Set `keyUsage` for generated HTTP certificates and self-signed CA #126376

slobodanadamovic · 2025-04-06T20:49:07Z

The elasticsearch-certutil http command, and security auto-configuration, generate the HTTP certificate and CA without setting the keyUsage extension.

This PR fixes this by setting (by default):

keyCertSign and cRLSign for self-signed CAs
digitalSignature and keyEncipherment for HTTP certificates and CSRs

These defaults can be overridden when running elasticsearch-certutil http command.
The user will be prompted to change them as they wish.

For elasticsearch-certutil ca, the default value can be overridden by passing the --keysage option, e.g.

elasticsearch-certutil ca --keyusage "digitalSignature,keyCertSign,cRLSign" -pem

Fixes #117769

elasticsearchmachine · 2025-04-06T20:49:32Z

Hi @slobodanadamovic, I've created a changelog YAML for you.

elasticsearchmachine · 2025-04-07T05:09:42Z

Pinging @elastic/es-security (Team:Security)

tvernum

Did you consider whether elasticsearch-certutil ca should be changed?
It's typically not used as a HTTP ca, but our docs to show how it can be.

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java

slobodanadamovic · 2025-04-07T07:46:12Z

Did you consider whether elasticsearch-certutil ca should be changed?

Honestly, I haven't but it does make sense. I'll make it default to keyCertSign and cRLSign but also make it overridable if necessary.

slobodanadamovic · 2025-04-07T10:13:33Z

x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/CertGenUtils.java

@@ -347,7 +380,9 @@ static PKCS10CertificationRequest generateCSR(
        if (sanList != null) {
            extGen.addExtension(Extension.subjectAlternativeName, false, sanList);
        }
-
+        if (keyUsage != null) {
+            extGen.addExtension(Extension.keyUsage, true, keyUsage);


It's debatable if CSR should include keyUsage. I went with adding it to the request and letting the issuer decide if it should be respected or not.

slobodanadamovic · 2025-04-07T12:16:53Z

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java

@@ -979,6 +1039,31 @@ private static Integer readKeySize(Terminal terminal, int keySize) {
        });
    }

+    private static List<String> readKeyUsage(Terminal terminal, List<String> defaultKeyUsage) {


The current implementation of readKeyUsage will not allow users to remove the keyUsage, but rather only to change the default value. I think this is okay, otherwise it would defeat the purpose of adding it in the first place (but I may oversee a use case where this could be a requirement).

Let me know if you think we should allow it to be overridden to a "none".

I think for http it's fine - I'm not even sure we need to let them change it.
If they want unlimited options they can use openssl (and suffer in pain)

slobodanadamovic · 2025-04-07T20:25:28Z

@tvernum I've fixed the missed place to add key usage and also made the default key usage overridable when running both elasticsearch-certutil http and elasticsearch-certutil ca commands. Please take another look.

`does not have keyCertSign bit set in KeyUsage extension`

…danadamovic/elasticsearch into sa-include-key-usage-in-http-certs

docs/reference/elasticsearch/command-line-tools/certutil.md

x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/CertGenUtils.java

.../plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/CertificateTool.java

tvernum · 2025-04-08T04:08:50Z

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java

@@ -979,6 +1039,31 @@ private static Integer readKeySize(Terminal terminal, int keySize) {
        });
    }

+    private static List<String> readKeyUsage(Terminal terminal, List<String> defaultKeyUsage) {


I think for http it's fine - I'm not even sure we need to let them change it.
If they want unlimited options they can use openssl (and suffer in pain)

tvernum

LGTM.

Thanks for the multiple rounds - it ended up being more than a 1 liner.

elasticsearchmachine · 2025-04-08T07:45:55Z

💚 All backports created successfully

Status	Branch	Result
✅	8.18
✅	8.x
✅	9.0
✅	8.17

…astic#126376) The `elasticsearch-certutil http` command, and security auto-configuration, generate the HTTP certificate and CA without setting the `keyUsage` extension. This PR fixes this by setting (by default): - `keyCertSign` and `cRLSign` for self-signed CAs - `digitalSignature` and `keyEncipherment` for HTTP certificates and CSRs These defaults can be overridden when running `elasticsearch-certutil http` command. The user will be prompted to change them as they wish. For `elasticsearch-certutil ca`, the default value can be overridden by passing the `--keysage` option, e.g. ``` elasticsearch-certutil ca --keyusage "digitalSignature,keyCertSign,cRLSign" -pem ``` Fixes elastic#117769

…astic#126376) The `elasticsearch-certutil http` command, and security auto-configuration, generate the HTTP certificate and CA without setting the `keyUsage` extension. This PR fixes this by setting (by default): - `keyCertSign` and `cRLSign` for self-signed CAs - `digitalSignature` and `keyEncipherment` for HTTP certificates and CSRs These defaults can be overridden when running `elasticsearch-certutil http` command. The user will be prompted to change them as they wish. For `elasticsearch-certutil ca`, the default value can be overridden by passing the `--keysage` option, e.g. ``` elasticsearch-certutil ca --keyusage "digitalSignature,keyCertSign,cRLSign" -pem ``` Fixes elastic#117769 (cherry picked from commit 284121a) # Conflicts: # docs/reference/elasticsearch/command-line-tools/certutil.md

