Knowledge Base (Posts about openssl)

asn1parse and underscores

bgstack15 — Mon, 02 Sep 2024 13:08:00 GMT

If you are building a CSR that includes the oid for a Microsoft Certificate Services template name, and that name includes an underscore, you might get an error when building a csr.

Error checking request extension section req_ext
00CCADFE01000000:error:0680007C:asn1 encoding routines:ASN1_mbstring_ncopy:illegal characters:crypto/asn1/a_mbstr.c:113:
00CCADFE01000000:error:0688000D:asn1 encoding routines:asn1_str2type:ASN1 lib:crypto/asn1/asn1_gen.c:681:string=ABC_NAME_TESTING
00CCADFE01000000:error:11000074:X509 V3 routines:v3_generic_extension:extension value error:crypto/x509/v3_conf.c:260:value=PRINTABLESTRING:ABC_NAME_TESTING

So what you can do is switch your openssl.cnf to use a different data type: UTF8STRING.

oid_section = new_oids
[ new_oids ]
certificateTemplateName = 1.3.6.1.4.1.311.20.2
[ req_ext ]
certificateTemplateName = ASN1:UTF8STRING:ABC_NAME_TESTING

Send SMTP with openssl cli

bgstack15 — Fri, 09 Aug 2024 12:40:00 GMT

files/2024/listings/smtp1.sh (Source)

	`#!/bin/sh`
	`# File: smtp1.sh`
	`# Location: stackbin`
	`# Author: bgstack15`
	`# Startdate: 2024-08-05-2 14:05`
	`# SPDX-License-Identifier: GPL-3.0-only`
	`# Title: Send authenticated email with openssl s_client`
	`# Purpose: demo cli smtp auth`
	`# History:`
	`# References:`
	`# https://stackoverflow.com/questions/1546367/how-to-send-mail-with-to-cc-and-bcc`
	`# https://szclsya.me/posts/net/send-email-with-netcat/`
	`# https://serverfault.com/questions/1101104/how-to-send-an-email-with-openssl-and-microsoft-exchange-online`
	`# https://woshub.com/sending-email-via-telnet-using-smtp-authentication/`
	`# https://learn.microsoft.com/en-us/exchange/mail-flow/test-smtp-telnet?view=exchserver-2019`
	`# https://stackoverflow.com/questions/14640560/openssl-to-negotiate-ssl-encryption-for-starttls`
	`# https://thelinuxcode.com/openssl-s-client/`
	`# https://www.stevenrombauts.be/2018/12/test-smtp-with-telnet-or-openssl/`
	`# https://stackoverflow.com/questions/44250054/send-email-with-netcat`
	`# Improve:`
	`# Dependencies:`
	`# dep-fedora: openssl, coreutils`
	`# an smtp account and server`
	`# Documentation:`

	`slowcat() {`
	`while read REPLY ; do sleep .05; echo "$REPLY"; done`
	`}`

	`{`
	`message1="$( printf '%s' 'exampleuser@example.com' \| base64 )"`
	`message2="$( cat ~/.config/smtp1 )"`
	`printf '%s\n' "EHLO exampleaddress.com"`
	`printf '%s\n' "AUTH LOGIN"`
	`printf '%s\n' "${message1}"`
	`printf '%s\n' "${message2}"`
	`# Everybody, so TO, CC, BCC is a RCPT TO. The To, CC, BCC headers are the decorations visible to the mail client.`
	`cat <<-EOF`
	`MAIL FROM:<exampleuser@example.com>`
	`RCPT TO:<user2@local.example.com>`
	`RCPT TO:<user3@anotherlocal.examplelong.com>`
	`DATA`
	`From: [marco polo] <exampleaddress.com>`
	`To: <user3@anotherlocal.examplelong.com>`
	`BCC: <user2@local.example.com>`
	`Date: Mon, 5 Aug 2024 17:31:32 +0000`
	`Subject: Hello from netcat`

	`sample message here`

	`.`
	`QUIT`
	`EOF`

	`# \| slowcat \| nc -v mail.example.net 587`
	`} \| slowcat \| openssl s_client -crlf -connect mail.example.net:587 -starttls smtp -ign_eof`

I needed to test (credentials, but also in general) the ability to send smtp messages. Here is my small script that does that.

