x509-cert: add certificate builder #764

baloo · 2022-11-19T06:59:25Z

This is an attempt at a certificate builder.

baloo · 2022-11-19T07:05:20Z

This is very much a work in progress, but sharing early to get feedback. I think I want to attached the extensions to the CertificateVersion::V3.

I don't exactly know how much we want to force in that API. I'm inclined to force the inclusion of:

X509v3 CRL Distribution Points
X509v3 Extended Key Usage
X509v3 Key Usage (make it critical)
X509v3 Basic Constraints (make it critical)
X509v3 Subject Alternative Name (probably needs a builder itself)

I'm not sure about:

Authority Information Access (ocsp uri)
X509v3 Certificate Policies (not sure if that's expected for a private CA).
X509v3 Subject Key Identifier / X509v3 Authority Key Identifier (not sure how they are built)

Pretty convinced I can't force:

CT Precertificate SCTs
the CT infrastructure is unlikely for a private ca.

tarcieri · 2022-11-19T16:43:28Z

@baloo there was a little bit of previous discussion on iqlusioninc/yubikey.rs#348 as linked from #418.

One thing I'd recommend is running the generated certificates through a tool like certlint or zlint (probably zlint these days?). I can help out with automating CI setup for that as need be.

tarcieri · 2022-11-19T17:02:54Z

Also @str4d's x509 crate includes a certificate builder and might provide some inspiration here.

I think if we make a good enough replacement he'll also give us the x509 crate name.

baloo · 2022-11-19T22:11:41Z

I've started a zlint integration, but it's not as easy as I thought (need to parse the output json, I can't just rely on the status code), I also need to remember how to setup github actions and pull a binary. Got the integration for it in nixos already (to run on my machine): NixOS/nixpkgs#201537

What are your thoughts on https://docs.rs/ouroboros/latest/ouroboros/attr.self_referencing.html. Wondering whether I should keep both the UIntRef and it's backing buffer (Vec<u8>) in the builder as to not have the fn build have to "reparse" from buffer.

tarcieri · 2022-11-19T22:41:12Z

I also need to remember how to setup github actions and pull a binary.

There's a binary here:

https://github.com/zmap/zlint/releases/download/v3.4.0/zlint_3.4.0_Linux_x86_64.tar.gz

You can look at this as an example for how to download it in a GitHub Actions workflow:

https://github.com/RustCrypto/actions/blob/master/cargo-hack-install/action.yml

It's fine to just put it in the x509-cert workflow for now.

What are your thoughts on https://docs.rs/ouroboros/latest/ouroboros/attr.self_referencing.html.

I played with trying to integrate ouroboros into der in the past. I don't think it was a good fit.

See #734 where I proposed yoke as an alternative.

Alternatively we could eliminate the lifetimes on the various types and move to entirely owned types. I opened #765 to discuss that.

baloo · 2022-11-20T07:06:37Z

I think I like the yoke a bit better than going to owned types.

tarcieri · 2022-11-20T16:14:35Z

The owned types are actually nice when decoding from PEM, since they avoid an intermediate PEM -> DER pass and allow the DER to be decoded from PEM on-the-fly as needed to parse document.

baloo · 2022-11-21T19:02:15Z

test basic_certificate ... ok

Got the root CA profile to work with zero lint error on zlint.
I guess now I need to get the other profiles working and then clean up that whole mess I made.

baloo · 2022-11-23T05:11:10Z

(minimal-versions error is a regression in nightly: rust-lang/rust#104759)

x509-cert/src/serial_number.rs

brandonweeks · 2023-02-08T02:42:09Z

I don't exactly know how much we want to force in that API. I'm inclined to force the inclusion of:

X509v3 CRL Distribution Points

X509v3 Extended Key Usage

X509v3 Key Usage (make it critical)

X509v3 Basic Constraints (make it critical)

X509v3 Subject Alternative Name (probably needs a builder itself)

It feels like doing so would inhibit the usage of this API for use cases other than Web PKI. Which would be a shame because I suspect Web PKI will be one of the last environments where this crate will be adopted.

