Problem/Motivation

This module requires the user to create the key pairs outside of the module and upload them as PEM file or reference them in files or environment variables. This can be difficult for some users who just need to create a cert for development purposes.

User interface changes

  • Add a "New Key Pair" and "New Certificate" link next to "New Key" on admin/config/system/keys.
  • Allow the user to select the strength of the key pair.
  • Allow the user to fill out the common fields of a certificate
  • Allow the user to self-sign the certificate or use another cert+private key to sign.

API changes

Add methods to the KeyPair class to do the heavy PKI lifting.

Issue fork key_asymmetric-3492479

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

john franklin created an issue. See original summary.

john franklin opened merge request !8

john franklin’s picture

john franklin commented
Assigned: Unassigned » roderik

@roderik, can you take a look at this MR?

roderik’s picture

roderik
Primary language Dutch
Location Amsterdam,NL / Budapest,HU
commented
Status: Active » Needs work

Added review comments.

I also had a voice in the back of my mind that we should be really careful how we use keys created in this way, because we can't trust that the webserver has a good openssl configuration. (I think I read that somewhere.) But I'm probably being paranoid, because I can't find any docs saying that, anymore / we're not doing anything special / PHP's OpenSSL extension is likely good.

But... how about e.g. adding this to the README (near the top, as the first 'separate section')?

## Creating key pairs

The screen to create a new key pair is mostly for developer convenience. Unlike
the "Add Key" option from the main key module, this uses OpenSSL code /
configuration on the webserver, to create keys (before adding them as usual).
Do not use these keys on a production environment unless you are sure they are
fit for their purpose. Also note: this creates a public key, not a signed
certificate for that key.

(And add a 4th point at the top:
- a screen to create a new key pair. )

roderik’s picture

roderik
Primary language Dutch
Location Amsterdam,NL / Budapest,HU
commented
Assigned: roderik » Unassigned
john franklin’s picture

john franklin commented

Thanks for the review. I'll go through these today and update the MR.

roderik’s picture

roderik
Primary language Dutch
Location Amsterdam,NL / Budapest,HU
commented
  • Reviewed changes. Seems all good... but exposed one extra thing, for which I pushed a commit for review.
  • Also one extra review comment (required "description").
  • and the thing you said you'll leave until last.

I don't know of anything else. From my tests, it works well, and does not get in the way of theoretical future extension work.

john franklin’s picture

john franklin commented
Status: Needs work » Needs review

Addressed the remaining issues.

john franklin’s picture

john franklin commented

Also added #3564920: Support creating a cert when creating a key pair to cover the certificate generation half of this issue.

roderik’s picture

roderik
Primary language Dutch
Location Amsterdam,NL / Budapest,HU
commented
Status: Needs review » Reviewed & tested by the community

Tested the last change. Don't know if I should RTBC or just merge :-)

Added a README adjustment.

john franklin’s picture

john franklin commented
Title: Add support for creating new key pairs and certs. » Add support for creating new key pairs.

Updating the title of this issue. The certificate part will be done under #3564920: Support creating a cert when creating a key pair.

I say just merge. RTBC is usually for non-maintainers to show a patch is ready for the maintainers to merge.

roderik’s picture

roderik
Primary language Dutch
Location Amsterdam,NL / Budapest,HU
commented

I'm merging... after sneaking in another commit that only changes comments on a method that is never called. (Removes TODOs.)

roderik’s picture

roderik
Primary language Dutch
Location Amsterdam,NL / Budapest,HU
commented
Status: Reviewed & tested by the community » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.