…26376) (#126447) The `elasticsearch-certutil http` command, and security auto-configuration, generate the HTTP certificate and CA without setting the `keyUsage` extension. This PR fixes this by setting (by default): - `keyCertSign` and `cRLSign` for self-signed CAs - `digitalSignature` and `keyEncipherment` for HTTP certificates and CSRs These defaults can be overridden when running `elasticsearch-certutil http` command. The user will be prompted to change them as they wish. For `elasticsearch-certutil ca`, the default value can be overridden by passing the `--keysage` option, e.g. ``` elasticsearch-certutil ca --keyusage "digitalSignature,keyCertSign,cRLSign" -pem ``` Fixes #117769

…26376) (#126448) * Set `keyUsage` for generated HTTP certificates and self-signed CA (#126376) The `elasticsearch-certutil http` command, and security auto-configuration, generate the HTTP certificate and CA without setting the `keyUsage` extension. This PR fixes this by setting (by default): - `keyCertSign` and `cRLSign` for self-signed CAs - `digitalSignature` and `keyEncipherment` for HTTP certificates and CSRs These defaults can be overridden when running `elasticsearch-certutil http` command. The user will be prompted to change them as they wish. For `elasticsearch-certutil ca`, the default value can be overridden by passing the `--keysage` option, e.g. ``` elasticsearch-certutil ca --keyusage "digitalSignature,keyCertSign,cRLSign" -pem ``` Fixes #117769 (cherry picked from commit 284121a) # Conflicts: # docs/reference/elasticsearch/command-line-tools/certutil.md * fix compilation error * [CI] Auto commit changes from spotless * fix failing test --------- Co-authored-by: elasticsearchmachine <[email protected]>

…astic#126376) (elastic#126448) * Set `keyUsage` for generated HTTP certificates and self-signed CA (elastic#126376) The `elasticsearch-certutil http` command, and security auto-configuration, generate the HTTP certificate and CA without setting the `keyUsage` extension. This PR fixes this by setting (by default): - `keyCertSign` and `cRLSign` for self-signed CAs - `digitalSignature` and `keyEncipherment` for HTTP certificates and CSRs These defaults can be overridden when running `elasticsearch-certutil http` command. The user will be prompted to change them as they wish. For `elasticsearch-certutil ca`, the default value can be overridden by passing the `--keysage` option, e.g. ``` elasticsearch-certutil ca --keyusage "digitalSignature,keyCertSign,cRLSign" -pem ``` Fixes elastic#117769 (cherry picked from commit 284121a) # Conflicts: # docs/reference/elasticsearch/command-line-tools/certutil.md * fix compilation error * [CI] Auto commit changes from spotless * fix failing test --------- Co-authored-by: elasticsearchmachine <[email protected]>

…26376) (#126448) (#126454) * Set `keyUsage` for generated HTTP certificates and self-signed CA (#126376) The `elasticsearch-certutil http` command, and security auto-configuration, generate the HTTP certificate and CA without setting the `keyUsage` extension. This PR fixes this by setting (by default): - `keyCertSign` and `cRLSign` for self-signed CAs - `digitalSignature` and `keyEncipherment` for HTTP certificates and CSRs These defaults can be overridden when running `elasticsearch-certutil http` command. The user will be prompted to change them as they wish. For `elasticsearch-certutil ca`, the default value can be overridden by passing the `--keysage` option, e.g. ``` elasticsearch-certutil ca --keyusage "digitalSignature,keyCertSign,cRLSign" -pem ``` Fixes #117769 (cherry picked from commit 284121a) # Conflicts: # docs/reference/elasticsearch/command-line-tools/certutil.md * fix compilation error * [CI] Auto commit changes from spotless * fix failing test --------- Co-authored-by: elasticsearchmachine <[email protected]>

…26376) (#126448) (#126453) * Set `keyUsage` for generated HTTP certificates and self-signed CA (#126376) The `elasticsearch-certutil http` command, and security auto-configuration, generate the HTTP certificate and CA without setting the `keyUsage` extension. This PR fixes this by setting (by default): - `keyCertSign` and `cRLSign` for self-signed CAs - `digitalSignature` and `keyEncipherment` for HTTP certificates and CSRs These defaults can be overridden when running `elasticsearch-certutil http` command. The user will be prompted to change them as they wish. For `elasticsearch-certutil ca`, the default value can be overridden by passing the `--keysage` option, e.g. ``` elasticsearch-certutil ca --keyusage "digitalSignature,keyCertSign,cRLSign" -pem ``` Fixes #117769 (cherry picked from commit 284121a) # Conflicts: # docs/reference/elasticsearch/command-line-tools/certutil.md * fix compilation error * [CI] Auto commit changes from spotless * fix failing test --------- Co-authored-by: elasticsearchmachine <[email protected]>