Go's crypto/x509 offers one of the best APIs for parsing and generating X.509 certificate for arbitrary use cases. It'd be great if this crate could analogous functionality.

x509-cert/src/ext/pkix/keyusage.rs

baloo · 2023-03-30T21:36:45Z

I don't exactly know how much we want to force in that API. I'm inclined to force the inclusion of:

X509v3 CRL Distribution Points

X509v3 Extended Key Usage

X509v3 Key Usage (make it critical)

X509v3 Basic Constraints (make it critical)

X509v3 Subject Alternative Name (probably needs a builder itself)

It feels like doing so would inhibit the usage of this API for use cases other than Web PKI. Which would be a shame because I suspect Web PKI will be one of the last environments where this crate will be adopted.

Go's crypto/x509 offers one of the best APIs for parsing and generating X.509 certificate for arbitrary use cases. It'd be great if this crate could analogous functionality.

@brandonweeks I implemented an hazmat feature that let you opt out of the default extensions (via Profile::Manual) and that allows you to build your own certificate without webpki extensions.

x509-cert/src/builder.rs

tarcieri · 2023-04-09T22:20:46Z

Finished a readthrough pass. Looking good so far. It's a lot of code!

tarcieri · 2023-04-09T23:05:42Z

x509-cert/test-support/src/zlint.rs

@@ -0,0 +1,195 @@
+use serde::{


FYI, I snagged https://crates.io/crates/zlint

Might be interesting to extract this into a separate crate (after landing this PR perhaps)

…nversions

tarcieri

Going to go ahead and land this

top-level Cargo.toml patches crates.io to point to the in-tree versions of several crates. Revert some of the changes introduced by the commit 98957ae ("x509-cert: add certificate builder (RustCrypto#764)") which gets overriden again by the patch.crates.io config. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>

Added - Certificate builder ([RustCrypto#764]) - Support for `RandomizedSigner` in builder ([RustCrypto#1007]) - Provide parsing profiles ([RustCrypto#987]) - Support for `Time::INFINITY` ([RustCrypto#1024]) - Conversion from `std::net::IpAddr` ([RustCrypto#1035]) - `CertReq` builder ([RustCrypto#1034]) Changed - use `ErrorKind::Value` for overlength serial ([RustCrypto#988]) - Bump `hex-literal` to v0.4.1 ([RustCrypto#999]) - Builder updates ([RustCrypto#1001]) - better debug info when `zlint` isn't installed ([RustCrypto#1018]) - make SKI optional in leaf certificate ([RustCrypto#1028]) - bump rsa from 0.9.0-pre.2 to 0.9.0 ([RustCrypto#1033]) Fixed - fix `KeyUsage` bit tests ([RustCrypto#993]) - extraneous PhantomData in `TbsCertificate` ([RustCrypto#1019])

Added - Certificate builder ([RustCrypto#764]) - Support for `RandomizedSigner` in builder ([RustCrypto#1007]) - Provide parsing profiles ([RustCrypto#987]) - Support for `Time::INFINITY` ([RustCrypto#1024]) - Conversion from `std::net::IpAddr` ([RustCrypto#1035]) - `CertReq` builder ([RustCrypto#1034]) Changed - use `ErrorKind::Value` for overlength serial ([RustCrypto#988]) - Bump `hex-literal` to v0.4.1 ([RustCrypto#999]) - Builder updates ([RustCrypto#1001]) - better debug info when `zlint` isn't installed ([RustCrypto#1018]) - make SKI optional in leaf certificate ([RustCrypto#1028]) - bump rsa from 0.9.0-pre.2 to 0.9.0 ([RustCrypto#1033]) Fixed - fix `KeyUsage` bit tests ([RustCrypto#993]) - extraneous PhantomData in `TbsCertificate` ([RustCrypto#1017])

