Keytool on Janik von Rotz

Generate PEM key- and truststores With Puppet

Thu, 07 Mar 2019 10:23:04 +0100

This post is a follow-up of Generate pkcs12 key- and truststores with Puppet.
In this post we are going to create PEM key- and truststores with Puppet.

PEM files are base64 encoded X.509 certificates. Enclosed between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- multiple PEM files can be concatinated into key- and truststores. And that is exactly what we are going to do using a Puppet manifest.

For the example use case multiple certificate files are required. Using the commands from the Create a certificate authority and sign server certificates without prompting using openssl post the following files must be provided:

localhost_cert.pem
localhost_key.pem
example.com_cert.pem
ca_cert.pem

The certificates will be concatinated into the following stores:

webservice-keystore.pem
- localhost - private key entry
webservice-truststore.pem
- ca - trusted cert entry
custom-truststore.pem
- example.com - trusted cert entry
- ca - trusted cert entry

All the files are processed in /var/tmp/certificates.

The manifest file is defined as followed:

modules/certbox/manifests/init.pp

class certbox (

    String $host = 'localhost',
    String $cert_dir = '/var/tmp/certificates',

    String $server_ca_cert = "${cert_dir}/ca_cert.pem",
    String $server_cn = $host,
    String $server_cert = "${cert_dir}/${host}_cert.pem",
    String $server_key = "${cert_dir}/${host}_key.pem",
    String $server_key_pass = 'password',
    String $server_keystore = "${cert_dir}/webservice-keystore.pem",
    String $server_truststore = "${cert_dir}/webservice-truststore.pem",

    Array $custom_trust_entries = [
      {
        cn => 'example.com',
        cert => 'example.com_cert.pem'
      },
      {
        cn => 'ca',
        cert => 'ca_cert.pem'
      },
    ],
    String $custom_truststore = "${cert_dir}/custom-truststore.pem",

    String $owner = 'root',
    String $group = 'root',
    String $file_read_mode = 'a=,ug+r',

) {

  # component-wide defaulting of the exec path attribute
  Exec {
    path => ['/usr/bin', '/bin']
  }

  # create copy of sever cert, if file state changes notify keystore assemble task
  file { "${server_cert}.tmp":
    ensure => file,
    owner  => $owner,
    group  => $group,
    mode   => $file_read_mode,
    source => $server_cert,
    notify => Exec["certbox - create server keystore"],
  }

  # check if keystore file does not exist and notify creation task
  exec { "certbox - check if server keystore exists":
    onlyif => "test ! -f $server_keystore",
    command => 'echo "File does not exist."',
    notify => Exec["certbox - create server keystore"],
  }

  # create server keystore if temporary file state changed
  exec { "certbox - create server keystore":
    refreshonly => true,
    command     => "cat ${server_cert} > ${server_keystore}; cat ${server_key} >> ${server_keystore}",
  }

  # ensure server keystore file permissions
  file { $server_keystore:
    ensure => file,
    owner  => $owner,
    group  => $group,
    mode   => $file_read_mode,
  }

  file { "${server_ca_cert}.tmp":
    ensure => file,
    owner  => $owner,
    group  => $group,
    mode   => $file_read_mode,
    source => $server_ca_cert,
    notify => Exec["certbox - create server truststore"],
  }

  exec { "certbox - check if server truststore exists":
    onlyif => "test ! -f $server_truststore",
    command => 'echo "File does not exist."',
    notify => Exec["certbox - create server truststore"],
  }

  exec { "certbox - create server truststore":
    refreshonly => true,
    command     => "cat ${server_ca_cert} > ${server_truststore}",
  }

  file { $server_truststore:
    ensure => file,
    owner  => $owner,
    group  => $group,
    mode   => $file_read_mode,
    notify => Exec["certbox - create server truststore"],
  }

  # create copy for each ca truststore entry
  $custom_trust_entries.each | Integer $index, Hash $entry | {

    file { "${cert_dir}/${entry['cert']}.ca_trust.icam.tmp":
      ensure => file,
      owner  => $owner,
      group  => $group,
      mode   => $file_read_mode,
      source => "${cert_dir}/${entry['cert']}",
      notify => [
        Exec["certbox - cleanup ca truststore"],
        Exec["certbox - add pem ${entry['cn']} to ca truststore"]],
    }

    exec { "certbox - check if ca truststore for ${entry['cn']} exists":
      onlyif => "test ! -f $custom_truststore",
      command => 'echo "File does not exist."',
      notify => Exec["certbox - add pem ${entry['cn']} to ca truststore"],
    }
  }

