Skip to content

Commit 3694d61

Browse files
jkroepkejkroepke
committed
Added support for elliptic curve keys
1 parent d5698a8 commit 3694d61

File tree

8 files changed

+348
-30
lines changed

8 files changed

+348
-30
lines changed

‎REFERENCE.md‎

Lines changed: 65 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -244,9 +244,12 @@ The following parameters are available in the `openvpn::ca` defined type:
244244
* [`email`](#email)
245245
* [`common_name`](#common_name)
246246
* [`group`](#group)
247+
* [`ssl_key_algo`](#ssl_key_algo)
247248
* [`ssl_key_size`](#ssl_key_size)
249+
* [`ssl_key_curve`](#ssl_key_curve)
248250
* [`key_expire`](#key_expire)
249251
* [`ca_expire`](#ca_expire)
252+
* [`digest`](#digest)
250253
* [`key_name`](#key_name)
251254
* [`key_ou`](#key_ou)
252255
* [`key_cn`](#key_cn)
@@ -310,14 +313,30 @@ User to drop privileges to after startup
310313

311314
Default value: ``undef``
312315

316+
##### <a name="ssl_key_algo"></a>`ssl_key_algo`
317+
318+
Data type: `Enum['rsa', 'ec', 'ed']`
319+
320+
SSL Key Algo. ec can enable elliptic curve support. ed uses ed25519 keys
321+
322+
Default value: `'rsa'`
323+
313324
##### <a name="ssl_key_size"></a>`ssl_key_size`
314325

315326
Data type: `Integer`
316327

317-
Length of SSL keys (in bits) generated by this module.
328+
Length of SSL keys (in bits) generated by this module, used if ssl_key_algo is rsa
318329

319330
Default value: `2048`
320331

332+
##### <a name="ssl_key_curve"></a>`ssl_key_curve`
333+
334+
Data type: `String`
335+
336+
Define the named curve for the ssl keys, used if ssl_key_algo is ec, ed
337+
338+
Default value: `'secp384r1'`
339+
321340
##### <a name="key_expire"></a>`key_expire`
322341

323342
Data type: `Integer`
@@ -334,6 +353,14 @@ The number of days to certify the CA certificate for
334353

335354
Default value: `3650`
336355

356+
##### <a name="digest"></a>`digest`
357+
358+
Data type: `Enum['md5','sha1','sha256','sha224','sha384','sha512']`
359+
360+
Cryptographic digest to use
361+
362+
Default value: `'sha512'`
363+
337364
##### <a name="key_name"></a>`key_name`
338365

339366
Data type: `Optional[String]`
@@ -938,7 +965,10 @@ The following parameters are available in the `openvpn::server` defined type:
938965
* [`route`](#route)
939966
* [`route_ipv6`](#route_ipv6)
940967
* [`keepalive`](#keepalive)
968+
* [`ssl_key_algo`](#ssl_key_algo)
941969
* [`ssl_key_size`](#ssl_key_size)
970+
* [`ssl_key_curve`](#ssl_key_curve)
971+
* [`ecdh_curve`](#ecdh_curve)
942972
* [`topology`](#topology)
943973
* [`c2c`](#c2c)
944974
* [`tcp_nodelay`](#tcp_nodelay)
@@ -976,6 +1006,7 @@ The following parameters are available in the `openvpn::server` defined type:
9761006
* [`persist_tun`](#persist_tun)
9771007
* [`key_expire`](#key_expire)
9781008
* [`crl_days`](#crl_days)
1009+
* [`digest`](#digest)
9791010
* [`ca_expire`](#ca_expire)
9801011
* [`key_name`](#key_name)
9811012
* [`key_ou`](#key_ou)
@@ -1264,14 +1295,38 @@ Add keepalive directive (ping and ping-restart) to server. Should match the form
12641295

12651296
Default value: ``undef``
12661297

1298+
##### <a name="ssl_key_algo"></a>`ssl_key_algo`
1299+
1300+
Data type: `Enum['rsa', 'ec', 'ed']`
1301+
1302+
SSL Key Algo. ec can enable elliptic curve support. ed uses ed25519 keys
1303+
1304+
Default value: `'rsa'`
1305+
12671306
##### <a name="ssl_key_size"></a>`ssl_key_size`
12681307

12691308
Data type: `Integer`
12701309

1271-
Length of SSL keys (in bits) generated by this module.
1310+
Length of SSL keys (in bits) generated by this module, used if ssl_key_algo is rsa
12721311