The slowcat is useful because smtp (or maybe just my email implementation) wanted to delay between some of the steps, particularly EHLO and AUTH.

I couldn't get netcat (nc) to work with tls, although I thought I saw that once. At least s_client could do it.

Openssl: Generate CSR with NTDS CA Security Extension

bgstack15 — Wed, 24 Jul 2024 12:44:00 GMT

To request a certificate with the exact Microsoft OID for Client Auth certs for the domain, you can use an openssl.cnf that resembles the following.

This also includes the SAN URI which is separate from the NTCS.

files/2024/listings/openssl.cnf (Source)

	`[ req ]`
	`prompt = no`
	`default_bits = 4096`
	`default_md = sha256`
	`default_keyfile = privkey.pem`
	`distinguished_name = req_distinguished_name`
	`req_extensions = req_ext`

	`[ req_distinguished_name ]`
	`C = US`
	`ST = Florida`
	`L = Miami`
	`O = Example Org`
	`# Important value`
	`CN = hostname123498.example.org`
	`#emailAddress = noreply@example.org`

	`[ req_ext ]`
	`basicConstraints = CA:FALSE`
	`keyUsage = digitalSignature, keyEncipherment`
	`# this oid is szOID_NTDS_CA_SECURITY_EXT`
	`1.3.6.1.4.1.311.25.2 = ASN1:SEQUENCE:NTDSCASecurityExt`
	`subjectAltName = @alt_names`

	`[ alt_names ]`
	`# Important value`
	`DNS.1 = hostname123498.example.org`
	`DNS.2 = hostname123498.subnet.example.org`
	`# hardcoded text until the sid`
	`URI.1 = tag:microsoft.com,2022-09-14;sid:S-1-5-21-2059058832-2300889872-1288252972-490382`

	`[ NTDSCASecurityExt ]`
	`# If you wanted to use another SEQUENCE but that does not conform to the M$ example.`
	`#wrappingSeq = EXPLICIT:0,SEQUENCE:ExtOid`
	`# The EXPLICIT,0 is required to get the specific context which is displayed by asn1parse as: cont [ 0 ]`
	`szOID_NTDS_OBJECTSID = EXPLICIT:0,OID:1.3.6.1.4.1.311.25.2.1`
	`# Important value`
	`key = EXPLICIT:0,OCTETSTRING:S-1-5-21-2059058832-2300889872-1288252972-490382`

	`[ ExtOid ]`
	`oid = OID:1.3.6.1.4.1.311.25.2.1`

References

Weblinks

Auxiliary

openssl read cert template

bgstack15 — Sun, 02 Jun 2024 13:06:06 GMT

Here's a post that combines all my favorite technologies! This is so fun.

If you want to use openssl to read the template name of a Microsoft Certificate Services certificate, you have to look up the OID that is stored on the cert and find it in the directory.

files/2024/listings/read-cert-template.sh (Source)

#!/usr/bin/env sh
# File: read-cert-template.sh
# Location: blog exclusive
# Author: bgstack15
# SPDX-License-Identifier: GPL-3.0-only
# Startdate: 2024-05-16-5 10:23
# Title: Read cert template
# Purpose: read certificate and print cert tempalte name if discoverable
# History:
# Usage:
# Reference: see blog post
# Improve:
# Dependencies:
#    openssl, ldapsearch, ldap credential in read-cert-template.conf

