Andreas Steffen
24a9c32a43
testing: Include ML-KEM crypto tests rw-cert scenario
2024-12-06 14:39:20 +01:00
Andreas Steffen
cf9b174dfe
Remove two files to be ignored
2024-12-02 23:13:10 +01:00
Andreas Steffen
c86f709b4b
Version bump to 6.0.0
2024-12-02 14:21:53 +01:00
Andreas Steffen
4de6bb3feb
Version bump to 6.0.0rc2
2024-11-26 08:21:20 +01:00
Andreas Steffen
f59ca9698a
cert-enroll: Support three generations of CA certificates
...
If the lifetime of an issuing or sub CA is twice the lifetime of
the end entity certificates issued by it and the renewal cycle of
the issuing CAs is a little shorter than the validity of the end
entity certificates then three generations of CA certificates have
to be handled by the cert-enroll scripts.
2024-11-26 08:15:09 +01:00
Andreas Steffen
af28aac85f
Version bump to 6.0.0rc1
2024-11-25 11:11:17 +01:00
Andreas Steffen
2c18e87b25
testing: Added ML-KEM test cases
2024-11-23 16:53:02 +01:00
Andreas Steffen
def312d200
testing: Fixed typos
2024-11-23 15:06:37 +01:00
Andreas Steffen
a5e80cf5e4
libcharon: Enable make_before_break option by default
2024-11-22 14:18:39 +01:00
Andreas Steffen
6735c3d7ca
Define new default plugins
2024-11-22 14:14:53 +01:00
Andreas Steffen
558529afe2
testing: Migrated wolfssl scenarios
2024-11-22 14:14:53 +01:00
Andreas Steffen
2e4c062512
testing: Migrated tnc scenarios to new default plugins
2024-11-22 14:14:53 +01:00
Andreas Steffen
11bb0a73b8
testing: Migrated tkm scenarios to new default plugins
2024-11-22 14:14:53 +01:00
Andreas Steffen
89acb24bd7
testing: Migrated sql scenarios to new default plugins
2024-11-22 14:14:53 +01:00
Andreas Steffen
b891da52b4
testing: Migrated route-based scenarios to new default plugins
2024-11-22 14:14:53 +01:00
Andreas Steffen
8fc6340c05
testing: Migrated pfkey scenarios to new default plugins
2024-11-22 14:14:53 +01:00
Andreas Steffen
93b6162d74
testing: Migrated p2pnat scenarios to new default plugins
2024-11-22 14:14:53 +01:00
Andreas Steffen
bd93dfb09b
testing: Migrated libipsec scenarios to new default plugins
2024-11-22 14:14:53 +01:00
Andreas Steffen
0cf08b45dd
testing: Migrated ha scenarios to new default plugins
2024-11-22 14:14:53 +01:00
Andreas Steffen
dc69cf2f65
testing: Migrated gcrypt-ikev2 scenarios
2024-11-22 14:14:53 +01:00
Andreas Steffen
b9e5764b75
testing: Migrated botan scenarios
2024-11-22 14:14:53 +01:00
Andreas Steffen
17e0f20f57
testing: Migrated af-alg scenarios
2024-11-22 14:14:53 +01:00
Andreas Steffen
fdc9e69523
testing: Migrated ike scenarios to new default plugins
2024-11-22 14:14:53 +01:00
Andreas Steffen
6ae40ac581
testing: Migrated ikev1-stroke to new default plugins
2024-11-22 14:14:53 +01:00
Andreas Steffen
950d4fe7a0
testing: Migrated ikev2-stroke scenarios to new default plugins
2024-11-22 14:14:53 +01:00
Andreas Steffen
2dbcb15338
testing: Migrated ipv6-stroke scenarios to new default plugins
2024-11-22 14:14:53 +01:00
Andreas Steffen
38bacea63b
testing: Migrated ipv6 scenarios to new default plugins
2024-11-22 14:14:52 +01:00
Andreas Steffen
e7166c342b
testing: Distributed openssl-ikev1 scenarios
2024-11-22 14:14:52 +01:00
Andreas Steffen
c9883d612b
testing: Migrated ikev1-algs scenarios to new default plugins