  # reset ca truststore if temporary entry file state changed
  exec { "certbox - cleanup ca truststore":
    refreshonly => true,
    command     => "echo > ${custom_truststore}",
  }

  # add ca truststore entry if temporary entry file state changed
  $custom_trust_entries.each | Integer $index, Hash $entry | {

    exec { "certbox - add pem ${entry['cn']} to ca truststore":
      refreshonly => true,
      command     => "echo >> ${custom_truststore};cat ${cert_dir}/${entry['cert']} >> ${custom_truststore}",
    }
  }

  file { $custom_truststore:
    ensure  => file,
    owner   => $owner,
    group   => $group,
    mode    => $file_read_mode,
  }
}

This manifest checks if the source PEM files have changed or the target stores does not exist. If one of these cases apply the manifests creates the key- or truststore. Finally, it sets the file mode and ownership.

To apply the manifest with Puppet run the following command:

sudo puppet apply --modulepath=modules/ -e "include certbox"

To verify if the files have been assembled correctly use this keytool commands:

sudo keytool -printcert -file /var/tmp/certificates/custom-truststore.pem

Let me know if this post helped you to resolve a particular use case.

Generate pkcs12 key- and truststores with Puppet

Wed, 30 Jan 2019 11:16:52 +0100

In my last post I have showed how to generate pkcs12 key- and truststores using openssl and keytool.

For this post we assume that we want to automate the store assembling with Puppet. Puppet is a configuration management tool that shares many ideas with Ansible. In the world of Puppet you define a manifest file that describes a state of how a file, service or any type of resource should look like. Puppet applies these manifests and makes sure that the targeted system reaches the defined state.

Using Puppets exec resource we are going to define key- and truststores using openssl and keytool.

Our manifest assure that the stores are assembled as defined. Puppet will be able to detect deltas and act accordingly.

For our use-case we assume we have generate multiple certificates under /var/tmp/certificates:

localhost_cert.pem
localhost_key.pem
example.com_cert.pem
example.com_key.pem
ca_cert.pem

Our fictive webservice requires a key- and truststore containing the provided certificates and keys:

webservice-keystore.pkcs12
- ca - trusted cert entry
- localhost - private key entry
- example.com - private key entry
webservice-truststore.pkcs12
- ca - trusted cert entry

Puppet is installed on our system and we are ready to declare and apply our manifest file.

Our Puppet module will be called certbox. Modules must follow a strict naming and folder structure.

Below is a copy-and-paste definition for our Puppet module. Create the manifest file and folders as showed.

modules/certbox/manifests/init.pp

class certbox (

  String $certDir = "/var/tmp/certificates",

  String $caCert = "$certDir/ca_cert.pem",

  String $cn1 = "localhost",
  String $cert1 = "$certDir/${cn1}_cert.pem",
  String $key1 = "$certDir/${cn1}_key.pem",
  String $keyPassword1 = "password",

  String $cn2 = "example.com",
  String $tmpKeystore2 = "$certDir/$cn2.pkcs12",
  String $cert2 = "$certDir/${cn2}_cert.pem",
  String $key2 = "$certDir/${cn2}_key.pem",
  String $keyPassword2 = "password",

  String $keystore = "$certDir/webservice-keystore.pkcs12",
  String $truststore = "$certDir/webservice-truststore.pkcs12",
  String $keystorePassword = "password",
  String $truststorePassword = "password",

  String $owner = "root",
  String $group = "root",
  String $fileReadMode = "a=,ug+r",

) {

  exec { "remove keystore for $cn1 if password changed or is empty":
    onlyif => "/bin/keytool -list -storetype PKCS12 -keystore $keystore -storepass $keystorePass | grep 'password was incorrect\\|file exists, but is empty'",
    command => "/bin/rm $keystore1",
  }

  exec { "create pkcs12 keystore for $cn1":
    onlyif => "/bin/keytool -list -keystore $keystore -storepass $keystorePassword | grep $(openssl x509 -noout -fingerprint -sha1 -in $cert1 | cut -f2 -d \"=\");test $? -eq 1",
    command => "/bin/openssl pkcs12  -export -in $cert1 -inkey $key1 -passin pass:$keyPassword1 -certfile $caCert -out $keystore -passout pass:$keystorePassword -name $cn1",
  }

  exec { "remove keystore for $cn2 if password changed or is empty":
    onlyif => "/bin/keytool -list -storetype PKCS12 -keystore $tmpKeystore2 -storepass $keystorePass | grep 'password was incorrect\\|file exists, but is empty'",
    command => "/bin/rm $tmpKeystore2",
  }

