YaPI::CaManagement
This package is the public Yast2 API to the CA management.
1.2.0
use YaPI::CaManagement
$caList = ReadCAList()
returns a list of available CAs
$caList = ReadCATree()
returns a list of lists of the available CAs containing the issuer caName
$bool = AddRootCA($valueMap)
create a new selfsigned root CA
$certValueMap = ReadCertificateDefaults($valueMap)
returns a map with defaults for the requested certificate type
$bool = WriteCertificateDefaults($valueMap)
write the default values for the available certificate types
$ca = ReadCA($valueMap)
returns a CA certificate as plain text or parsed map
$name = AddRequest($valueMap)
create a request for a special CA and returns the name $name = IssueCertificate($valueMap)
issue a certificate and returns the name of the new certificate
$name = AddCertificate($valueMap)
create a new Certificate and returns the name
$certList = ReadCertificateList($valueMap)
returns a list of maps with all certificates of a special CA
$bool = UpdateDB($valueMap)
update the internal openssl database
$cert = ReadCertificate($valueMap)
returns a certificate as plain text or parsed map $bool = RevokeCertificate($valueMap)
revoke a certificate
$bool = AddCRL($valueMap)
create a CRL
$crl = ReadCRL($valueMap)
returns a CRL as plain text or parsed map
$file = ExportCA($valueMap)
Export a CA to a file or returns it in different formats
$file = ExportCertificate($valueMap)
Export a certificate to a file or returns it in different formats
$file = ExportCRL($valueMap)
Export a CRL to a file or returns it in different formats
$bool = Verify($valueMap)
verify a certificate
$bool = AddSubCA($valueMap)
Create a new CA which signed by another CA
$bool = ExportCAToLDAP($valueMap)
Export a CA to a LDAP directory
$bool = ExportCRLToLDAP($valueMap)
Export a CRL to a LDAP directory
$bool = ExportCertificateToLDAP($valueMap)
Export a Certificate in a LDAP Directory.
$defaultsMap = ReadLDAPExportDefaults($valueMap)
Return the defaults for export CA, CRL or certificates to LDAP.
$bool = InitLDAPcaManagement($valueMap)
Creates the default configuration structure in LDAP
$bool = DeleteCertificate($valueMap)
Delete a Certificate. This function removes also the request and the private key.
$bool = ImportCommonServerCertificate($valueMap)
Import a server certificate plus correspondenting CA and copy them to a place where other YaST modules look for such a common certificate.
$bool = ReadFile($valueMap)
Returns a certificate or CRL as plain text or parsed map.
$certList = ReadRequestList($valueMap)
Returns a list of maps with all requests of the defined CA.
$cert = ReadRequest($valueMap)
Returns a request as plain text or parsed map.
$request = ImportRequest($valueMap)
Import a request in a CA repository.
$bool = DeleteRequest($valueMap)
Delete a Request.
$bool = ImportCA($valueMap)
Import a CA certificate and creates a infrastructure
$bool = DeleteCA($valueMap)
Delete a Certificate Authority infrastructure
$crlValueMap = ReadCRLDefaults($valueMap)
Read the default values for a CRL.
$bool = WriteCRLDefaults($valueMap)
Write the default values for creating a CRL.
Here is a list of common parameter which are often used in $valueMap
allowed values are:
client, server, ca
(without suffix)
(without suffix)
(ascii)
( must be greater or equal 512 )
allowed values are:
unspecified, keyCompromise, CACompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold
X509v3 extensions. All values can have the parameter critical as first value. Combinations can be done via ',' if they are allowed.
CA:TRUE, CA:FALSE, pathlen:<integer>
allowed values are:
client, server, email, objsign, reserved, sslCA, emailCA, objCA
allowed values are:
digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly
allowed values are:
"hash" or a Hex String
allowed values are:
issuer[:always], keyid[:always]
allowed values are:
email:<email-address>, URI:<URL>, DNS:<domain_name>, RID:<object_identifier>, IP:<ip_address>, email:copy
allowed values are:
email:<email-address>, URI:<URL>, DNS:<domain_name>, RID:<object_identifier>, IP:<ip_address>, issuer:copy
allowed values are:
serverAuth, clientAuth, codeSigning, emailProtection, timeStamping, msCodeInd, msCodeCom, msCTLSign, msSGC, msEFS, nsSGC, <object_identifier>
a list of explanation:
"serverAuth" SSL/TLS Web Server Authentication. "clientAuth" SSL/TLS Web Client Authentication. "codeSigning" Code signing. "emailProtection" E-mail Protection (S/MIME). "timeStamping" Trusted Timestamping "msCodeInd" Microsoft Individual Code Signing (authenticode) "msCodeCom" Microsoft Commercial Code Signing (authenticode) "msCTLSign" Microsoft Trust List Signing "msSGC" Microsoft Server Gated Crypto "msEFS" Microsoft Encrypted File System "nsSGC" Netscape Server Gated Crypto
accessOID can be: OCSP, caIssuers or a <object_identifier>
location can be: email:<email-address>, URI:<URL>, DNS:<domain_name>, RID:<object_identifier>, IP:<ip_address>
$caList = ReadCAList()
Returns a list of available CAs
EXAMPLE:
my $caList = YaPI::CaManagement->ReadCAList(); if(not defined $caList) { #error }
foreach my $ca (@$caList) { print $ca."\n"; }
$caList = ReadCATree()
Returns a list of lists of the available CAs containing the issuer caName.