2024-11-22 14:14:52 +01:00
Andreas Steffen
8060541f53
testing: Migrated ikev1 scenarios to new default plugins
2024-11-22 14:14:52 +01:00
Andreas Steffen
4df94b56c0
testing: Distributed openssl-ikev2 scenarios
2024-11-22 14:14:52 +01:00
Andreas Steffen
f766a7ed49
testing: Migrated ikev2-algs scenarios to new default plugins
2024-11-22 14:14:52 +01:00
Andreas Steffen
2099a52618
testing: Migrated ikev2 scenarios to new default plugins
2024-11-22 14:14:52 +01:00
Andreas Steffen
3b7c49bc31
mgf1: Support of RSA PSS with SHA3 hash
2024-11-22 14:05:36 +01:00
Andreas Steffen
1265d78cac
ntru: Remove legacy NTRU key exchange method
2024-11-22 14:05:36 +01:00
Andreas Steffen
8e3a373e18
newhope: Remove legacy Newhope key exchange method
2024-11-22 14:05:36 +01:00
Andreas Steffen
4833f29b15
bliss: Remove legacy BLISS signatures
2024-11-22 14:05:36 +01:00
Andreas Steffen
ee19c3e7dd
scripts: Add script formatting NIST KEM KAT records into ke_test vectors
2024-11-22 14:03:16 +01:00
Andreas Steffen
40676786aa
key-exchange: Joint ke_test_vector format for DH and KEM
...
Both Diffie-Hellman (DH) and Key Encapsulation Mechanism (KEM) based
key exchange methods use a common ke_test_vector format. The
set_seed() function is used to provide deterministic private key
material for the crypto tests.
2024-11-21 14:26:35 +01:00
Andreas Steffen
0be6fd7735
certificate_printer: Fix spacing for additional CRL/OCSP URIs
...
Multiple occurences of CRL and OCSP URIs where not indented correctly.
2024-10-18 15:45:07 +02:00
Andreas Steffen
957aae8f64
cert-enroll: Fixed typo
...
This typo prevented the cert-enroll script from successfully
signalling a detected change of the sub CA certificate.
2024-09-07 17:17:07 +02:00
Andreas Steffen
d4fb07911f
vici: Increase maximum proposal length
2024-08-07 16:20:18 +02:00
Andreas Steffen and Tobias Brunner
355f917532
vici: List additional key exchanges
...
Co-authored-by: Tobias Brunner <[email protected]
2024-08-07 16:20:18 +02:00
Andreas Steffen
dea8493f3a
Version bump to 5.9.14
2024-03-19 11:56:44 +01:00
Andreas Steffen
91f209b878
Version bump to 5.9.14rc1
2024-03-13 20:24:54 +01:00
Andreas Steffen
6f8275abab
testing: Added RFC4806 tests
2024-03-13 15:11:00 +01:00
Andreas Steffen
06afb5f109
cert-enroll: add init.d support to cert-install-sssd
2024-03-03 17:12:48 +01:00
Andreas Steffen
f566a85fcf
Version bump to 5.9.14dr1
2024-02-22 15:51:24 +01:00
Andreas Steffen
ad08ced8b2
pki: Added key and cert handles to --ocsp command
2024-02-21 12:22:33 +01:00
Andreas Steffen
49769fff53
pkcs11: Support RSA-PSS signatures
2024-02-21 11:22:33 +01:00
Andreas Steffen
f739657aac
pkcs11: Updated pkcs11.h header file based on OpenSC
2024-02-21 11:22:33 +01:00
Andreas Steffen
c8ef91c786
Version bump to 5.9.13
2023-12-01 07:26:22 +01:00
Andreas Steffen
04794e703d
Version bump to 5.9.13rc1
2023-11-25 17:16:59 +01:00
Andreas Steffen
da45cf9f38
cert-enroll: Set the environment variables needed by cert-install-ssl
2023-11-23 19:05:22 +01:00
Andreas Steffen
11dbc8e7f2
Version bumpt to 5.9.12
2023-11-20 12:10:34 +01:00
Andreas Steffen
02a4c8cfa9
Version bump to 5.9.12rc1
2023-11-14 08:12:00 +01:00
Andreas Steffen
6941dcb17a
x509: Fix regression introduced by commit a22147a
...