  exec { "create pkcs12 keystore for $cn2":
    onlyif => "/bin/keytool -list -keystore $tmpKeystore2 -storepass $keystorePassword | grep $(openssl x509 -noout -fingerprint -sha1 -in $cert2 | cut -f2 -d \"=\");test $? -eq 1",
    command => "/bin/openssl pkcs12 -in $cert2 -inkey $key2 -passin pass:$keyPassword2 -export -out $tmpKeystore2 -passout pass:$keystorePassword -name $cn2",
  }

  exec { "merge $cn2 into $cn1 keystore":
    onlyif => "/bin/keytool -list -keystore $keystore -storepass $keystorePassword | grep $(openssl x509 -noout -fingerprint -sha1 -in $cert2 | cut -f2 -d \"=\");test $? -eq 1",
    command => "/bin/keytool -importkeystore -storetype PKCS12 -destkeystore $keystore -deststorepass $keystorePassword -destkeypass $keystorePassword \
      -srckeystore $tmpKeystore2 -srcstoretype PKCS12 -srcstorepass $keystorePassword -alias $cn2 -noprompt",
  }

  file { $keystore:
    ensure => file,
    owner => $owner,
    group => $group,
    mode => $fileReadMode,
  }

  exec { "remove truststore for $cn1 if password changed":
    onlyif => "/bin/keytool -list -storetype PKCS12 -keystore $truststore -storepass $truststorePass | grep 'password was incorrect'",
    command => "/bin/rm $truststore",
  }

  exec { "create pkcs12 truststore":
    onlyif => "/bin/keytool -list -keystore $truststore -storepass $truststorePassword | grep $(openssl x509 -noout -fingerprint -sha1 -in $caCert | cut -f2 -d \"=\");test $? -eq 1",
    command => "/bin/keytool -importcert -storetype PKCS12 -keystore $truststore -storepass $truststorePassword -alias ca -file $caCert -noprompt",
  }

  file { $truststore:
    ensure => file,
    owner => $owner,
    group => $group,
    mode => $fileReadMode,
  }
}

Edit 1: Compare sha1 of cert to assert if import should be executed.
Edit 2: On create keystore check not if store file already exist, but check if cert in keystore matches the sha1. The check should also act as expected if file does not exist.
Edit 3: Remove the create empty truststore task. If the truststore file does not exist, the keytool import command will create the file.
Edit 4: Added exec task that remove the store file if the password has changed.

The manifest is kept fairly simple. However, you might ask why we have to merge our second certificate from a pkcs12 store. The answer is a bit more complicated. The openssl and keytool utilities help generating and managing key material. They provide similar tasks, but differ heavy in specific features. Here are the most important differences:

Openssl cannot manipulate existing pkcs12 stores.
Openssl cannot create pkcs12 with multiple certificates and keys.
Keytool cannot import certificates and keys into an existing pkcs12 store, however, it can import a pkcs12 store into an existing one.
Keytool cannot create pkcs12 stores from a certificate and key.

Hope this helps to understand the design decisions made here much better.

To apply the manifest with Puppet run the following command:

sudo puppet apply --modulepath=modules/ -e "include certbox"

At this point Puppet should create the key- and truststores.

If you ended up with an error or faced some other issues let me know!

Create pkcs12 key- and truststore with keytool and openssl

Tue, 22 Jan 2019 14:05:15 +0100

In my last post I’ve showed you how to create a custom certificate authority and sign a server cert using openssl without user interaction.

For this post I assume that we want to set up a webservice that requires a pkcs12 keystore. Using openssl and the java keytool we are going to create a pkcs12 store and add our ca cert, server cert and server key. Further, we assume that the application also requires a truststore containing the ca cert only.

Make sure to walk through the last post before getting started.

Configure new environment variables.

APPLICATION_NAME=webservice
KEYSTORE_PASSWORD=password
TRUSTSTORE_PASSWORD=password
SERVER_CERT_PASSWORD=password
SERVER_CERT_CN=localhost

Create the pkcs12 store containing the server cert and the ca trust.

openssl pkcs12 -in ${SERVER_CERT_CN}_cert.pem -inkey ${SERVER_CERT_CN}_key.pem -passin pass:$SERVER_CERT_PASSWORD -certfile ca_cert.pem \
  -export -out ${APPLICATION_NAME}_${SERVER_CERT_CN}-keystore.pkcs12 -passout pass:$KEYSTORE_PASSWORD -name $SERVER_CERT_CN

Show the content of keystore.

keytool -list -storetype PKCS12 -keystore $APPLICATION_NAME-keystore.pkcs12 \
  -storepass $KEYSTORE_PASSWORD

Openssl cannot create a pkcs12 store from cert without key. This is why we create the truststore with the keytool.