# Load conf, RCT_LDAPSERVER RCT_LDAPBASE RCT_LDAPAUTH1 RCT_LDAPAUTH2
RCT_CONF="${RCT_CONF:-${HOME}/.config/read-cert-template.conf}"
test -f "${RCT_CONF}" && . "${RCT_CONF}"

# use RCT_IN env var or first parameter, or else standard input
RCT_IN="${RCT_IN:-${1}}"
RCT_IN="${RCT_IN:-/dev/stdin}"

if echo "${RCT_IN}" | grep -qE -e '^-$|^stdin$' ;
then
   _input="$( cat )"
else
   _input="$( cat "${RCT_IN}" )"
fi

oid="$( echo "${_input}" | openssl x509 -in /dev/stdin -noout -text -certopt no_header,no_version,no_serial,no_signame,no_validity,no_subject,no_issuer,no_pubkey,ext_parse | sed -n -r -e '/1.3.6.1.4.1.311.21.7/,+2p' | awk '/OBJECT/{print $NF}' | sed -r -e 's/^://;' )"
test -n "${VERBOSE}" && printf 'oid=%s\n' "${oid}" 1>&2
LDAPTLS_REQCERT=never ldapsearch -LLL -o ldif-wrap=9000 -H "${RCT_LDAPSERVER}" ${RCT_LDAPAUTHUNQUOTED} "${RCT_LDAPAUTHQUOTED}" -b "CN=Certificate Templates,CN=Public Key,CN=Services,CN=Configuration,${RCT_LDAPBASE}" "(msPKI-Cert-Template-OID=${oid})" CN | awk '$1~/cn:/{$1="";print;}' | sed -r -e 's/^ +| +$//g;'

files/2024/listings/read-cert-template.conf (Source)

# File: ~/.config/read-cert-template.conf
RCT_LDAPSERVER=ldaps://example.corp
# The "CN=Certificate Templates,CN=Public Key,CN=Services,CN=Configuration," will be prepended to this:
RCT_LDAPBASE="DC=example,DC=corp"
RCT_LDAPAUTHUNQUOTED="-x -w see#keepass"
RCT_LDAPAUTHQUOTED="-D CN=Service Account 319 (sa319),OU=Accounts,DC=example,DC=corp"

References

man openssl man x509

Query ldap CDP with ldapsearch

bgstack15 — Sat, 25 May 2024 13:21:55 GMT

Quick and dirty note for manual inspection of the CRL distribution point stored in LDAP (so primarily for M$ use cases).

ldapsearch -LLL -o ldif-wrap=9000 -H ldap://example.corp -b "CN=CA Name V3,CN=hostname,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=example,DC=corp" "(objectclass=cRLDistributionPoint)" -x -w "KEEPASS" -D "CN=Account,OU=Accounts,DC=example,DC=corp" certificateRevocationList | awk -F'::' '$1~/certificateRevocationList/{print $NF}' > ~/tmp1
{ printf '%s\n' '-----BEGIN X509 CRL-----' ; <~/tmp1 tr -d '\r\n ' | fold -w64 ; printf '\n%s' '-----END X509 CRL-----' ; } | openssl crl -in /dev/stdin -noout -text

References

Latest way to get certificate in FreeIPA

bgstack15 — Mon, 02 Oct 2023 12:46:38 GMT

Copy pasta

openssl genpkey -algorithm RSA -out https-app1.ipa.internal.com.key
openssl req -new -key https-app1.ipa.internal.com.key -subj "/O=IPA.INTERNAL.COM/CN=app1.ipa.internal.com" -addext "subjectAltName = DNS:webapp.ipa.internal.com,DNS:app.ipa.internal.com" -out https-app1.ipa.internal.com.csr
ipa host-add --force webapp.ipa.internal.com
ipa host-add --force app.ipa.internal.com
ipa service-add --force HTTP/app1.ipa.internal.com
ipa service-add --force HTTP/webapp.ipa.internal.com
ipa service-add --force HTTP/app.ipa.internal.com
ipa cert-request --chain --principal=HTTP/app1.ipa.internal.com https-app1.ipa.internal.com.csr --certificate-out=https-app1.ipa.internal.com.pem