Instead of the CA certificate's subjectKeyIdentifier erroneously
the CA's authorityKeyIdentifier was used as the authorityKeyIdentfier
of the certificate to be issued. This might work with a root CA
where the authorityKeyIdentifier equals its subjectKeyIdentfier
but introduces a severe regression when an intermediate CA is used.
2023-11-14 08:00:27 +01:00
Andreas Steffen
821d7784a3
man: Extended pki man page and added pki --ocsp man page
2023-11-13 12:40:58 +01:00
Andreas Steffen
a0c9f9b842
pki: Added ocsp command
...
The pki --ocsp command implements an OCSP responder.
2023-11-13 12:40:58 +01:00
Andreas Steffen
ec325b4c09
pki: Added ocsp-req and ocsp-rsp types to pki --print
2023-11-13 12:40:58 +01:00
Andreas Steffen
a0f672d3d1
unit-tests: Update test_serial_gen suite
2023-11-13 12:40:55 +01:00
Andreas Steffen
00ab8d62c0
x509: Support generation of OCSP responses
2023-11-13 12:40:55 +01:00
Andreas Steffen
aa0fe149d6
certificates: Added ocsp_single_response object
2023-11-13 12:40:55 +01:00
Andreas Steffen
199c7083e1
openxpki: OCSP responder plugin accessing OpenXPKI
...
The openxpki plugin directly access the certificates table in
the OpenXPKI's MariaDB in order to retrieve the status of an
issued X.509 certificate based on its serial number.
2023-11-13 12:40:55 +01:00
Andreas Steffen
24d45de633
crl-reason: Fixed typo
2023-11-13 12:40:52 +01:00
Andreas Steffen
d72d0c0dfa
utils: Added chunk_to_dec() function
2023-11-13 12:39:10 +01:00
Andreas Steffen
9381559754
x509: Support parsing of OCSP requests
2023-11-13 12:39:10 +01:00
Andreas Steffen
09e2a9ff50
pki --pkcs7: Set default to res = 1
2023-11-13 12:39:10 +01:00
Andreas Steffen
28ccdff692
cert-enroll: Preventing some errors that might occur
2023-11-13 11:57:51 +01:00
Andreas Steffen
f328ef0e04
cert-enroll: Install TLS client/server credentials
...
Install the generated key, host certificate and associated CA certificates
as credentials for a TLS-protected client-server connection.
2023-11-13 11:57:51 +01:00
Andreas Steffen
51872a0a0c
Version bump to 5.9.12dr2
2023-10-30 22:42:55 +01:00
Andreas Steffen
d6bfdf2b2b
cert-enroll: Pack all source files into EXTRA_DIST
2023-10-26 15:15:37 +02:00
Andreas Steffen
6f0cd19fd6
cert-enroll: Fixed path in cert-install-openxpki
2023-10-12 08:14:38 +02:00
Andreas Steffen
7dfb88ead2
Version bump to 5.9.12dr2
2023-10-04 08:15:54 +02:00
Andreas Steffen
cbfc12b330
cert-enroll: certificate checking and enrollment
...
The cert-enroll script handles the initial enrollment of an X.509
host certificate with a PKI server via the EST or SCEP protocols.
Run as a systemd timer or via a crontab entry the script daily
checks the expiration date of the host certificate. When a given
deadline is reached, the host certificate is automatically renewed
via EST or SCEP re-enrollment based on the possession of the old
private key and the matching certificate.
