mc_ssl / ssl registry¶

If you alter this module and want to test it, do not forget to deploy it on minion using:

salt '*' saltutil.sync_modules

Documentation of this module is available with:

salt '*' sys.doc mc_ssl

mc_states.modules.mc_ssl.ca_ssl_certs(domains, **kwargs)¶: Wrapper to ssl_certs to also return the cacert information Return a triple (ert, key, ca) if ca is none: ca==’‘

mc_states.modules.mc_ssl.domain_match(domain, cert_domain, wildcard_match=False)¶

Test if a domain exactly match other domain the other domain can be a wildcard, and this only match top level wildcards as per openssl spec

>>> from mc_states.modules.mc_ssl import domain_match
>>> domain_match('a.com', 'a.com')
True
>>> domain_match('a.a.com', '*.a.com')
True
>>> domain_match('a.a.a.com', '*.a.com')
False
>>> domain_match('aaa.a.com', '*.a.com')
True
>>> domain_match('a', '*')
False
>>> domain_match('a.a', '*.a')
False
>>> domain_match('a.com', '*.a.com')
True
>>> domain_match('a.com', '*.a.a.com')
False

mc_states.modules.mc_ssl.domain_match_wildcard(domain, wildcard_or_domain)¶

Test if a common name matches a wild card

>>> from mc_states.modules.mc_ssl \
...     import domain_match_wildcard as match_wildcard
>>> match_wildcard('foo.dom.net', '*.foo.dom.net')
True
>>> match_wildcard('www.foo.dom.net', '*.foo.dom.net')
True
>>> match_wildcard('foo.dom.net', 'foo.dom.net')
True
>>> match_wildcard('www.foo.dom.net', 'foo.dom.net')
True
>>> match_wildcard('dom.net', '*.dom.net')
True
>>> match_wildcard('www.dom.net', '*.dom.net')
True
>>> match_wildcard('dom.net', 'dom.net')
True
>>> match_wildcard('www.dom.net', 'dom.net')
True

mc_states.modules.mc_ssl.get_cert_for(domain, gen=False, domain_csr_data=None)¶

Generate or return certificate for domain

The certificates are stored inside <pillar_root>/cloud-controller/ssl

Search order precedence:

./custom/<subdomain>.<domain>.<tld>

wildcard certificate: ./custom/*.<domain>.<tld>

signed by the controller: ./<cloudctlr>/certs/*.<domain>.<tld>

signed by the controller: ./<cloudctlr>/certs/<sub>.<domain>.<tld>

mc_states.modules.mc_ssl.get_configured_cert(domain, gen=False, ttl=60)¶: Return any configured ssl cert for domain or the wildward domain matching the precise domain. It will prefer to use any real signed certificate over a self signed certificate

mc_states.modules.mc_ssl.get_custom_cert_for(domain)¶

Seach for certificate and key file inside pillar folder

pillarroot/cloud-controller/ssl/custom:

<domain>.key

contain private ,key

<domain>.crt

contain cert

<domain>.auth.crt

contain auth chain

<domain>.bundle.crt

<generated if not present> contain cert + auth chain

<domain>.full.crt

<generated if not present> contain cert + auth chain + key

mc_states.modules.mc_ssl.get_installed_cert_for(domain)¶

Seach for certificate and key file inside pillar folder

pillarroot/cloud-controller/ssl/custom:

<domain>.key

contain private ,key

<domain>.crt

contain cert

<domain>.auth.crt

contain auth chain

<domain>.bundle.crt

<generated if not present> contain cert + auth chain

<domain>.full.crt

<generated if not present> contain cert + auth chain + key

mc_states.modules.mc_ssl.get_selfsigned_cert_for(domain, gen=False, domain_csr_data=None)¶

Generate or return certificate for domain

The certificates are stored inside <pillar_root>/cloud-controller/ssl

Search precedence:

./custom/<subdomain>.<domain>.<tld>

wildcard certificate: ./custom/*.<domain>.<tld>

selfsigned: ./selfsigned/certs/*.<domain>.<tld>

selfsigned: ./selfsigned/certs/<subdomain>.<domain>.<tld>

mc_states.modules.mc_ssl.load_certs(path)¶

Load certificates from a directory (certs must be suffixed with .crt) return 2 dictionnary:

one contains certs with common name as indexes

one contains certs with subjectaltnames as indexes

mc_states.modules.mc_ssl.load_selfsigned_certs(path)¶

Load certificates from a directory (certs must be suffixed with .crt) return 2 dictionnary:

one contains certs with common name as indexes

one contains certs with subjectaltnames as indexes

mc_states.modules.mc_ssl.search_matching_certificate(domain, as_text=False, selfsigned=True)¶: Search in the pillar certificate directory the certificate belonging to a particular domain

mc_states.modules.mc_ssl.search_matching_selfsigned_certificate(domain, gen=False, as_text=False)¶: Search in the pillar certificate directory the certificate belonging to a particular domain

mc_states.modules.mc_ssl.selfsigned_last(ctuple)¶: Certificate tuple containing in first element the text of the PEM certificate

mc_states.modules.mc_ssl.selfsigned_ssl_certs(domains, gen=False, as_text=False)¶: Maybe Generate and Return SSL certificate and key paths for domain Certicates are generated inside pillar/cloudcontroller/<minionid>. this generates a signed certificate with a generated certificate authority with the name of the current minion.

mc_states.modules.mc_ssl.settings()¶

ssl registry

country

country

st

st

l

l

o

organization

cn

common name

email

mail

certs

mapping of COMMON_NAME: (cert_text, key_text, cacert_chain_txt)

cert_text and cacert_chain_txt contain x509 certs, concatenated

chain_txt is an empty string if selfsigned or not found

key we will validated to be a valid private key

all certs will be validated to be x509 certs

mc_states.modules.mc_ssl.ssl_certs(domains, **kw)¶

Maybe Generate and Return SSL certificate and key paths for domain Certicates are generated inside pillar/cloudcontroller/<minionid>. this generates a signed certificate with a generated certificate authority with the name of the current minion.

Return a xtuple (cert, key) Cert can contain multiple certs (full chain of certification)

mc_states.modules.mc_ssl.ssl_chain(common_name, cert_string)¶

Extract the cerfificate and auth chain for a certificate file or string containing one or multiple certificates

Return a tuble:

The certificate maching the common name If not found, assume the first of the given certs

The rest of certificates as the ssl chain authentication

mc_states.modules.mc_ssl.ssl_infos(cert_text, **kw)¶

Get some infos out of a PEM certificates kw can contain default values

issuer

cert issuer

subject

cert subject

mc_states.modules.mc_ssl.ssl_key(cert_string)¶: Extract valid ssl keys from a string or a file & return the first

mc_states.modules.mc_ssl.ssl_keys(cert_string)¶: Extract valid ssl keys from a string or a file