How can I persist values of KeyUsage and BasicConstraints in the ECDSA based certificates from LetsEncrypt?

huangapple
go评论82阅读模式
英文:

How can I persist values of KeyUsage and BasicConstraints in the ECDSA based certificates from LetsEncrypt?

问题

我正在尝试建立一个CA，我需要一个用于此CA的根证书。这个根证书必须由一个公共CA签名，并且签名算法必须是ECDSA，使用prime256v1曲线。

我正在关注LetsEncrypt论坛上的这个问题。但是，我使用了一个单独的实用程序来生成密钥和CSR。这个实用程序帮助我成功生成了ECDSA密钥和CSR。以下是生成的CSR：

  1. 证书请求：
  2.     数据：
  3.         版本：0（0x0）
  4.         主题：O=MyOrg，L=Bengaluru，ST=Karnataka，C=IN，CN=mydomain.in
  5.         主题公钥信息：
  6.             公钥算法：id-ecPublicKey
  7.                 公钥：（256位）
  8.                 pub：
  9.                     <value>
  10.                 ASN1 OID：prime256v1
  11.                 NIST CURVE：P-256
  12.         属性：
  13.         请求扩展：
  14.             X509v3基本约束：关键
  15.                 CA:TRUE
  16.             X509v3扩展密钥用途：
  17.                 TLS Web客户端身份验证，TLS Web服务器身份验证
  18.             X509v3密钥用法：
  19.                 数字签名，密钥加密，证书签名，CRL签名
  20.     签名算法：ecdsa-with-SHA256
  21.         <value>

所以，基本上我在扩展中获得了KeyUsage和BasicConstraints的正确值。

现在，对于下一步，我正在从我的ec2实例中使用以下命令：

  1. certbot certonly -d <mydomain> --server https://acme-v02.api.letsencrypt.org/directory --csr <csr_generated_above> --cert-name <mydomain>

使用这个命令，我能够获得由LetsEncrypt签名的证书以及证书链。然而，在生成的证书中，我获得了不同的KeyUsage和BasicConstraints值：

  1. 所有者：CN=<my_domain>
  2. 颁发者：CN=Let's Encrypt Authority X3，O=Let's Encrypt，C=US
  3. 序列号：<value>
  4. 有效期自：2020年1月3日14:46:29 UTC 到：2020年4月2日14:46:29 UTC
  5. 证书指纹：
  6.     SHA1：<value>
  7.     SHA256：<value>
  8. 签名算法名称：SHA256withRSA
  9. 主题公钥算法：256位EC密钥
  10. 版本：3
  12. 扩展：
  14. #1: <value>
  15. #2: <value>
  16. #3: <value>
  18. #4: ObjectId: <value> Criticality=true
  19. 基本约束：[
  20.     CA:false
  21.     PathLen: undefined
  22. ]
  24. #5: <value>
  25. #6: ObjectId: <value> Criticality=false
  26. 扩展密钥用途 [
  27.     serverAuth
  28.     clientAuth
  29. ]
  31. #7: ObjectId: <value> Criticality=true
  32. 密钥用途 [
  33.     DigitalSignature
  34. ]
  36. #8: <value>
  37. #9: <value>

如上所示，KeyUsage、BasicConstraints和签名算法未保留。问题在于，我的CA需要KeyUsage的一个值为'Certificate Sign'。因此，我的CA无法启动。

所以我的问题是：

  1. 从LetsEncrypt获取我的CA的根证书是否可行？
  2. 如果是的话，是否需要在certbot命令中传递一些额外的标志？
  3. 或者我在哪里出错了？

我对使用公共CA来生成证书还相当新手。

英文:

I am trying to set up a CA and I need a root certificate for this CA. This root certificate has to be signed by a public CA and the signing algorithm has to be ECDSA with prime256v1 curve.

