Set keyUsage for generated HTTP certificates and self-signed CA (#126376)
#126448
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…astic#126376) The `elasticsearch-certutil http` command, and security auto-configuration, generate the HTTP certificate and CA without setting the `keyUsage` extension. This PR fixes this by setting (by default): - `keyCertSign` and `cRLSign` for self-signed CAs - `digitalSignature` and `keyEncipherment` for HTTP certificates and CSRs These defaults can be overridden when running `elasticsearch-certutil http` command. The user will be prompted to change them as they wish. For `elasticsearch-certutil ca`, the default value can be overridden by passing the `--keysage` option, e.g. ``` elasticsearch-certutil ca --keyusage "digitalSignature,keyCertSign,cRLSign" -pem ``` Fixes elastic#117769 (cherry picked from commit 284121a) # Conflicts: # docs/reference/elasticsearch/command-line-tools/certutil.md
|
Documentation preview: |
slobodanadamovic
added
the
auto-merge-without-approval
slobodanadamovic
added
>bug
:Security/TLS
slobodanadamovic
added
auto-backport
slobodanadamovic
changed the title
keyUsage for generated HTTP certificates and self-signed CA (#126376)keyUsage for generated HTTP certificates and self-signed CA (#126376)
slobodanadamovic
added a commit
to slobodanadamovic/elasticsearch
that referenced
this pull request
Apr 8, 2025
…astic#126376) (elastic#126448) * Set `keyUsage` for generated HTTP certificates and self-signed CA (elastic#126376) The `elasticsearch-certutil http` command, and security auto-configuration, generate the HTTP certificate and CA without setting the `keyUsage` extension. This PR fixes this by setting (by default): - `keyCertSign` and `cRLSign` for self-signed CAs - `digitalSignature` and `keyEncipherment` for HTTP certificates and CSRs These defaults can be overridden when running `elasticsearch-certutil http` command. The user will be prompted to change them as they wish. For `elasticsearch-certutil ca`, the default value can be overridden by passing the `--keysage` option, e.g. ``` elasticsearch-certutil ca --keyusage "digitalSignature,keyCertSign,cRLSign" -pem ``` Fixes elastic#117769 (cherry picked from commit 284121a) # Conflicts: # docs/reference/elasticsearch/command-line-tools/certutil.md * fix compilation error * [CI] Auto commit changes from spotless * fix failing test --------- Co-authored-by: elasticsearchmachine <[email protected]>
slobodanadamovic
added a commit
to slobodanadamovic/elasticsearch
that referenced
this pull request
Apr 8, 2025
…astic#126376) (elastic#126448) * Set `keyUsage` for generated HTTP certificates and self-signed CA (elastic#126376) The `elasticsearch-certutil http` command, and security auto-configuration, generate the HTTP certificate and CA without setting the `keyUsage` extension. This PR fixes this by setting (by default): - `keyCertSign` and `cRLSign` for self-signed CAs - `digitalSignature` and `keyEncipherment` for HTTP certificates and CSRs These defaults can be overridden when running `elasticsearch-certutil http` command. The user will be prompted to change them as they wish. For `elasticsearch-certutil ca`, the default value can be overridden by passing the `--keysage` option, e.g. ``` elasticsearch-certutil ca --keyusage "digitalSignature,keyCertSign,cRLSign" -pem ``` Fixes elastic#117769 (cherry picked from commit 284121a) # Conflicts: # docs/reference/elasticsearch/command-line-tools/certutil.md * fix compilation error * [CI] Auto commit changes from spotless * fix failing test --------- Co-authored-by: elasticsearchmachine <[email protected]>
elasticsearchmachine
pushed a commit
that referenced
this pull request
Apr 8, 2025
…26376) (#126448) (#126454) * Set `keyUsage` for generated HTTP certificates and self-signed CA (#126376) The `elasticsearch-certutil http` command, and security auto-configuration, generate the HTTP certificate and CA without setting the `keyUsage` extension. This PR fixes this by setting (by default): - `keyCertSign` and `cRLSign` for self-signed CAs - `digitalSignature` and `keyEncipherment` for HTTP certificates and CSRs These defaults can be overridden when running `elasticsearch-certutil http` command. The user will be prompted to change them as they wish. For `elasticsearch-certutil ca`, the default value can be overridden by passing the `--keysage` option, e.g. ``` elasticsearch-certutil ca --keyusage "digitalSignature,keyCertSign,cRLSign" -pem ``` Fixes #117769 (cherry picked from commit 284121a) # Conflicts: # docs/reference/elasticsearch/command-line-tools/certutil.md * fix compilation error * [CI] Auto commit changes from spotless * fix failing test --------- Co-authored-by: elasticsearchmachine <[email protected]>
elasticsearchmachine
pushed a commit
that referenced
this pull request
Apr 8, 2025
…26376) (#126448) (#126453) * Set `keyUsage` for generated HTTP certificates and self-signed CA (#126376) The `elasticsearch-certutil http` command, and security auto-configuration, generate the HTTP certificate and CA without setting the `keyUsage` extension. This PR fixes this by setting (by default): - `keyCertSign` and `cRLSign` for self-signed CAs - `digitalSignature` and `keyEncipherment` for HTTP certificates and CSRs These defaults can be overridden when running `elasticsearch-certutil http` command. The user will be prompted to change them as they wish. For `elasticsearch-certutil ca`, the default value can be overridden by passing the `--keysage` option, e.g. ``` elasticsearch-certutil ca --keyusage "digitalSignature,keyCertSign,cRLSign" -pem ``` Fixes #117769 (cherry picked from commit 284121a) # Conflicts: # docs/reference/elasticsearch/command-line-tools/certutil.md * fix compilation error * [CI] Auto commit changes from spotless * fix failing test --------- Co-authored-by: elasticsearchmachine <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport
This will backport the following commits from
mainto8.17:keyUsagefor generated HTTP certificates and self-signed CA (#126376)Questions ?
Please refer to the Backport tool documentation