* $caList->[$x]->[0] is the caName
* $caList->[$x]->[1] is the issuer caName
If the issuer caName is empty caName is a root CA. The list is sorted by the first element.
The function return undef on an error.
EXAMPLE:
my $caList = YaPI::CaManagement->ReadCATree(); if(not defined $caList) { #error }
print Data::Dumper->Dump([$ca])."\n";
$bool = AddRootCA($valueMap)
Create a new selfsigned root CA and creates the whole needed infrastructure.
$valueMap supports the following Keys:
* caName (required)
* keyPasswd (required)
* commonName (required)
* emailAddress (depending on CA policy)
* keyLength (default 2048 min: 512 max: 9999)
* days (default 3650)
* countryName (depending on CA policy)
* stateOrProvinceName (depending on CA policy)
* localityName (depending on CA policy)
* organizationName (depending on CA policy)
* organizationalUnitName (depending on CA policy)
* challengePassword
* unstructuredName
* basicConstraints (required)
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* authorityKeyIdentifier
* subjectAltName
* issuerAltName
* nsBaseUrl
* nsRevocationUrl
* nsCaRevocationUrl
* nsRenewalUrl
* nsCaPolicyUrl
* nsSslServerName
* extendedKeyUsage
* authorityInfoAccess
* crlDistributionPoints
The syntax of these values are explained in the COMMON PARAMETER section.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'keyPasswd' => 'system', 'commonName' => 'My CA', 'emailAddress' => 'my@example.com', 'keyLength' => '2048', 'days' => '3650', 'countryName' => 'US', 'localityName' => 'New York', 'organizationName' => 'My Inc.', };
my $res = YaPI::CaManagement->AddRootCA($data); if( not defined $res ) { # error } else { print "OK\n"; }
$certValueMap = ReadCertificateDefaults($valueMap)
In $valueMap you can define the following keys:
* caName (if not defined, read defaults for a Root CA)
* certType
Returns a map with defaults for the requested certificate type. The return value is ``undef'' on an error.
On success the return value is a hash which can contain the following keys:
* basicConstraints
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* authorityKeyIdentifier
* subjectAltName
* issuerAltName
* nsBaseUrl
* nsRevocationUrl
* nsCaRevocationUrl
* nsRenewalUrl
* nsCaPolicyUrl
* nsSslServerName
* extendedKeyUsage
* authorityInfoAccess
* crlDistributionPoints
* keyLength
* days
* DN
DN is a hash which contains some values of the subject of the CA Certificate (if caName is defined)
The syntax of these values are explained in the COMMON PARAMETER section.
EXAMPLE:
use Data::Dumper;
my $data = { 'caName' => 'My_CA', 'certType' => 'client' } $certValueMap = YaPI::CaManagement->ReadCertificateDefaults($data) if( not defined $certValueMap ) { # error } else { print Data::Dumper->Dump([$certValueMap])."\n"; }
$bool = WriteCertificateDefaults($valueMap)
Write the default values for the available certificate types. Keys which are not present, will be removed if they are available in the configuration file.
In $valueMap you can define the following keys:
* caName (required)
* certType (required)
* basicConstraints
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* authorityKeyIdentifier
* subjectAltName
* issuerAltName
* nsBaseUrl
* nsRevocationUrl
* nsCaRevocationUrl
* nsRenewalUrl
* nsCaPolicyUrl
* nsSslServerName
* extendedKeyUsage
* authorityInfoAccess
* crlDistributionPoints
* days
* keyLength
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'certType' => 'server', 'nsComment' => '"My Server Certificate"' }; my $res = YaPI::CaManagement->WriteCertificateDefaults($data); if( not defined $res ) { # error } else { print "OK\n"; } }
$ca = ReadCA($valueMap)
Returns a CA certificate as plain text or parsed map.