Extra, in case you forget to add "--chain" to the above command. It is not necessary for a 2-deep cert chain, that is, if you don't have an intermediate certificate.

sn="$( ipa cert-find --raw --services=HTTP/"$( hostname -f )" | awk '/serial_number:/{print $NF}' )"
ipa cert-show --chain "${sn}" --certificate-out=https-app1.ipa.internal.com.chain.pem

Explanation

I learned you can use genpkey from the (openssl) genrsa man page. This simplifies the command a little. And now, with the later versions of openssl, you can pass SAN extensions and even the subject on the command line! I remember reading about that years ago but this is the first time my server environment has a new enough version of openssl to take advantage of that.

References

Send https request with openssl s_client

bgstack15 — Fri, 28 Oct 2022 12:48:28 GMT

Inspired by https://news.ycombinator.com/item?id=32903694.

To send a simple http get with openssl s_client, use this template.

sed -r -e 's/$/\r/;' <<EOF | openssl s_client -connect www.example.com:443 -ign_eof
GET /internal/directory.html HTTP/1.1
Host: www.example.com
Connection: close

EOF

Or with printf.

printf 'GET /internal/directory.html HTTP/1.1\r\nHost: www.example.com\r\nConnection: close\r\n\r\n' | openssl s_client -connect www.example.com:443 -ign_eof

Here is a sample post:

sed -r -e 's/$/\r/;' <<EOF | openssl s_client -connect server3.ipa.internal.com:443 -ign_eof
POST /coupons/search/ HTTP/1.0
Host: server3.ipa.internal.com
Connection: close
Content-Type: text/plain;charset=UTF-8
Accept: text/plain

cheese
EOF

View details of a certificate

bgstack15 — Wed, 10 Feb 2021 13:38:03 GMT

Sometimes you need to inspect your certificate or certificate chain presented by a server. Here are several ways to do that.

Inspect certificate with web browser

If the certificate or cert chain in question is being used to present a web site, you can visit the site in a browser, such as Firefox. Visit your site, and select the padlock icon in the address bar beside the URL. Select the arrow pointing to the right, and then select the "More information" link. On the new modal window that appears, select the "View certificate" button. Firefox will show you the certificate and its chain (if Firefox knows about it, or the web server presents the chain) for your inspection.

Inspect certificate chain with openssl command

The openssl reference implementation is available for both Windows and Linux through various means. Sufficiently high versions of openssl (>=1.0.1a) will be able to perform these tasks. Openssl can make network connections to https sites, and can also inspect files.

Inspect certificate chain presented by web server

The simplest way is to search for the descriptors provided by openssl natively with s_client. You can make sure the number and order of certificates is what you expect to make a complete intermediate-server cert chain.

$ echo "" | openssl s_client -connect xkcd.com:443 -showcerts 2>&1 | grep -iE '[si]:'
 0 s:C = US, ST = California, L = San Francisco, O = "Fastly, Inc.", CN = i.ssl.fastly.net
   i:C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - SHA256 - G2
 1 s:C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - SHA256 - G2
   i:C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA

A well-behaved web server will present, at a minimum, the server certificate and all intermediate certificates. Serving the root certificate is optional, because well-behaved clients will already trust the root certificate. You can also dump the whole chain to a file, so you can split it up and read each certificate with the commands farther down on this page.

$ echo "" | openssl s_client -connect xkcd.com:443 -showcerts > certchain.pem

Inspect certificate in a file

Openssl will only read one certificate per file! If you have a certificate chain in a file, split it into multiple files before running these commands.