Added - Certificate builder (RustCrypto#764) - Support for `RandomizedSigner` in builder (RustCrypto#1007) - Provide parsing profiles (RustCrypto#987) - Support for `Time::INFINITY` (RustCrypto#1024) - Conversion from `std::net::IpAddr` (RustCrypto#1035) - `CertReq` builder (RustCrypto#1034) - missing extension implementations (RustCrypto#1050) - notes about `UTCTime` range being 1970-2049 (RustCrypto#1052) Changed - use `ErrorKind::Value` for overlength serial (RustCrypto#988) - Bump `hex-literal` to v0.4.1 (RustCrypto#999) - Builder updates (RustCrypto#1001) - better debug info when `zlint` isn't installed (RustCrypto#1018) - make SKI optional in leaf certificate (RustCrypto#1028) - bump rsa from 0.9.0-pre.2 to 0.9.0 (RustCrypto#1033) - bump rsa from 0.9.1 to 0.9.2 (RustCrypto#1056) Fixed - fix `KeyUsage` bit tests (RustCrypto#993) - extraneous PhantomData in `TbsCertificate` (RustCrypto#1017) - CI flakiness (RustCrypto#1042) - usage of ecdsa signer (RustCrypto#1043)

Added - Certificate builder (RustCrypto#764) - Support for `RandomizedSigner` in builder (RustCrypto#1007) - Provide parsing profiles (RustCrypto#987) - Support for `Time::INFINITY` (RustCrypto#1024) - Conversion from `std::net::IpAddr` (RustCrypto#1035) - `CertReq` builder (RustCrypto#1034) - missing extension implementations (RustCrypto#1050) - notes about `UTCTime` range being 1970-2049 (RustCrypto#1052) - consume the `SignatureBitStringEncoding` trait (RustCrypto#1048) Changed - use `ErrorKind::Value` for overlength serial (RustCrypto#988) - Bump `hex-literal` to v0.4.1 (RustCrypto#999) - Builder updates (RustCrypto#1001) - better debug info when `zlint` isn't installed (RustCrypto#1018) - make SKI optional in leaf certificate (RustCrypto#1028) - bump rsa from 0.9.0-pre.2 to 0.9.0 (RustCrypto#1033) - bump rsa from 0.9.1 to 0.9.2 (RustCrypto#1056) Fixed - fix `KeyUsage` bit tests (RustCrypto#993) - extraneous PhantomData in `TbsCertificate` (RustCrypto#1017) - CI flakiness (RustCrypto#1042) - usage of ecdsa signer (RustCrypto#1043)

Added - Certificate builder (#764) - Support for `RandomizedSigner` in builder (#1007) - Provide parsing profiles (#987) - Support for `Time::INFINITY` (#1024) - Conversion from `std::net::IpAddr` (#1035) - `CertReq` builder (#1034) - missing extension implementations (#1050) - notes about `UTCTime` range being 1970-2049 (#1052) - consume the `SignatureBitStringEncoding` trait (#1048) Changed - use `ErrorKind::Value` for overlength serial (#988) - Bump `hex-literal` to v0.4.1 (#999) - Builder updates (#1001) - better debug info when `zlint` isn't installed (#1018) - make SKI optional in leaf certificate (#1028) - bump rsa from 0.9.0-pre.2 to 0.9.0 (#1033) - bump rsa from 0.9.1 to 0.9.2 (#1056) Fixed - fix `KeyUsage` bit tests (#993) - extraneous PhantomData in `TbsCertificate` (#1017) - CI flakiness (#1042) - usage of ecdsa signer (#1043)

baloo force-pushed the baloo/x509-cert/cert-builder branch 2 times, most recently from 2c89de5 to ad06b76 Compare November 19, 2022 16:11

baloo force-pushed the baloo/x509-cert/cert-builder branch 2 times, most recently from a44db20 to 111c526 Compare November 20, 2022 06:56

baloo force-pushed the baloo/x509-cert/cert-builder branch from a8c8cb6 to cd1bf94 Compare November 21, 2022 17:07

baloo force-pushed the baloo/x509-cert/cert-builder branch 2 times, most recently from c00659b to 240c0f9 Compare November 23, 2022 04:00

baloo marked this pull request as draft November 28, 2022 06:03

baloo force-pushed the baloo/x509-cert/cert-builder branch from 240c0f9 to 61fe940 Compare December 31, 2022 06:11

baloo commented Dec 31, 2022

View reviewed changes

x509-cert/src/serial_number.rs Show resolved Hide resolved

baloo mentioned this pull request Dec 31, 2022

x509-cert: another parse failure on publicly known cert #826

Closed

baloo force-pushed the baloo/x509-cert/cert-builder branch 3 times, most recently from aeb2cf8 to 1e4b92e Compare January 3, 2023 18:30