In $valueMap you can define the following keys:
* caName (required)
* type (required; can be ``plain'', ``parsed'', ``extended'')
The return value is ``undef'' on an error.
On success and type = ``plain'' the plain text view of the CA is returned.
If the type = ``parsed'' or ``extended'' a complex structure with the single values is returned.
EXAMPLE:
use Data::Dumper;
foreach my $type ("parsed", "plain", "extended") { my $data = { 'caName' => 'My_CA', 'type' => $type }; my $res = YaPI::CaManagement->ReadCA($data); if( not defined $res ) { # error } else { print Data::Dumper->Dump([$res])."\n"; } }
$name = AddRequest($valueMap)
Create a request for a special CA and returns the name.
The keys in $valueMap are:
* caName (required)
* keyPasswd (required)
* commonName (required)
* emailAddress (depending on CA policy)
* keyLength (required)
* countryName (depending on CA policy)
* stateOrProvinceName (depending on CA policy)
* localityName (depending on CA policy)
* organizationName (depending on CA policy)
* oganizationalUnitName (depending on CA policy)
* challengePassword
* unstructuredName
* basicConstraints
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* subjectAltName
* nsSslServerName
* extendedKeyUsage
The return value is ``undef'' on an error and the filename(without suffix) of the request on success.
The syntax of these values are explained in the COMMON PARAMETER section.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'keyPasswd' => 'system', 'commonName' => 'My New Request', 'emailAddress' => 'my@example.com', 'keyLength' => '2048', 'days' => '365', 'countryName' => 'DE', 'localityName' => 'Nuremberg', 'stateOrProvinceName' => 'Bavaria', 'organizationName' => 'My Linux AG', 'nsComment' => "YaST Generated Certificate" }; my $res = YaPI::CaManagement->AddRequest($data); if( not defined $res ) { # error } else { print "OK Name of the request is: '$res'\n"; }
$name = IssueCertificate($valueMap)
Issue a certificate and returns the name of the new certificate.
In $valueMap you can define the following keys:
* caName (required)
* request (required - the name of the request without suffix)
* certType (required - allowed values are: ``client'', ``server'' and ``ca'')
* caPasswd (required)
* days (required)
* basicConstraints (required)
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* authorityKeyIdentifier
* subjectAltName
* issuerAltName
* nsBaseUrl
* nsRevocationUrl
* nsCaRevocationUrl
* nsRenewalUrl
* nsCaPolicyUrl
* nsSslServerName
* extendedKeyUsage
* authorityInfoAccess
* crlDistributionPoints
The return value is ``undef'' on an error and the filename(without suffix) of the certificate on success.
The syntax of these values are explained in the COMMON PARAMETER section.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'request' => $request, 'certType' => 'client', 'caPasswd' => 'system', 'days' => '365', 'crlDistributionPoints' => "URI:ldap://my.linux.tux/?cn=My_CA%2Cou=PKI%2Cdc=example%2Cdc=com", 'nsComment' => "YaST Generated Certificate", }; my $res = YaPI::CaManagement->IssueCertificate($data); if( not defined $res ) { # error } else { print STDERR "OK: '$res'\n"; }
$name = AddCertificate($valueMap)
Create a new Certificate and returns the name
In $valueMap you can define the following keys:
* caName (required)
* certType (required - ``client'', ``server'' or ``ca'' )
* keyPasswd (required)
* caPasswd (required)
* commonName (required)
* emailAddress (depending on CA policy)
* keyLength (required)
* days (required)
* countryName (depending on CA policy)
* stateOrProvinceName (depending on CA policy)
* localityName (depending on CA policy)
* organizationName (depending on CA policy)
* organizationalUnitName (depending on CA policy)
* challengePassword
* unstructuredName
* basicConstraints (required)
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* authorityKeyIdentifier
* subjectAltName
* issuerAltName
* nsBaseUrl
* nsRevocationUrl
* nsCaRevocationUrl
* nsRenewalUrl
* nsCaPolicyUrl
* nsSslServerName
* extendedKeyUsage
* authorityInfoAccess
* crlDistributionPoints
* notext (optional - if set to ``1'' do not output the text version in the PEM file)
The return value is ``undef'' on an error and the filename(without suffix) of the certificate on success.