$ openssl x509 -in cert1.pem -noout -subject -issuer -dates -fingerprint -serial
subject=C = US, ST = California, L = San Francisco, O = "Fastly, Inc.", CN = i.ssl.fastly.net
issuer=C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - SHA256 - G2
notBefore=Jun 16 18:30:07 2020 GMT
notAfter=Jul 28 18:43:49 2022 GMT
SHA1 Fingerprint=7A:63:0B:5F:F6:72:E8:4D:70:B7:8B:45:1D:CF:27:94:AF:2C:F1:9A
serial=0F40947DD38354936AD7D7D0

Install openssl-1.1.0 on CentOS7

bgstack15 — Tue, 18 Sep 2018 12:59:59 GMT

I really wanted the -proxy flag on the openssl command. It's not available in the provided openssl package (1.0.1 series), but it is in the 1.1.0 which is now the base package in Fedora. But for the Enterprise Linux users, you need to do a little bit of work to get it.

Download a pre-compiled package

You could just download the package from my copr. Save the contents of the .repo file [copr.fedorainfracloud.org] or use them from here.

[bgstack15-stackrpms]
name=Copr repo for stackrpms owned by bgstack15
baseurl=https://copr-be.cloud.fedoraproject.org/results/bgstack15/stackrpms/epel-7-$basearch/
type=rpm-md
skip_if_unavailable=True
gpgcheck=1
gpgkey=https://copr-be.cloud.fedoraproject.org/results/bgstack15/stackrpms/pubkey.gpg
repo_gpgcheck=0
enabled=1
enabled_metadata=1

Install with:

yum install openssl110

And then the binary has been named openssl110

Download and compile the source

wget https://www.openssl.org/source/openssl-1.1.0i.tar.gz
tar -zxf openssl-1.1.0i.tar.gz
cd openssl-1.1.0i
./config
make
sudo make install

To prevent an error that resembles:

/usr/local/bin/openssl version
/usr/local/bin/openssl: error while loading shared libraries: libcrypto.so.1.1: cannot open shared object file: No such file or directory

You have to provide the library files in a directory that the dynamic linker is looking in. There are multiple ways to tackle this.

Option 1: update library path

Add the directory containing the libcrypt.so.1.1 and similar files to the LD_LIBRARY_PATH environment variable.

export LD_LIBRARY_PATH=/usr/local/lib64:${LD_LIBRARY_PATH}

Option 2: move library files to lib directory

Or just move the files to the main library location. On a x86_64 system, that would be:

mv libcrypto.so.1.1 libssl.so.1.1 /usr/lib64/

References

Weblinks

Internet search openssl s_client http proxy [duckduckgo.com] openssl s_client using a proxy [stackoverflow.com] How to update openssl 1.1.0 in Centos 6.9/7.0 [linuxscriptshub.com]

Automated certreq for GNU/Linux

bgstack15 — Wed, 27 Dec 2017 14:13:12 GMT

Last updated 2018-11-14

Background

Microsoft provides the certreq utility for its non-free operating system. This tool makes it easy to get certificates from the Microsoft sub-CA on your network. GNU Linux hosts do not get that tool, so a viable alternative is to script the interaction with the website. My content in this post is shamelessly ripped from a StackOverflow post and beefed up. In my research, I came across a question: "How to submit certificate request from red hat to windows ca".

The solution

Dependencies

Certreq needs the framework.sh shell library available from my bgscripts package. At the very least, you need framework.sh, which you can place either in the same directory as certreq.sh or you can modify the framework lookup paths in the script to point to where you placed it. This will solve the issue "certreq.sh: validateparams: not found."

