Pretty cool, but there are a couple injection vulnerabilities when you make the cert.
Yes, I haven't enforced proper security yet. Proper throttling handling should be added too. Will add. Thanks!
My weekend project - Create a self-signed SSL certificate instantly and for free
11–14 of 14 posts
Re: My weekend project - Create a self-signed SSL certificate instantly and for free
#12I just sent an security issue (via github).
Got it, thank a lot.
Re: My weekend project - Create a self-signed SSL certificate instantly and for free
#13as I stated the last time a site like this appeared on the front page: the third party running the site has your private key, so they can decrypt everything
are two openssl commands really that hard?
(yes it's a self signed cert, but it's still a bad idea)
Re: My weekend project - Create a self-signed SSL certificate instantly and for free
#14you could also integrate the paid verified ssl's into this. I remember generating it from godaddy was a pain.. by the way nice work.
Thanks. I'll have to integrate with trusted CAs for this. Will check this out.
Wait... you're not using the browser's SSL engine, as far as I can tell? So you have copy of the secret key? Please, do not integrate directly, the way your server is set up now.
That said, it's a nice GUI(WUI?) for generating the needed openssl.conf-parameters -- so I'm sure you could offer to download that or something, along with copy-paste tools for the need openssl-stuff (openssl -config genrsa... etc).
Also, while you need to do your own req, I find http://CAcert.org actually is great for my use of private/personal/etc certs.
I actually use a script along the lines of:
#!/usr/bin/env bash
# Helper script for generating ssl keys/reqs
#Set the variables used for the script
#Expands filenames and paths
function expand_vars
{
stamp=$(date +%d%m%Y)
prefix=.
conf=$prefix/conf/$host.conf
key=$prefix/private/$host-$stamp.key
csr=$prefix/csr/$host-$stamp.csr
}
#Print usage help
function usage
{
cat
Generate new key and csr for
Files:
$conf
$key
$csr
eof
}
if [[ $# -ne 1 ]]
then
#Set host to a format that lends itself for the usage()-text
host=""
expand_vars
usage
exit 1
fi
host="$1"
expand_vars
if [[ ! -r $conf ]]
then
echo "Cannot read config file $conf"
echo "Please make a symlink in ./conf to $conf"
exit 1
fi
for f in $key $csr
do
if [[ -a $f ]]
then
echo "$f exist! Please move/delete before attempting to generate new cert"
exit 1
fi
done
echo "Warning: Generating *new* key -- manually create cert if this is not what you want!"
openssl req -config $conf -keyout $key -new -out $csr
Along with a config file of the form:
#This is in conf/example.com.conf
[ req ]
default_bits = 4096
prompt = no
encrypt_key = yes
default_md = sha1
distinguished_name = dn
utf-8 = yes
[ dn ]
C = EX #Company code
O = Organization Name
CN = example.com
ST = State
L = City
emailAddress=you@example.com