The syntax of these values are explained in the COMMON PARAMETER section.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'certType' => 'client', 'keyPasswd' => 'system', 'caPasswd' => 'system', 'commonName' => 'John Doe', 'emailAddress' => 'John.Doe@example.com', 'keyLength' => '2048', 'days' => '365', 'countryName' => 'US', 'localityName' => 'New York', 'organizationalUnitName'=> 'IT', 'organizationName' => 'My Inc.', 'crlDistributionPoints' => "URI:ldap://ldap.example.com/?cn=My_CA%2Cou=PKI%2Cdc=example%2Cdc=com", 'nsComment' => "YaST Generated Certificate", };
my $res = YaPI::CaManagement->AddCertificate($data); if( not defined $res ) { # error } else { print "OK: '$res'\n"; }
$certList = ReadCertificateList($valueMap)
Returns a list of maps with all certificates of the defined CA.
In $valueMap you can define the following keys:
* caName (required)
* caPasswd (required)
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error.
On success it returns an array of hashes with all certificates of this CA. @ret[0..X] can have the following Hash keys:
* certificate (the name of the certificate)
* commonName
* emailAddress
* countryName
* stateOrProvinceName
* localityName
* organizationName
* organizationalUnitName
* status (The status of the certificate: ``valid'', ``revoked'', ``expired'')
EXAMPLE:
use Data::Dumper;
my $data = { 'caName' => 'My_CA', 'caPasswd' => 'system' };
my $res = YaPI::CaManagement->ReadCertificateList($data); if( not defined $res ) { # error } else { my $certificateName = $res->[0]->{'certificate'}; print Data::Dumper->Dump([$res])."\n"; }
$bool = UpdateDB($valueMap)
Update the internal openssl database.
In $valueMap you can define the following keys:
* caName (required)
* caPasswd (required)
The return value is ``undef'' on an error and ``1'' on success.
The syntax of these values are explained in the COMMON PARAMETER section.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'caPasswd' => 'system' };
my $res = YaPI::CaManagement->UpdateDB($data); if( not defined $res ) { # error } else { print "OK \n"; }
$cert = ReadCertificate($valueMap)
Returns a certificate as plain text or parsed map.
In $valueMap you can define the following keys:
* caName (required)
* certificate (required - name without suffix)
* type (required - allowed values: ``parsed'', ``extended'' or ``plain'')
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error.
On success and type = plain the plain text view of the Certificate is returned.
If the type is ``parsed'' or ``extended'' a complex structure with the single values is returned.
EXAMPLE:
use Data::Dumper;
foreach my $type ("parsed", "plain", "extended") { my $data = { 'caName' => 'My_CA', 'type' => $type, 'certificate' => $certName };
my $res = YaPI::CaManagement->ReadCertificate($data); if( not defined $res ) { # error } else { print Data::Dumper->Dump([$res])."\n"; } }
$bool = RevokeCertificate($valueMap)
Revoke a certificate.
In $valueMap you can define the following keys:
* caName (required)
* caPasswd (required)
* certificate (required)
* crlReason
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'caPasswd' => 'system', 'certificate' => $certName, 'crlReason' => 'keyCompromise' };
my $res = YaPI::CaManagement->RevokeCertificate($data); if( not defined $res ) { # error } else { print "Revoke successful\n"; }
$bool = AddCRL($valueMap)
Create a new CRL.
In $valueMap you can define the following keys:
* caName (required)
* caPasswd (required)
* days (required)
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'caPasswd' => 'system', 'days' => 8 };
my $res = YaPI::CaManagement->AddCRL($data); if( not defined $res ) { # error } else { print "AddCRL successful\n"; }
$crl = ReadCRL($valueMap)
Returns a CRL as plain text or parsed map.
In $valueMap you can define the following keys:
* caName (required)
* type (required - allowed values: ``parsed'', ``extended'' or ``plain'')
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error.
On success and type = plain the plain text view of the CRL is returned.
If the type is ``parsed'' or ``extended'' a complex structure with the single values is returned.
EXAMPLE:
use Data::Dumper;
foreach my $type ("parsed", "plain", "extended") { my $data = { 'caName' => 'My_CA', 'type' => $type, };
my $res = YaPI::CaManagement->ReadCRL($data); if( not defined $res ) { # error } else { print Data::Dumper->Dump([$res])."\n"; } }
$file = ExportCA($valueMap)
Export a CA to a file or returns it in different formats.