The script

I present my shell script, certreq.sh. This shell script:

Generates CSR and submits it to the Microsoft Sub-CA.
Saves private key, public key (the certificate), and cert chain to a temporary directory
Removes the temp directory after 5 minutes automatically to remove the private key
Sends to standard out the file names and purposes, for consumption by automation tool, e.g., ansible

Code walkthrough

Instead of copying and pasting the whole code here, I will discuss only snippets. Here is the usage block.

usage: certreq.sh [-dhV] [-u username] [-p password] [-w tempdir] [-t template] [--cn CN] [--ca ]
version ${certreqversion}
 -d debug   Show debugging info, including parsed variables.
 -h usage   Show this usage block.
 -V version Show script version number.
 -u username User to connect via ntlm to CA. Can be "username" or "domain\\username"
 -p password
 -w workdir  Temp directory to work in. Default is a (mktemp -d).
 -t template Template to request from CA. Default is "ConfigMgrLinuxClientCertificate"
 --cn        CN to request. Default is the \$( hostname -f )
 --ca        CA hostname or base URL. Example: ca2.example.com
Return values under 1000: A non-zero value is the sum of the items listed here:
 0 Everything worked
 1 Cert file is still a CSR
 2 Cert file is html, probably due to permissions/credentials issue
 4 Return code of curl statement that saves cert file is non-zero
 8 Cert file does not contain whole certificate
16 Cert does not contain an issuer
Return values above 1000:
1001 Help or version info displayed
1002 Count or type of flaglessvals is incorrect
1003 Incorrect OS type
1004 Unable to find dependency
1005 Not run as root or sudo

All the magic happens at line 239, the main loop. These blocks perform the different web requests, and are the real meat of this script. Block GENERATE PRIVATE KEY makes the csr and saves in to the file that will eventually hold the cert.

   # GENERATE PRIVATE KEY
   openssl req -new -nodes \
      -out "${CERTREQ_WORKDIR}/${CERTREQ_CNPARAM}.crt" \
      -keyout "${CERTREQ_WORKDIR}/${CERTREQ_CNPARAM}.key" \
      -subj "${CERTREQ_SUBJECT}"
   CERT="$( cat "${CERTREQ_WORKDIR}/${CERTREQ_CNPARAM}.crt" | tr -d '\n\r' )"
   DATA="Mode=newreq&CertRequest=${CERT}&C&TargetStoreFlags=0&SaveCert=yes"
   CERT="$( echo ${CERT} | sed -e 's/+/%2B/g' | tr -s ' ' '+' )"
   CERTATTRIB="CertificateTemplate:${CERTREQ_TEMPLATE}"

SUBMIT CERTIFICATE SIGNING REQUEST submits the CSR to the website

   # SUBMIT CERTIFICATE SIGNING REQUEST
   OUTPUTLINK="$( curl -k -u "${CERTREQ_USER}:${CERTREQ_PASS}" --ntlm \
      "${CERTREQ_CA}/certsrv/certfnsh.asp" \
      -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
      -H 'Accept-Encoding: gzip, deflate' \
      -H 'Accept-Language: en-US,en;q=0.5' \
      -H 'Connection: keep-alive' \
      -H "Host: ${CERTREQ_CAHOST}" \
      -H "Referer: ${CERTREQ_CA}/certsrv/certrqxt.asp" \
      -H 'User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko' \
      -H 'Content-Type: application/x-www-form-urlencoded' \
      --data "Mode=newreq&CertRequest=${CERT}&CertAttrib=${CERTATTRIB}&TargetStoreFlags=0&SaveCert=yes&ThumbPrint=" | grep -A 1 'function handleGetCert() {' | tail -n 1 | cut -d '"' -f 2 )"
   CERTLINK="${CERTREQ_CA}/certsrv/${OUTPUTLINK}"

FETCH SIGNED CERTIFICATE downloads the cert that the previous page links to.

   # FETCH SIGNED CERTIFICATE
   curl -k -u "${CERTREQ_USER}:${CERTREQ_PASS}" --ntlm $CERTLINK \
      -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
      -H 'Accept-Encoding: gzip, deflate' \
      -H 'Accept-Language: en-US,en;q=0.5' \
      -H 'Connection: keep-alive' \
      -H "Host: ${CERTREQ_CAHOST}" \
      -H "Referer: ${CERTREQ_CA}/certsrv/certrqxt.asp" \
      -H 'User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko' \
      -H 'Content-Type: application/x-www-form-urlencoded' > "${CERTREQ_WORKDIR}/${CERTREQ_CNPARAM}.crt"
   finaloutput=$?