I am following [this issue][1] on LetsEncryp forum. However, I am using a separate utility for generating the keys and CSR. This utility helps me generate ECDSA keys and CSR successfully. Following is the CSR that's generated:

  1. Certificate Request:
  2.     Data:
  3.         Version: 0 (0x0)
  4.         Subject: O=MyOrg, L=Bengaluru, ST=Karnataka, C=IN, CN=mydomain.in
  5.         Subject Public Key Info:
  6.             Public Key Algorithm: id-ecPublicKey
  7.                 Public-Key: (256 bit)
  8.                 pub: 
  9.                     &lt;value&gt;
  10.                 ASN1 OID: prime256v1
  11.                 NIST CURVE: P-256
  12.         Attributes:
  13.         Requested Extensions:
  14.             X509v3 Basic Constraints: critical
  15.                 CA:TRUE
  16.             X509v3 Extended Key Usage: 
  17.                 TLS Web Client Authentication, TLS Web Server Authentication
  18.             X509v3 Key Usage: 
  19.                 Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
  20.     Signature Algorithm: ecdsa-with-SHA256
  21.         &lt;value&gt;

So, basically I am getting correct values for KeyUsage and BasicConstraints in the extension.

Now, for the next step, I am using the following command from my ec2 instance:

  1. certbot certonly -d &lt;mydomain&gt; --server https://acme-v02.api.letsencrypt.org/directory --csr &lt;csr_generated_above&gt; --cert-name &lt;mydomain&gt;

Using this command I'm able to get a certificate signed by LetsEncrypt along with the certificate chain. However, in the certificate that is generated, I get different values for KeyUsage and BasicConstraints:

  1. Owner: CN=&lt;my_domain&gt;
  2. Issuer: CN=Let&#39;s Encrypt Authority X3, O=Let&#39;s Encrypt, C=US
  3. Serial number: &lt;value&gt;
  4. Valid from: Fri Jan 03 14:46:29 UTC 2020 until: Thu Apr 02 14:46:29 UTC 2020
  5. Certificate fingerprints:
  6.     SHA1: &lt;value&gt;
  7.     SHA256: &lt;value&gt;
  8. Signature algorithm name: SHA256withRSA
  9. Subject Public Key Algorithm: 256-bit EC key
  10. Version: 3
  12. Extensions: 
  14. #1: &lt;value&gt;
  15. #2: &lt;value&gt;
  16. #3: &lt;value&gt;
  18. #4: ObjectId: &lt;value&gt; Criticality=true
  19. BasicConstraints:[
  20.     CA:false
  21.     PathLen: undefined
  22. ]
  24. #5: &lt;value&gt;
  25. #6: ObjectId: &lt;value&gt; Criticality=false
  26. ExtendedKeyUsages [
  27.     serverAuth
  28.     clientAuth
  29. ]
  31. #7: ObjectId: &lt;value&gt; Criticality=true
  32. KeyUsage [
  33.     DigitalSignature
  34. ]
  36. #8: &lt;value&gt;
  37. #9: &lt;value&gt;

As seen above, the KeyUsage, BasicConstraints and Signature algorithm are not persisted. And the issue is my CA needs that one of the values of KeyUsage should be 'Certificate Sign'. Due to which my CA is not able to spinup.

So my question is:

  1. Is it feasible to get a root cert for my CA from LetsEncrypt?
  2. If yes, do we need to pass some extra flags with the cert bot command?
  3. Or where am I getting this wrong?

I'm quite new to using public ca for the certificate generation.

[1]: http://And%20are%20there%20any%20other%20open%20source%20public%20ca%20that%20could%20be%20used%20for%20generating%20ecdsa%20based%20certs%20for%20testing%20purpose%20other%20than%20openssl? "broken link!"

答案1

得分: 1

LetsEncrypt仅颁发域名验证证书，不颁发代码签名证书，也不颁发根CA证书，没有其他类型的证书。

https://letsencrypt.org/docs/faq/

英文:

LetsEncrypt does not issue anything except Domain Validated certificates. No code signing certificates, no root CA certificates, nothing else.

https://letsencrypt.org/docs/faq/

huangapple
  • 本文由 发表于 2020年1月4日 00:48:44
  • 转载请务必保留本文链接：https://go.coder-hub.com/59582286.html
  • ecdsa
  • lets-encrypt
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定