In $valueMap you can define the following keys:
* caName (required)
* caPasswd (required)
* exportFormat <format> (required)
PEM_CERT (export only the Certificate im PEM format)
PEM_CERT_KEY (export the Certificate and the Key unencrypted in PEM Format)
PEM_CERT_ENCKEY (export the Certificate and the Key encrypted in PEM Format)
DER_CERT (export the Certificate in DER Format)
PKCS12 (export the Certificate and the Key in PKCS12 Format)
PKCS12_CHAIN (like PKCS12 + include the CA Chain )
* destinationFile (optional)
* P12Password (only for creating PKCS12 password)
The return value is ``undef'' on an error and ``1'' on success if destinationFile is defined. If destinationFile is not defined, the CA is directly returned. If the exportFormat is PEM_CERT_KEY or PEM_CERT_ENCKEY the certificate and the key are returned. Because of the PEM format it is easy to split them later.
EXAMPLE:
foreach my $ef ("PEM_CERT", "PEM_CERT_KEY", "PEM_CERT_ENCKEY","DER_CERT", "PKCS12", "PKCS12_CHAIN") { my $data = { 'caName' => 'My_CA', 'exportFormat' => $ef, 'caPasswd' => "system", }; if($ef =~ /^PKCS12/) { $data->{'P12Password'} = "p12pass"; }
my $res = YaPI::CaManagement->ExportCA($data); if( not defined $res ) { # error } else { if(! open(OUT, "> /tmp/certs/$ef")) { print STDERR "OPEN_FAILED\n"; exit 1; } print OUT $res; close OUT; } }
$file = ExportCertificate($valueMap)
Export a certificate to a file or returns it in different formats.
In $valueMap you can define the following keys:
* caName (required)
* caPassword (required)
* keyPassword (required)
* certificate (required)
* exportFormat <format> (required)
PEM_CERT (export only the Certificate im PEM format)
PEM_CERT_KEY (export the Certificate and the Key unencrypted in PEM Format)
PEM_CERT_ENCKEY (export the Certificate and the Key encrypted in PEM Format)
DER_CERT (export the Certificate in DER Format)
PKCS12 (export the Certificate and the Key in PKCS12 Format)
PKCS12_CHAIN (like PKCS12 + include the CA Chain )
* destinationFile (optional)
* P12Password (only for creating PKCS12 password)
The return value is ``undef'' on an error and ``1'' on success if destinationFile is defined. If destinationFile is not defined, the certificate is directly returned. If the exportFormat is PEM_CERT_KEY or PEM_CERT_ENCKEY the certificate and the key are returned. Because of the PEM format it is easy to split them later.
EXAMPLE:
foreach my $ef ("PEM_CERT", "PEM_CERT_KEY", "PEM_CERT_ENCKEY","DER_CERT", "PKCS12", "PKCS12_CHAIN") { my $data = { 'caName' => 'My_CA', 'certificate' => $certName, 'exportFormat' => $ef, 'keyPasswd' => "system", }; if($ef =~ /^PKCS12/) { $data->{'P12Password'} = "p12pass"; }
my $res = YaPI::CaManagement->ExportCertificate($data); if( not defined $res ) { # error } else { if(! open(OUT, "> /tmp/certs/$ef")) { print STDERR "OPEN_FAILED\n"; exit 1; } print OUT $res; close OUT; } }
$file = ExportCRL($valueMap)
Export a CRL to a file or returns it in different formats.
In $valueMap you can define the following keys:
* caName (required)
* caPasswd (required)
* exportFormat <format> (required)
PEM - Export the CRL in PEM format
DER - Export the CRL in DER format
* destinationFile (optional)
The return value is ``undef'' on an error and ``1'' on success, if 'destinationFile' is defined. If 'destinationFile' is not defined the CRL is returned.
EXAMPLE:
foreach my $ef ("PEM", "DER") { my $data = { 'caName' => 'My_CA', 'caPasswd' => 'system', 'exportFormat' => $ef, }; my $res = YaPI::CaManagement->ExportCRL($data); if( not defined $res ) { # error } else { if(! open(OUT, "> /tmp/certs/CRL_$ef")) { print STDERR "OPEN_FAILED\n"; } print OUT $res; close OUT; } }
$bool = Verify($valueMap)
Verify a certificate.
In $valueMap you can define the following keys:
* caName (required)
* certificate (required)
* disableCRLcheck (optional)
* purpose (optional)
The parameter purpose could be one of the following values:
* sslclient (SSL client)
* sslserver (SSL server)
* nssslserver (Netscape SSL server)
* smimesign (S/MIME signing)
* smimeencrypt (S/MIME encryption)
* crlsign (CRL signing)
* any (Any Purpose)
* ocsphelper (OCSP helper)
The syntax of the other values are explained in the COMMON PARAMETER section.