My additions to this secret sauce start with GET NUMBER OF CURRENT CA CERT. I needed the cert chain, so I automated fetching it from the server. You have to find out how many different CA certs are being offered by this server, and then use the latest.

   # GET NUMBER OF CURRENT CA CERT
   RESPONSE="$( curl -s -k -u "${CERTREQ_USER}:${CERTREQ_PASS}" --ntlm \
      "${CERTREQ_CA}/certsrv/certcarc.asp" \
      -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
      -H 'Accept-Encoding: gzip, deflate' \
      -H 'Accept-Language: en-US,en;q=0.5' \
      -H 'Connection: keep-alive' \
      -H "Host: ${CERTREQ_CAHOST}" \
      -H "Referer: ${CERTREQ_CA}/certsrv/certrqxt.asp" \
      -H 'User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko' \
      -H 'Content-Type: application/x-www-form-urlencoded' )"
   CURRENTNUM="$( echo "${RESPONSE}" | grep -cE 'Option' )"

   # GET LATEST CA CERT CHAIN
   CURRENT_P7B="$( curl -s -k -u "${CERTREQ_USER}:${CERTREQ_PASS}" --ntlm \
      "${CERTREQ_CA}/certsrv/certnew.p7b?ReqID=CACert&Renewal=${CURRENTNUM}" \
      -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
      -H 'Accept-Encoding: gzip, deflate' \
      -H 'Accept-Language: en-US,en;q=0.5' \
      -H 'Connection: keep-alive' \
      -H "Host: ${CERTREQ_CAHOST}" \
      -H "Referer: ${CERTREQ_CA}/certsrv/certrqxt.asp" \
      -H 'User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko' \
      -H 'Content-Type: application/x-www-form-urlencoded' )"

   # CONVERT TO PEM
   echo "${CURRENT_P7B}" | openssl pkcs7 -print_certs -out "${CERTREQ_TEMPFILE}"

I like having the domain name in the filename, so this last part renames the cert chain.

   # RENAME TO PROPER FILENAME
   # will read only the first cert, so get domain of issuer of it.
   CA_DOMAIN="$( openssl x509 -in "${CERTREQ_TEMPFILE}" -noout -issuer 2>&1 | sed -r -e 's/^.*CN=[A-Za-z0-9]+\.//;' )"
   CHAIN_FILE="chain-${CA_DOMAIN}.crt"
   mv -f "${CERTREQ_TEMPFILE}" "${CERTREQ_WORKDIR}/${CHAIN_FILE}" 1>/dev/null 2>&1

The ansible role

I needed this task deployed to my whole environment, so I rolled it into an ansible role saved to gitlab and also added another feature, where it converts the generated cert files into a pcks12 (pfx) file for a specific application's need.

Knowledge Base (Posts about openssl)

asn1parse and underscores

Send SMTP with openssl cli

Openssl: Generate CSR with NTDS CA Security Extension

References

Weblinks

Auxiliary

openssl read cert template

References

Query ldap CDP with ldapsearch

References

Latest way to get certificate in FreeIPA

Copy pasta

Explanation

References

Send https request with openssl s_client

View details of a certificate

Inspect certificate with web browser

Inspect certificate chain with openssl command

Inspect certificate chain presented by web server

Inspect certificate in a file

See also

Install openssl-1.1.0 on CentOS7

Download a pre-compiled package

Download and compile the source

Option 1: update library path

Option 2: move library files to lib directory

References

Weblinks

Automated certreq for GNU/Linux

Background

The solution

Dependencies

The script

Code walkthrough

The ansible role

References

Weblinks