cloudflare / cloudflare/cfssl

Config file seems to be ignored when using "cfssl selfsign"

Open
#889 4 comments 1 reaction 0 assignees View on GitHub
Dominant language
Go
Stars
9.5k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

I am trying to add a CRL to a root CA, which issue #41 suggests can now be accomplished using the "selfsign" command.

However, it seems to ignore the entire contents of my config file. If my config file is malformed, it will throw an error, but it is disregarding the entire contents.

For a given **rootca_csr.json**

```
{
"CN": "My Root CA",
"key": {
"algo": "ecdsa",
"size": 384
},
"names": [
{
"C": "US",
"O": "My Company"
}
],
"ca": {
"expiry": "262800h"
}
}
```

And a given **rootca_config.json**

```
{
"signing": {
"default": {
"crl_url": "http://my.site/root.crl",
"usages": [
"signing",
"key encipherment",
"cert sign",
"crl sign"
],
"expiry": "262800h",
"ca_constraint": {
"is_ca": true,
"max_path_len": 0,
"max_path_len_zero": true
}
}
}
}
```

And the given command:
`cfssl selfsign -config="rootca_config.json" -loglevel=0 "My Root CA" rootca_csr.json | cfssljson -bare rootca`

I get this:

> 2018/05/01 19:51:02 [DEBUG] loading configuration file from rootca_config.json
> 2018/05/01 19:51:02 [DEBUG] parse expiry in profile
> 2018/05/01 19:51:02 [DEBUG] expiry is valid
> 2018/05/01 19:51:02 [DEBUG] validating configuration
> 2018/05/01 19:51:02 [DEBUG] validate local profile
> 2018/05/01 19:51:02 [DEBUG] profile is valid
> 2018/05/01 19:51:02 [DEBUG] configuration ok
> 2018/05/01 19:51:02 [INFO] generate received request
> 2018/05/01 19:51:02 [INFO] received CSR
> 2018/05/01 19:51:02 [INFO] generating key: ecdsa-384
> 2018/05/01 19:51:02 [DEBUG] generate key from request: algo=ecdsa, size=384
> 2018/05/01 19:51:02 [INFO] encoded CSR
> *** WARNING ***
>
> Self-signed certificates are dangerous. Use this self-signed
> certificate at your own risk.
>
> It is strongly recommended that these certificates NOT be used
> in production.
>
> *** WARNING ***

The resulting certificate, though, has a 4 month expiration, none of the correct usages, and no CRL. If I, say, rename the default section of that config file and run the command, I'll get errors about no default section, so it's definitely seeing the config file. Why isn't it processing the parameters?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.