The return value is ``undef'' if the verification failed. On success it returns ``1''.
EXAMPLE:
$data = { 'caName' => 'My_CA', 'certificate' => $certName };
my $Vret = YaPI::CaManagement->Verify($data); if(not defined $Vret) { # verification failed } else { print "OK \n"; }
$bool = AddSubCA($valueMap)
create a new CA signed by another CA.
In $valueMap you can define the following keys:
* newCaName (required - the name of the new CA)
* caName (required - the name of the CA which should issue the new CA)
* keyPasswd (required - password for the new CA)
* caPasswd (required - password for the CA which should issue the new CA)
* commonName (required)
* emailAddress (depending on CA policy)
* keyLength (required)
* days (required)
* countryName (depending on CA policy)
* stateOrProvinceName (depending on CA policy)
* localityName (depending on CA policy)
* organizationName (depending on CA policy)
* organizationalUnitName (depending on CA policy)
* challengePassword
* unstructuredName
* basicConstraints (required)
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* authorityKeyIdentifier
* subjectAltName
* issuerAltName
* nsBaseUrl
* nsRevocationUrl
* nsCaRevocationUrl
* nsRenewalUrl
* nsCaPolicyUrl
* nsSslServerName
* extendedKeyUsage
* authorityInfoAccess
* crlDistributionPoints
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an the filename(without suffix) of the certificate on success.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'newCaName' => 'My_New_Sub_CA', 'keyPasswd' => 'newPasswd', 'caPasswd' => 'system', 'commonName' => 'My CA New Sub CA', 'emailAddress' => 'my@example.com', 'keyLength' => '2048', 'days' => '3000', 'countryName' => 'US', 'localityName' => 'New York', 'organizationName' => 'My Inc.', 'basicConstraints' => 'CA:TRUE', 'crlDistributionPoints' => 'URI:http://my.example.com/', };
my $res = YaPI::CaManagement->AddSubCA($data); if( not defined $res ) { # error } else { print "OK '$res'\n"; }
$bool = ExportCAToLDAP($valueMap)
Export a CA in a LDAP Directory.
In $valueMap you can define the following keys:
* caName (required)
* ldapHostname (required - hostname or IP address)
* ldapPort (default: 389)
* destinationDN (required)
* bindDN (required)
* ldapPasswd (required)
destinationDN is the DN to the entry where to store the CA. The following objectclasses are used:
* cRLDistributionPoint
* pkiCA
The first attribute type of the DN must be 'cn'.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { caName => 'My_CA', ldapHostname => 'myhost.example.com', ldapPort => 389, destinationDN => "cn=My_CA,ou=PKI,dc=suse,dc=de", BindDN => "cn=Admin,dc=example,dc=com", ldapPasswd => "system" };
my $res = YaPI::CaManagement->ExportCAToLDAP($data); if( not defined $res ) { # error } else { print STDERR "OK\n"; }
$bool = ExportCRLToLDAP($valueMap)
Export a CRL in a LDAP Directory
In $valueMap you can define the following keys:
* caName (required)
* ldapHostname (required - hostname or IP address)
* ldapPort (default: 389)
* destinationDN (required)
* bindDN (required)
* ldapPasswd (required)
destinationDN is the DN to the entry where to store the CA. The following objectclasses are used:
* cRLDistributionPoint
* pkiCA
The first attribute type of the DN must be 'cn'.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { caName => 'My_CA', ldapHostname => 'myhost.example.com', ldapPort => 389, destinationDN => "cn=My_CA,ou=PKI,dc=suse,dc=de", BindDN => "cn=Admin,dc=example,dc=com", ldapPasswd => "system" };
my $res = YaPI::CaManagement->ExportCRLToLDAP($data); if( not defined $res ) { # error } else { print STDERR "OK\n"; }
$defaultsMap = ReadLDAPExportDefaults($valueMap)
Return the defaults for export CA, CRL or certificates to LDAP. If an error ocured with code = LDAP_CONFIG_NEEDED, you have to call InitLDAPcaManagement() first.
In $valueMap you can define the following keys:
* type (required - allowed values are: ``ca'', ``crl'', ``certificate'')
* caName (optional)
* commonName (required - only if 'type' is 'certificate')
* emailAddress (optional - only if 'type' is 'certificate')
* subjectAltName (optional - only if 'type' is 'certificate')
The return value is ``undef'' on an error.
