan).])
@@ -516,6 +518,10 @@ if test x$stroke = xtrue; then
counters=true
fi
if test x$cert_enroll = xtrue; then
pki=true
fi
if test x$kdf = xfalse; then
if test x$aesni = xtrue -o x$cmac = xtrue -o x$xcbc = xtrue; then
AC_MSG_WARN(m4_normalize([
@@ -1030,14 +1036,16 @@ if test x$xml = xtrue; then
AC_SUBST(xml_LIBS)
fi
if test x$systemd = xtrue; then
if test x$systemd = xtrue -o x$cert_enroll_timer = xtrue; then
AC_MSG_CHECKING([for systemd system unit directory])
if test -n "$systemdsystemunitdir" -a "x$systemdsystemunitdir" != xno; then
AC_MSG_RESULT([$systemdsystemunitdir])
else
AC_MSG_ERROR([not found (try --with-systemdsystemunitdir)])
fi
fi
if test x$systemd = xtrue; then
PKG_CHECK_MODULES(systemd, [libsystemd >= 209],
[AC_SUBST(systemd_CFLAGS)
AC_SUBST(systemd_LIBS)],
@@ -1893,6 +1901,8 @@ AM_CONDITIONAL(USE_SWANCTL, test x$swanctl = xtrue)
AM_CONDITIONAL(USE_SVC, test x$svc = xtrue)
AM_CONDITIONAL(USE_SYSTEMD, test x$systemd = xtrue)
AM_CONDITIONAL(USE_LEGACY_SYSTEMD, test -n "$systemdsystemunitdir" -a "x$systemdsystemunitdir" != xno)
AM_CONDITIONAL(USE_CERT_ENROLL, test x$cert_enroll = xtrue)
AM_CONDITIONAL(USE_CERT_ENROLL_TIMER, test x$cert_enroll_timer = xtrue)
AM_CONDITIONAL(USE_RUBY_GEMS, test x$ruby_gems = xtrue)
AM_CONDITIONAL(USE_PYTHON_EGGS, test x$python_eggs = xtrue)
AM_CONDITIONAL(USE_PERL_CPAN, test x$perl_cpan = xtrue)
@@ -2167,6 +2177,7 @@ AC_CONFIG_FILES([
src/sw-collector/Makefile
src/sec-updater/Makefile
src/swanctl/Makefile
src/cert-enroll/Makefile
src/xfrmi/Makefile
scripts/Makefile
testing/Makefile
@@ -2206,6 +2217,7 @@ AC_CONFIG_FILES([
src/pt-tls-client/pt-tls-client.1
src/sw-collector/sw-collector.8
src/sec-updater/sec-updater.8
src/cert-enroll/cert-enroll.8
])
AC_OUTPUT