certmaster w/o func, issues & patches

[Hans Lellelid]

Hi -

We're looking at using certmaster without func (for now, anyway) as a very
lightweight development PKI solution. Basically we want to be able to
request certs automatically (we use Puppet) and ensure they're signed by
something we trust. Certmaster sounds perfect.

I've run into a few stumbling blocks along the way that I wanted to mention;
I think the appropriate places for most of this is the issue tracker, but
figured I would start with an email.

(1) The certmaster daemon segfaults on CentOS 5.6 using the certmaster
0.28-1 package from EPEL. This appears to be happening in the create-cert
step, since the ca key exists but no cert. Anyway, SSL/pyOpenSSL seems to
be a likely culprit. Anyway, I haven't investigated further, because I
rebuilt the RPM for python27 (we are using python26 from epel and our own
python27 epel-based packages) and that worked fine.

(2) The certmaster-sync triggers that are installed/enabled by default by
the RPM implicitly require func. This breaks for us, obviously. (I realize
that cermaster-sync is the culprit here, so if that is supposed to work
without func, that is probably the problem; if that is a func tool then it
probably shouldn't be enabled by default.)

(3) We'd really like to be able to specify the hostname when calling
certmaster-request, since we have many hosts which have multiple interfaces
/ IPs (e.g. SSL vhosts) for which we'll want certs. I made a patch in our
RPM process to add this feature (add optparse + --hostname param).

There are some other changes we made to the SPEC file to sort of
"best-practicize" it, I'd like to contribute all of this back up for
consideration. Should I just create a ticket in Trac and attach the patches
there?

Thanks,
Hans

[seth vidal]

Post by Hans Lellelid
Hi -
We're looking at using certmaster without func (for now, anyway) as a
very lightweight development PKI solution. Basically we want to be
able to request certs automatically (we use Puppet) and ensure they're
signed by something we trust. Certmaster sounds perfect.

okay - that's fine - but you do know that puppet has its own CA built
in, too, right?

puppetca does just the same thing certmaster does.

func even has a mode to use the puppet certs.

Post by Hans Lellelid
I've run into a few stumbling blocks along the way that I wanted to
mention; I think the appropriate places for most of this is the issue
tracker, but figured I would start with an email.
(1) The certmaster daemon segfaults on CentOS 5.6 using the certmaster
0.28-1 package from EPEL. This appears to be happening in the
create-cert step, since the ca key exists but no cert. Anyway,
SSL/pyOpenSSL seems to be a likely culprit. Anyway, I haven't
investigated further, because I rebuilt the RPM for python27 (we are
using python26 from epel and our own python27 epel-based packages) and
that worked fine.

known - the new pyopenssl should have fixed it.

Post by Hans Lellelid
(2) The certmaster-sync triggers that are installed/enabled by default
by the RPM implicitly require func. This breaks for us, obviously.
(I realize that cermaster-sync is the culprit here, so if that is
supposed to work without func, that is probably the problem; if that
is a func tool then it probably shouldn't be enabled by default.)

hmm - that's a disentangling that would be useful.

Post by Hans Lellelid
(3) We'd really like to be able to specify the hostname when calling
certmaster-request, since we have many hosts which have multiple
interfaces / IPs (e.g. SSL vhosts) for which we'll want certs. I made
a patch in our RPM process to add this feature (add optparse +
--hostname param).

I'd be interested in seeing that patch.

Post by Hans Lellelid
There are some other changes we made to the SPEC file to sort of
"best-practicize" it, I'd like to contribute all of this back up for
consideration. Should I just create a ticket in Trac and attach the
patches there?

Or post your patches here.

-sv

[seth vidal]

HI Seth -- thanks for the response.
(inline)

Post by Hans Lellelid
We're looking at using certmaster without func (for now,

anyway) as a

Post by Hans Lellelid
very lightweight development PKI solution. Basically we

want to be

Post by Hans Lellelid
able to request certs automatically (we use Puppet) and

ensure they're

Post by Hans Lellelid
signed by something we trust. Certmaster sounds perfect.

okay - that's fine - but you do know that puppet has its own CA built
in, too, right?
puppetca does just the same thing certmaster does.
func even has a mode to use the puppet certs.
Hmmm -- ok. That's probably worth more consideration. We like
Python, though, so for the flexibility of using it when we don't need
Puppet we might still prefer certmaster.

Post by Hans Lellelid
(1) The certmaster daemon segfaults on CentOS 5.6 using the

certmaster

Post by Hans Lellelid
0.28-1 package from EPEL. This appears to be happening in the
create-cert step, since the ca key exists but no cert. Anyway,
SSL/pyOpenSSL seems to be a likely culprit. Anyway, I haven't
investigated further, because I rebuilt the RPM for python27 (we are
using python26 from epel and our own python27 epel-based packages)

and

Post by Hans Lellelid
that worked fine.

known - the new pyopenssl should have fixed it.
Ok, great. Yeah, since I had to also create a python27-pyOpenSSL
package, it's likely that this is what really fixed the problem :)

Post by Hans Lellelid
(2) The certmaster-sync triggers that are installed/enabled by

default

Post by Hans Lellelid
by the RPM implicitly require func. This breaks for us, obviously.
(I realize that cermaster-sync is the culprit here, so if that is
supposed to work without func, that is probably the problem; if that
is a func tool then it probably shouldn't be enabled by default.)

hmm - that's a disentangling that would be useful.
Yeah, for now I just commented out adding the triggers from the spec.

Post by Hans Lellelid
(3) We'd really like to be able to specify the hostname when calling
certmaster-request, since we have many hosts which have multiple
interfaces / IPs (e.g. SSL vhosts) for which we'll want certs. I

made

Post by Hans Lellelid
a patch in our RPM process to add this feature (add optparse +
--hostname param).

I'd be interested in seeing that patch.
Very simple - but attached.

and applied. thanks
-sv

[Greg Swift]

Post by Hans Lellelid
Hi -
We're looking at using certmaster without func (for now, anyway) as a very
lightweight development PKI solution.  Basically we want to be able to
request certs automatically (we use Puppet) and ensure they're signed by
something we trust.  Certmaster sounds perfect.

Also check out this thread:
https://www.redhat.com/archives/func-list/2011-April/msg00054.html

At the moment I have nothing else to add to seth's response to your
thread... he covered the bases.