On success a map is returned with the following keys:
* ldapHostname
* ldapPort
* BindDN
* destinationDN
The value of destinationDN is an array.
EXAMPLE:
use Data::Dumper;
my $data = { 'caName' => 'My_CA', 'type' => 'ca' };
my $res = YaPI::CaManagement->ReadLDAPExportDefaults($data);
if( not defined $res ) { # error } else { print Data::Dumper->Dump([$res]).``\n''; }
$bool = InitLDAPcaManagement($valueMap)
Creates the default configuration structure in LDAP
In $valueMap you can define the following keys:
* ldapPasswd (required)
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { 'ldapPasswd' => 'system' };
my $res = YaPI::CaManagement->InitLDAPcaManagement($data); if( not defined $res ) { # error } else { print "OK\n"; }
$bool = ExportCertificateToLDAP($valueMap)
Export a Certificate in a LDAP Directory. This function is designed for exporting user certificates. The destination entry must have the objectclass 'inetOrgPerson'.
In $valueMap you can define the following keys:
* caName (required)
* certificate (required)
* keyPasswd (optional - if defined, then p12Passwd is required)
* p12Passwd (optional)
* ldapHostname (required - hostname or IP address)
* ldapPort (default: 389)
* destinationDN (required)
* bindDN (required)
* ldapPasswd (required)
If the private key of the certificate is available and the parameter 'caPasswd', 'keyPasswd' and 'p12Passwd' are defined, an export in PKCS12 format is also done.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { caName => 'My_CA', certificate => $certificateName, ldapHostname => 'myhost.example.com', ldapPort => 389, destinationDN => "uid=me,ou=people,dc=suse,dc=de", BindDN => "cn=Admin,dc=example,dc=com", ldapPasswd => "system" };
my $res = YaPI::CaManagement->ExportCertificateToLDAP($data); if( not defined $res ) { # error } else { print STDERR "OK\n"; }
$bool = DeleteCertificate($valueMap)
Delete a Certificate. This function removes also the request and the private key.
In $valueMap you can define the following keys:
* caName (required)
* certificate (required)
* caPasswd (required)
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { caName => 'My_CA', certificate => $certificateName, caPasswd => 'system' };
my $res = YaPI::CaManagement->DeleteCertificate($data); if( not defined $res ) { # error } else { print STDERR "OK\n"; }
$bool = ImportCommonServerCertificate($valueMap)
Import a server certificate plus correspondenting CA and copy them to a place where other YaST modules look for such a common certificate.
The CA(s)
are copied to '/etc/ssl/certs/YaST-CA.pem'.
The server certificate is copied to '/etc/ssl/servercerts/servercert.pem' .
The private key is copied to '/etc/ssl/servercerts/serverkey.pem' . The private key is unencrypted and only for root readable.
In $valueMap you can define the following keys:
* inFile (required)
* passwd (required)
inFile is the path to a certificate in PKCS12 format.
passwd is the password which is needed to decrypt the PKCS12 certificate. A second password is not needed, because the private key will be unencrypted.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { inFile => '/media/floppy/YaST-Servercert.p12', passwd => 'system' };
my $res = YaPI::CaManagement->ImportCommonServerCertificate($data); if( not defined $res ) { # error } else { print STDERR "OK\n"; }
$bool = ReadFile($valueMap)
Returns a certificate or CRL as plain text or parsed map.
In $valueMap you can define the following keys:
* inFile (required)
* type (required; can be ``plain'', ``parsed'' or ``extended'')
* datatype (can be ``CERTIFICATE'', ``REQUEST'' or ``CRL'')
* inForm (required; ``PEM'', ``DER'')
The return value is ``undef'' on an error.
On success and type = ``plain'' the plain text view of the CA is returned.
If the type = ``parsed'' or ``extended'' a complex structure with the single values is returned.
EXAMPLE:
use Data::Dumper;
foreach my $type ("parsed", "plain", "extended") { my $data = { 'datatype' => "CERTIFICATE", 'inFile' => '/path/to/a/certificate.pem', 'inForm' => "PEM" 'type' => $type, };
my $res = YaPI::CaManagement->ReadFile($data); if( not defined $res ) { # error } else { print Data::Dumper->Dump([$res])."\n"; } }
$cert = ReadRequest($valueMap)
Returns a request as plain text or parsed map.
In $valueMap you can define the following keys:
* caName (required)
* request (required - name without suffix)
* type (required - allowed values: ``parsed'', ``extended'' or ``plain'')
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error.
On success and type = plain the plain text view of the Certificate is returned.