baloo force-pushed the baloo/x509-cert/cert-builder branch from 1e4b92e to 74dcf8e Compare March 30, 2023 21:11

baloo commented Mar 30, 2023

View reviewed changes

x509-cert/src/ext/pkix/keyusage.rs Outdated Show resolved Hide resolved

baloo force-pushed the baloo/x509-cert/cert-builder branch 2 times, most recently from f803168 to 37b45da Compare April 1, 2023 16:05

baloo changed the title ~~x509-cert: wip: add certificate builder~~ x509-cert: add certificate builder Apr 1, 2023

tarcieri reviewed Apr 9, 2023

View reviewed changes

x509-cert/src/builder.rs Show resolved Hide resolved

tarcieri reviewed Apr 9, 2023

View reviewed changes

baloo force-pushed the baloo/x509-cert/cert-builder branch from ce7fe7c to 3086be6 Compare April 10, 2023 16:17

baloo mentioned this pull request Apr 10, 2023

Handle cyclic dependencies #997

Merged

baloo force-pushed the baloo/x509-cert/cert-builder branch 3 times, most recently from 497ad4f to 7a91c7b Compare April 10, 2023 20:10

baloo added 8 commits April 10, 2023 14:12

x509-cert: provide zlint in CI

d5d186e

x509-cert: adds a builder for certificate

cf468f8

x509-cert: make use of DynAssociatedAlgorithmIdentifier

9c16e60

x509-cert: wire ecdsa signatures

d3d2320

x509-cert: fixup dependencies versions

2d6a07e

x509-cert: remove support for unique ids

c845cb7

x509-cert: add SubjectKeyIdentifier and AuthorityKeyIdentifier co…

50ce381

…nversions

x509-cert: test leaf certificates

794e080

baloo force-pushed the baloo/x509-cert/cert-builder branch from 7a91c7b to 794e080 Compare April 10, 2023 21:17

tarcieri approved these changes Apr 10, 2023

View reviewed changes

tarcieri merged commit 98957ae into RustCrypto:master Apr 10, 2023

baloo deleted the baloo/x509-cert/cert-builder branch April 10, 2023 22:08

tarcieri mentioned this pull request Apr 11, 2023

x509: CertificateBuilder w\ misuse resistance + best practices support #418

Closed

tarcieri mentioned this pull request Apr 20, 2023

x509-cert: support creating Certificate without additional variables #700

Closed

baloo mentioned this pull request May 3, 2023

x509-cert: v0.2.2 #1040

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

x509-cert: add certificate builder #764

x509-cert: add certificate builder #764

baloo commented Nov 19, 2022

baloo commented Nov 19, 2022

tarcieri commented Nov 19, 2022

tarcieri commented Nov 19, 2022

baloo commented Nov 19, 2022

tarcieri commented Nov 19, 2022

baloo commented Nov 20, 2022

tarcieri commented Nov 20, 2022 •

edited

Loading

baloo commented Nov 21, 2022 •

edited

Loading

baloo commented Nov 23, 2022

brandonweeks commented Feb 8, 2023

baloo commented Mar 30, 2023

tarcieri commented Apr 9, 2023

tarcieri Apr 9, 2023

tarcieri left a comment

x509-cert: add certificate builder #764

x509-cert: add certificate builder #764

Conversation

baloo commented Nov 19, 2022

baloo commented Nov 19, 2022

tarcieri commented Nov 19, 2022

tarcieri commented Nov 19, 2022

baloo commented Nov 19, 2022

tarcieri commented Nov 19, 2022

baloo commented Nov 20, 2022

tarcieri commented Nov 20, 2022 • edited Loading

baloo commented Nov 21, 2022 • edited Loading

baloo commented Nov 23, 2022

brandonweeks commented Feb 8, 2023

baloo commented Mar 30, 2023

tarcieri commented Apr 9, 2023

tarcieri Apr 9, 2023

Choose a reason for hiding this comment

tarcieri left a comment

Choose a reason for hiding this comment

tarcieri commented Nov 20, 2022 •

edited

Loading

baloo commented Nov 21, 2022 •

edited

Loading