Set keyUsage for generated HTTP certificates and self-signed CA

0f6dffd

slobodanadamovic added >bug :Security/TLS SSL/TLS, Certificates Team:Security Meta label for security team auto-backport Automatically create backport pull requests when merged v8.18.1 v8.19.0 v9.0.1 v9.1.0 v8.17.5 labels Apr 6, 2025

slobodanadamovic self-assigned this Apr 6, 2025

Update docs/changelog/126376.yaml

2ed9991

Merge branch 'main' into sa-include-key-usage-in-http-certs

11e96ee

slobodanadamovic requested a review from tvernum April 7, 2025 05:08

slobodanadamovic marked this pull request as ready for review April 7, 2025 05:09

tvernum reviewed Apr 7, 2025

View reviewed changes

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java Outdated Show resolved Hide resolved

slobodanadamovic and others added 2 commits April 7, 2025 12:00

make default HTTP keyUsage overridable

2a77f86

[CI] Auto commit changes from spotless

8c7fa75

slobodanadamovic commented Apr 7, 2025

View reviewed changes

slobodanadamovic added 6 commits April 7, 2025 12:22

respect custom keyUsage

09f698e

fix terminal messages and ignore leading and trailing whitespaces

c0f66f3

nit: error message

814f5db

add extra line after error message

411f5cf

more test coverage

e1ef610

nit: error message

d8c8d30

slobodanadamovic commented Apr 7, 2025

View reviewed changes

add ca-keyusage option

b05a367

slobodanadamovic added 2 commits April 7, 2025 22:38

remove randomization to avoid raising ValidatorException:

992b8ee

`does not have keyCertSign bit set in KeyUsage extension`

Merge branch 'sa-include-key-usage-in-http-certs' of github.com:slobo…

10d682d

…danadamovic/elasticsearch into sa-include-key-usage-in-http-certs

tvernum reviewed Apr 8, 2025

View reviewed changes

slobodanadamovic added 5 commits April 8, 2025 07:37

move bit map to test class

41b982f

map of entires

fa68b1a

rename ca-keyusage to keyusage and make it applicable only to ca

5fdda88

remove obsolete dependencies to unapplicable ca options

e03f096

make it private

06c04c0

slobodanadamovic requested a review from tvernum April 8, 2025 06:30

Merge branch 'main' into sa-include-key-usage-in-http-certs

f238cd0

tvernum approved these changes Apr 8, 2025

View reviewed changes

slobodanadamovic merged commit 284121a into elastic:main Apr 8, 2025
22 checks passed

slobodanadamovic mentioned this pull request Apr 8, 2025

[9.0] Set keyUsage for generated HTTP certificates and self-signed CA (#126376) #126447

Merged

elasticsearchmachine added the backport pending label Apr 8, 2025

slobodanadamovic mentioned this pull request Apr 8, 2025

Set keyUsage for generated HTTP certificates and self-signed CA (#126376) #126448

Merged

This comment was marked as duplicate.

Sign in to view

slobodanadamovic mentioned this pull request Apr 8, 2025

[8.18] Set keyUsage for generated HTTP certificates and self-signed CA (#126376) (#126448) #126453

Merged

slobodanadamovic mentioned this pull request Apr 8, 2025

[8.x] Set keyUsage for generated HTTP certificates and self-signed CA (#126376) (#126448) #126454

Merged

slobodanadamovic removed the backport pending label Apr 8, 2025

n1v0lg mentioned this pull request Apr 8, 2025

[CI] HttpCertificateCommandTests testGenerateMultipleCertificateWithNewCA failing #126471

Closed

Set keyUsage for generated HTTP certificates and self-signed CA #126376

Set keyUsage for generated HTTP certificates and self-signed CA #126376

Uh oh!

Conversation

slobodanadamovic commented Apr 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticsearchmachine commented Apr 6, 2025

Uh oh!

elasticsearchmachine commented Apr 7, 2025

Uh oh!

tvernum left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

slobodanadamovic commented Apr 7, 2025

Uh oh!

slobodanadamovic Apr 7, 2025

Choose a reason for hiding this comment

Uh oh!

slobodanadamovic Apr 7, 2025

Choose a reason for hiding this comment

Uh oh!

tvernum Apr 8, 2025

Choose a reason for hiding this comment

Uh oh!

slobodanadamovic commented Apr 7, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tvernum Apr 8, 2025

Choose a reason for hiding this comment

Uh oh!

tvernum left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticsearchmachine commented Apr 8, 2025 • edited by slobodanadamovic Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 All backports created successfully

Uh oh!

This comment was marked as duplicate.

Uh oh!

Set `keyUsage` for generated HTTP certificates and self-signed CA #126376

Set `keyUsage` for generated HTTP certificates and self-signed CA #126376

slobodanadamovic commented Apr 6, 2025 •

edited

Loading

elasticsearchmachine commented Apr 8, 2025 •

edited by slobodanadamovic

Loading