If the type is ``parsed'' or ``extended'' a complex structure with the single values is returned.
EXAMPLE:
use Data::Dumper;
foreach my $type ("parsed", "plain", "extended") { my $data = { 'caName' => 'My_CA', 'type' => $type, 'request' => $certName };
my $res = YaPI::CaManagement->ReadRequest($data); if( not defined $res ) { # error } else { print Data::Dumper->Dump([$res])."\n"; } }
$certList = ReadRequestList($valueMap)
Returns a list of maps with all requests of the defined CA.
In $valueMap you can define the following keys:
* caName (required)
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error.
On success it returns an array of hashes with all requests of this CA. @ret[0..X] can have the following Hash keys:
* request (the name of the certificate)
* commonName
* emailAddress
* countryName
* stateOrProvinceName
* localityName
* organizationName
* organizationalUnitName
* date
EXAMPLE:
use Data::Dumper;
my $data = { 'caName' => 'My_CA' };
my $res = YaPI::CaManagement->ReadRequestList($data); if( not defined $res ) { # error } else { my $requestName = $res->[0]->{'request'}; print Data::Dumper->Dump([$res])."\n"; }
$request = ImportRequest($valueMap)
Import a request in a CA repository.
In $valueMap you can define the following keys:
* caName (required)
* inFile
* data
* importFormat (default PEM)
inFile is the path to a request. data the request data directly
One of inFile or data is required.
importFormat can be ``PEM'' or ``DER''. Default is PEM.
The return value is ``undef'' on an error and the request name on success.
EXAMPLE:
my $data = { caName => 'My_CA', inFile => '/media/floppy/my_request.pem', importFormat => 'PEM' };
my $res = YaPI::CaManagement->ImportRequest($data); if( not defined $res ) { # error } else { print STDERR "$res\n"; }
$bool = DeleteRequest($valueMap)
Delete a Request. This function removes also the private key if one is available.
In $valueMap you can define the following keys:
* caName (required)
* caPasswd (required)
* request (required)
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { caName => 'My_CA', request => $requestName, caPasswd => 'system' };
my $res = YaPI::CaManagement->DeleteRequest($data); if( not defined $res ) { # error } else { print STDERR "OK\n"; }
$bool = ImportCA($valueMap)
Import a CA certificate and private key and creates a infrastructure.
In $valueMap you can define the following keys:
* caName (required - A name for this CA)
* caCertificate (required - path to certificate file in PEM format)
* caKey (required - path to private key in PEM format)
* caPasswd (required, if the private key is unencrypted)
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { caName => 'My_CA', caCertificate => /path/to/cacert.pem, caKey => /path/to/cacert.key };
my $res = YaPI::CaManagement->ImportCA($data); if( not defined $res ) { # error } else { print STDERR "OK\n"; }
$bool = DeleteCA($valueMap)
Delete a Certificate Authority infrastructure
In $valueMap you can define the following keys:
* caName (required - A name for this CA)
* caPasswd (required)
* force (0/1 default is 0)
Normaly you can only delete a CA if the CA certificate is expired or you have never signed a certificate with this CA. In all other cases you have to set the force parameter to 1 if you realy want to delete the CA and you know what you are doing.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { caName => 'My_CA', caPasswd => 'system, };
my $res = YaPI::CaManagement->DeleteCA($data); if( not defined $res ) { # error } else { print STDERR "OK\n"; }
$crlValueMap = ReadCRLDefaults($valueMap)
Read the default values for a CRL. In $valueMap you can define the following keys:
* caName (required)
Returns a map with defaults for CRLs in this CA. The return value is ``undef'' on an error.
On success the return value is a hash which can contain the following keys:
* days
* authorityKeyIdentifier
* issuerAltName
The syntax of these values are explained in the COMMON PARAMETER section.
EXAMPLE:
use Data::Dumper;
my $data = { 'caName' => 'My_CA' } $crlValueMap = YaPI::CaManagement->ReadCRLDefaults($data) if( not defined $crlValueMap ) { # error } else { print Data::Dumper->Dump([$crlValueMap])."\n"; }
$bool = WriteCRLDefaults($valueMap)
Write the default values for creating a CRL. Keys which are not present, will be removed if they are available in the configuration file except for the 'days' key.
In $valueMap you can define the following keys:
* caName (required)
* days
* authorityKeyIdentifier
* issuerAltName
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'days' => '7' }; my $res = YaPI::CaManagement->WriteCRLDefaults($data); if( not defined $res ) { # error } else { print "OK\n"; } }