12731312
Default value: `2048`
12741313

1314+
##### <a name="ssl_key_curve"></a>`ssl_key_curve`
1315+
1316+
Data type: `String`
1317+
1318+
Define the named curve for the ssl keys, used if ssl_key_algo is ec, ed
1319+
1320+
Default value: `'secp384r1'`
1321+
1322+
##### <a name="ecdh_curve"></a>`ecdh_curve`
1323+
1324+
Data type: `String`
1325+
1326+
Define the named curve for ECDH key exchange, used if ssl_key_algo is ec, ed
1327+
1328+
Default value: `'secp384r1'`
1329+
12751330
##### <a name="topology"></a>`topology`
12761331

12771332
Data type: `String`
@@ -1568,6 +1623,14 @@ The number of days the client revocation list will be valid for after generating
15681623

15691624
Default value: `30`
15701625

1626+
##### <a name="digest"></a>`digest`
1627+
1628+
Data type: `Enum['md5','sha1','sha256','sha224','sha384','sha512']`
1629+
1630+
Cryptographic digest to use
1631+
1632+
Default value: `'sha512'`
1633+
15711634
##### <a name="ca_expire"></a>`ca_expire`
15721635

15731636
Data type: `Integer`

‎manifests/ca.pp‎

Lines changed: 39 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,12 @@
77
# @param email Email address to be used for the SSL certificate
88
# @param common_name Common name to be used for the SSL certificate
99
# @param group User to drop privileges to after startup
10-
# @param ssl_key_size Length of SSL keys (in bits) generated by this module.
10+
# @param ssl_key_algo SSL Key Algo. ec can enable elliptic curve support. ed uses ed25519 keys
11+
# @param ssl_key_size Length of SSL keys (in bits) generated by this module, used if ssl_key_algo is rsa
12+
# @param ssl_key_curve Define the named curve for the ssl keys, used if ssl_key_algo is ec, ed
1113
# @param key_expire The number of days to certify the server certificate for
1214
# @param ca_expire The number of days to certify the CA certificate for
15+
# @param digest Cryptographic digest to use
1316
# @param key_name Value for name_default variable in openssl.cnf and KEY_NAME in vars
1417
# @param key_ou Value for organizationalUnitName_default variable in openssl.cnf and KEY_OU in vars
1518
# @param key_cn Value for commonName_default variable in openssl.cnf and KEY_CN in vars
@@ -23,22 +26,25 @@
2326
# }
2427
#
2528
define openvpn::ca (
26-
Optional[String] $country = undef,
27-
Optional[String] $province = undef,
28-
Optional[String] $city = undef,
29-
Optional[String] $organization = undef,
30-
Optional[String] $email = undef,
31-
String $common_name = 'server',
32-
Optional[String] $group = undef,
33-
Integer $ssl_key_size = 2048,
34-
Integer $ca_expire = 3650,
35-
Integer $key_expire = 3650,
36-
Integer $crl_days = 30,
37-
Optional[String] $key_cn = undef,
38-
Optional[String] $key_name = undef,
39-
Optional[String] $key_ou = undef,
40-
Boolean $tls_auth = false,
41-
Boolean $tls_static_key = false,
29+
Optional[String] $country = undef,
30+
Optional[String] $province = undef,
31+
Optional[String] $city = undef,
32+
Optional[String] $organization = undef,
33+
Optional[String] $email = undef,
34+
String $common_name = 'server',
35+
Optional[String] $group = undef,
36+
Enum['rsa', 'ec', 'ed'] $ssl_key_algo = 'rsa',
37+
Integer $ssl_key_size = 2048,
38+
String $ssl_key_curve = 'secp384r1',
39+
Integer $ca_expire = 3650,
40+
Integer $key_expire = 3650,
41+
Integer $crl_days = 30,
42+
Enum['md5','sha1','sha256','sha224','sha384','sha512'] $digest = 'sha512',
43+
Optional[String] $key_cn = undef,
44+
Optional[String] $key_name = undef,
45+
Optional[String] $key_ou = undef,
46+
Boolean $tls_auth = false,
47+
Boolean $tls_static_key = false,
4248
) {
4349
if $tls_auth {
4450
warning('Parameter $tls_auth is deprecated. Use $tls_static_key instead.')
@@ -80,6 +86,10 @@
8086

