systemd: allow SendSIGKILL and TimeoutStopUSec dbus properties

[pve-common.git] / src / PVE / Certificate.pm

diff --git a/src/PVE/Certificate.pm b/src/PVE/Certificate.pm
index 65c5c8f6f2f5c2a1e73d7236b9229dc76b56bd1f..31a77223f83c556e393be3a3165ea168eda5ae1d 100644 (file)
--- a/src/PVE/Certificate.pm
+++ b/src/PVE/Certificate.pm
@@ -78,6 +78,16 @@ PVE::JSONSchema::register_standard_option('pve-certificate-info', {
            format => 'pem-certificate',
            optional => 1,
        },
+       'public-key-type' => {
+           type => 'string',
+           description => 'Certificate\'s public key algorithm',
+           optional => 1,
+       },
+       'public-key-bits' => {
+           type => 'integer',
+           description => 'Certificate\'s public key size',
+           optional => 1,
+       },
     },
 });
 
@@ -189,10 +199,8 @@ my $read_certificate = sub {
        or $ssl_die->("unable to read '$cert_path' - $!\n");
 
     my $cert = Net::SSLeay::PEM_read_bio_X509($bio);
-    if (!$cert) {
-       Net::SSLeay::BIO_free($bio);
-       die "unable to read certificate from '$cert_path'\n";
-    }
+    Net::SSLeay::BIO_free($bio);
+    die "unable to read certificate from '$cert_path'\n" if !$cert;
 
     return $cert;
 };
@@ -206,6 +214,20 @@ sub convert_asn1_to_epoch {
     return Date::Parse::str2time($iso_time);
 }
 
+sub get_certificate_fingerprint {
+    my ($cert_path) = @_;
+
+    my $cert = $read_certificate->($cert_path);
+
+    my $fp = Net::SSLeay::X509_get_fingerprint($cert, 'sha256');
+    Net::SSLeay::X509_free($cert);
+
+    die "unable to get fingerprint for '$cert_path' - got empty value\n"
+       if !defined($fp) || $fp eq '';
+
+    return $fp;
+}
+
 sub get_certificate_info {
     my ($cert_path) = @_;
 
@@ -312,6 +334,9 @@ sub generate_csr {
     my $san = [ map { $_->{value} } grep { $_->{type} eq 'dns' } @$identifiers ];
     die "DNS identifiers are required to generate a CSR.\n" if !scalar @$san;
 
+    # optional
+    my $common_name = delete($attr{common_name}) // $san->[0];
+
     my $md = eval { Net::SSLeay::EVP_get_digestbyname($dig_alg) };
     die "Invalid digest algorithm '$dig_alg'\n" if !$md;
 
@@ -342,7 +367,7 @@ sub generate_csr {
        }
     };
 
-    $add_name_entry->('CN', @$san[0]);
+    $add_name_entry->('CN', $common_name);
     for (qw(C ST L O OU)) {
         if (defined(my $v = $attr{$_})) {
            $add_name_entry->($_, $v);