Create a pkcs12 truststore containing the ca cert.

keytool -importcert -storetype PKCS12 -keystore $APPLICATION_NAME-truststore.pkcs12 \
  -storepass $TRUSTSTORE_PASSWORD -alias ca -file ca_cert.pem -noprompt

Show the content of the truststore.

keytool -list -storetype PKCS12 -keystore $APPLICATION_NAME-truststore.pkcs12 \
  -storepass $TRUSTSTORE_PASSWORD

Edit 1: Removed keystore ca import step. The openssl certfile parameter accepts a bundled .pem containing trusted certs.
Edit 2: Removed the create empty truststore step. Keytool will create the truststore file if it does not exist.

Not sure if it is a bug that openssl cannot create pkcs12 stores from certs without keys. Nonetheless, the two step workflow is a convenient solution. Openssl creates the initial pkcs12 store and the keytool manipulates the store as required.

Note: It seems you cannot import a certificate and its key with keytool. So you need to create the store with openssl in order to import the key.

Source: Stackoverflow - How to import an existing x509 certificate and private key in Java keystore to use in SSL?

Create a certificate authority and sign server certificates without prompting using openssl

Mon, 21 Jan 2019 16:20:35 +0100

Most of the times people want to get a certificate for the hostname localhost, let’s encrypt wrote a nice post about this, but sometimes people want a certificate for any hostname. And further, signed by a custom CA and if possible should the key material be generated without user interaction. In this post I have covered the less likely case.

Below you’ll find a list of bash commands. You can copy and paste all of them into a bash script or run each command at a time in the shell.

Set environment variables for key material configuration.

CA_CERT_PASSWORD=password
SERVER_CERT_PASSWORD=password
SERVER_CERT_CN=localhost
SERVER_ALT_NAME=localhost

Create the CA key.

openssl genrsa -des3 -passout pass:$CA_CERT_PASSWORD -out ca_key.pem 4096

Create the CA certificate.

openssl req -x509 -new -nodes -key ca_key.pem -passin pass:$CA_CERT_PASSWORD -sha256 -days 1825 -out ca_cert.pem \
  -subj "/C=CH/ST=Bern/L=Bern/O=AdNovum AG/CN=ca"

Create the server key.

openssl genrsa -des3 -passout pass:$SERVER_CERT_PASSWORD -out ${SERVER_CERT_CN}_key.pem 2048

Create the server certificate signing request.

openssl req -new -key ${SERVER_CERT_CN}_key.pem -passin pass:$SERVER_CERT_PASSWORD -out ${SERVER_CERT_CN}.csr \
  -subj "/CN=$SERVER_CERT_CN"

Create server certificate extension configuration.

cat > ./${SERVER_CERT_CN}.cnf <<EOT
authorityKeyIdentifier=keyid,issuer
keyUsage=digitalSignature
extendedKeyUsage=serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = $SERVER_ALT_NAME
EOT

Sign the server certificate signing request.

openssl x509 -req -in ${SERVER_CERT_CN}.csr -CA ca_cert.pem -CAkey ca_key.pem -passin pass:$CA_CERT_PASSWORD -CAcreateserial \
  -out ${SERVER_CERT_CN}_cert.pem -days 1825 -sha256 -extfile ${SERVER_CERT_CN}.cnf

To create additional server certificates use the snippet below.

CA_CERT_PASSWORD=password
SERVER_CERT_PASSWORD=password
SERVER_CERT_CN=hostname
SERVER_ALT_NAME=hostname

openssl genrsa -des3 -passout pass:$SERVER_CERT_PASSWORD -out ${SERVER_CERT_CN}_key.pem 2048
  
openssl req -new -key ${SERVER_CERT_CN}_key.pem -passin pass:$SERVER_CERT_PASSWORD -out ${SERVER_CERT_CN}.csr \
  -subj "/CN=$SERVER_CERT_CN"
  
cat > ./${SERVER_CERT_CN}.cnf <<EOT
authorityKeyIdentifier=keyid,issuer
keyUsage=digitalSignature
extendedKeyUsage=serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = $SERVER_ALT_NAME
EOT
 
openssl x509 -req -in ${SERVER_CERT_CN}.csr -CA ca_cert.pem -CAkey ca_key.pem -passin pass:$CA_CERT_PASSWORD -CAcreateserial \
  -out ${SERVER_CERT_CN}_cert.pem -days 1825 -sha256 -extfile ${SERVER_CERT_CN}.cnf