8187
case $openvpn::easyrsa_version {
8288
'2.0': {
89+
if $ssl_key_algo != 'rsa' {
90+
fail('easy-rsa 2.0 supports only rsa keys.')
91+
}
92+
8393
file { "${server_directory}/${name}/easy-rsa/vars":
8494
ensure => file,
8595
mode => '0550',
@@ -136,10 +146,13 @@
136146
{
137147
'server_directory' => $server_directory,
138148
'openvpn_server' => $name,
149+
'ssl_key_algo' => $ssl_key_algo,
150+
'ssl_key_curve' => $ssl_key_curve,
139151
'ssl_key_size' => $ssl_key_size,
140152
'ca_expire' => $ca_expire,
141153
'key_expire' => $key_expire,
142154
'crl_days' => $crl_days,
155+
'digest' => $digest,
143156
'country' => $country,
144157
'province' => $province,
145158
'city' => $city,
@@ -168,13 +181,15 @@
168181
require => File["${server_directory}/${name}/easy-rsa/vars"],
169182
}
170183

171-
exec { "generate dh param ${name}":
172-
command => './easyrsa --batch gen-dh',
173-
timeout => 20000,
174-
cwd => "${server_directory}/${name}/easy-rsa",
175-
creates => "${server_directory}/${name}/easy-rsa/keys/dh.pem",
176-
provider => 'shell',
177-
require => Exec["generate server cert ${name}"],
184+
if ($ssl_key_algo == 'rsa') {
185+
exec { "generate dh param ${name}":
186+
command => './easyrsa --batch gen-dh',
187+
timeout => 20000,
188+
cwd => "${server_directory}/${name}/easy-rsa",
189+
creates => "${server_directory}/${name}/easy-rsa/keys/dh.pem",
190+
provider => 'shell',
191+
require => Exec["generate server cert ${name}"],
192+
}
178193
}
179194

180195
exec { "generate server cert ${name}":

‎manifests/server.pp‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,10 @@
3333
# @param route Add route to routing table after connection is established. Multiple routes can be specified.
3434
# @param route_ipv6 Add IPv6 route to routing table after connection is established. Multiple routes can be specified.
3535
# @param keepalive Add keepalive directive (ping and ping-restart) to server. Should match the form "n m".
36-
# @param ssl_key_size Length of SSL keys (in bits) generated by this module.
36+
# @param ssl_key_algo SSL Key Algo. ec can enable elliptic curve support. ed uses ed25519 keys
37+
# @param ssl_key_size Length of SSL keys (in bits) generated by this module, used if ssl_key_algo is rsa
38+
# @param ssl_key_curve Define the named curve for the ssl keys, used if ssl_key_algo is ec, ed
39+
# @param ecdh_curve Define the named curve for ECDH key exchange, used if ssl_key_algo is ec, ed
3740
# @param topology Define the network topology type
3841
# @param c2c Enable client to client visibility
3942
# @param tcp_nodelay Enable/Disable.
@@ -71,6 +74,7 @@
7174
# @param persist_tun Try to retain access to resources that may be unavailable because of privilege downgrades
7275
# @param key_expire The number of days to certify the server certificate for
7376
# @param crl_days The number of days the client revocation list will be valid for after generating
77+
# @param digest Cryptographic digest to use
7478
# @param ca_expire The number of days to certify the CA certificate for
7579
# @param key_name Value for name_default variable in openssl.cnf and KEY_NAME in vars
7680
# @param key_ou Value for organizationalUnitName_default variable in openssl.cnf and KEY_OU in vars
@@ -175,7 +179,10 @@
175179
Array $route_ipv6 = [],
176180
Optional[String[1]] $keepalive = undef,
177181
Variant[Boolean, Integer] $fragment = false,
182+
Enum['rsa', 'ec', 'ed'] $ssl_key_algo = 'rsa',
178183
Integer $ssl_key_size = 2048,
184+
String $ssl_key_curve = 'secp384r1',
185+
String $ecdh_curve = 'secp384r1',
179186
String $topology = 'net30',
180187
Boolean $c2c = false,
181188
Boolean $tcp_nodelay = false,
@@ -209,6 +216,7 @@
209216
Integer $ca_expire = 3650,
210217
Integer $key_expire = 3650,
211218
Integer[1] $crl_days = 30,
219+
Enum['md5','sha1','sha256','sha224','sha384','sha512'] $digest = 'sha512',
212220
Optional[String] $key_cn = undef,
213221
Optional[String] $key_name = undef,
214222
Optional[String] $key_ou = undef,
@@ -365,10 +373,13 @@
365373
email => $email,
366374
common_name => $common_name,
367375
group => $group,
376+
ssl_key_algo => $ssl_key_algo,
368377
ssl_key_size => $ssl_key_size,
378+
ssl_key_curve => $ssl_key_curve,
369379
ca_expire => $ca_expire,
370380
key_expire => $key_expire,
371381
crl_days => $crl_days,
382+
digest => $digest,
372383
key_cn => $key_cn,
373384
key_name => $key_name,
374385
key_ou => $key_ou,

0 commit comments

Comments
 (0)