2023-10-03 08:45:22 +02:00
Andreas Steffen
4e1dc0a224
Version bump to 5.9.11
2023-06-12 07:50:02 +02:00
Andreas Steffen
0ba7aefdc9
Version bump to 5.9.11rc1
2023-06-08 10:42:17 +02:00
Andreas Steffen
b420857123
Version bump to 5.9.11dr3
2023-04-21 16:36:23 +02:00
Andreas Steffen
47e8b21c76
cert_cache: Replace cached stale OCSP responses in-place
2023-04-21 16:04:26 +02:00
Andreas Steffen
ef94a5b4ab
Version bump to 5.9.11dr2
2023-04-19 04:24:18 +02:00
Andreas Steffen
67e9cb161d
Version bump to 5.9.11dr1
2023-03-28 16:27:04 +02:00
Andreas Steffen
c0ae81fc83
Version bump to 5.9.10
2023-03-02 09:58:24 +01:00
Andreas Steffen
edd3c797b0
testing: Negotiate TLS 1.3 for part of the EAP-TLS scenarios
2023-03-02 09:02:38 +01:00
Andreas Steffen
350101abad
Version bump to 5.9.10rc1
2023-02-22 20:00:18 +01:00
Andreas Steffen
bf3e4c85d0
Revert "libipsec: Added Windows tun device support"
...
This reverts commit 77b91e6d0e
2023-01-31 15:19:58 +01:00
Andreas Steffen
77b91e6d0e
libipsec: Added Windows tun device support
2023-01-31 14:59:57 +01:00
Andreas Steffen
8effb06d6c
pki: Use X.509v3 EKU extension in CSR
2023-01-11 19:19:09 +01:00
Andreas Steffen
0c7bfec7af
Version bump to 5.9.9
2023-01-01 11:55:50 +01:00
Andreas Steffen
7928deece1
Version bump to 5.9.9rc2
2022-12-23 11:19:06 +01:00
Andreas Steffen
4aa5868d8e
Version bump to 5.9.9rc1
2022-12-22 13:24:34 +01:00
Andreas Steffen
8329455628
testing: Check canonical OCSP/CRL serial numbers
2022-12-05 20:18:24 +01:00
Andreas Steffen
0d88c76abc
unit-tests: Check encoding/retrieval of serial numbers
2022-12-05 20:18:24 +01:00
Andreas Steffen
18082ce2b0
certificates: Retrieve serial numbers in canonical form
...
The x509 plugin retrieves serial numbers with two's complement
encoding whereas the openssl plugin partially returns them without
leading zeroes.
Serial numbers in X.509 certificates, X.509 CRL, X.509 attribute
certificates, OCSP Requests and OCSP responses are now returned in
canonical form without prepended zero octets.
2022-12-05 20:18:24 +01:00
Andreas Steffen
e09bc70d12
Version bump to 5.9.8
2022-10-03 16:16:53 +02:00
Andreas Steffen
6bf60221f5
pkcs7: Support rsa-pss signatures
2022-10-03 09:52:07 +02:00
Andreas Steffen
ef93c7e2ea
Version bump to 5.9.8rc1
2022-09-26 10:34:04 +02:00
Andreas Steffen
8f5ff23d6c
Version bump to 5.9.8dr4
2022-09-20 16:37:44 +02:00
Andreas Steffen
063ef084e4
pki: Base64 encoding of username:password in HTTP basic authentication
2022-09-20 11:07:33 +02:00
Andreas Steffen
a345e635c4
Version bumpt to 5.9.8dr3
2022-09-07 06:38:42 +02:00
Andreas Steffen
747e840912
libstrongswan: Encode RSA-PSS algorithmIdentifier variant
...
Some third party IKEv2 products expect an RSA-PSS ASN.1
algorithmIdentifier with an explicit trailerField value (CONTEXT3)
instead of the DEFAULT value if the trailerField is missing.
The setting charon.rsa_pss_trailerfield = yes enables the explicit
encoding.
2022-09-06 21:15:43 +02:00
Andreas Steffen