KNEL/KNELCa
9
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: port legacy TSYS-CA (admin-code PKI + tsys-bits) [#769][#783]

Browse Source 
Excluded admin-code/*SECRETS.inc (real Nitrokey HSM PINs in the public
source repo) — SECRETS.inc.example template added in their place.
Rotation/history-purge ruling pending in #783. legacy-* trees exempt
from lint/pointer checks (historical verbatim code).

https://projects.knownelement.com/issues/769#note-4152
This commit is contained in:
mrcharles
2026-09-04 07:01:46 -05:00
parent 2eca50490d
commit af7c0f3478
29 changed files with 738 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+1 -1
View File
@@ -7,7 +7,7 @@
# they don't need this file.
# Project-specific overrides for check-rules.sh
export PROJECT_DOC_EXEMPT ?= AGENTS.md STATUS.md WORKING.md README.md ADOPTING.md LICENSE .env.example questions-v1.md BASELINE-PROMPT.md PATTERNS.md
export PROJECT_DOC_EXEMPT ?= legacy-* AGENTS.md STATUS.md WORKING.md README.md ADOPTING.md LICENSE .env.example questions-v1.md BASELINE-PROMPT.md PATTERNS.md
export PROJECT_DISCOURSE_HOST ?= community.turnsys.com
.PHONY: setup validate fast lint test garden up down status clean help
legacy-tsys-ca/PORT-NOTE.md
+6
View File
@@ -0,0 +1,6 @@
# Port provenance
Imported from KNEL/TSYS-CA@master (2026-09-04) per OQ2 ruling (#769). The two
*SECRETS.inc files were excluded — they contained real Nitrokey HSM PINs in
the public source repo (security ticket #783, founder rotation decision
pending). Legacy repo now carries a redirect README.
legacy-tsys-ca/README.md
+9
View File
@@ -0,0 +1,9 @@
# TSYS CA
## Repo description
## Repo issues
https://projects.knownelement.com/project/reachableceo-vptechnicaloperations/kanban
## Repo discussion
https://community.turnsys.com/c/chiefoperationsandfinanceofficer/vptechnicaloperations/20
legacy-tsys-ca/admin-code/README.md
+11
View File
@@ -0,0 +1,11 @@
PKI CA Scripts
==============
**FAILURE TO FOLLOW SECURITY PROCEDURES CAN AND WILL RESULT IN CONSEQUENCES UP TO AND INCLUDING LEGAL ACTION. YOU ARE WARNED.**
These scripts facilitate the creation of a root certificate authority and one intermediate certificate.
These scripts have only been tested on the live-build Debian 9 environment.
legacy-tsys-ca/admin-code/SECRETS.inc.example
+6
View File
@@ -0,0 +1,6 @@
#!/bin/bash
# TEMPLATE ONLY — real values lived in *SECRETS.inc which were EXCLUDED from
# this port after a secret-scan (Nitrokey SO PIN + USER PIN; see #783).
# Populate at deploy time from ~/.creds or the secrets store — never commit.
export SECRET_SOPIN=""
export SECRET_USER_PIN=""
legacy-tsys-ca/admin-code/init-i-nitrokey.sh
+5
View File
@@ -0,0 +1,5 @@
#!/bin/bash
# This resets the counters on the HSM and ensures the PIN is what we want for now.
sc-hsm-tool --initialize --so-pin 1636511164917894 --pin 712583
sc-hsm-tool
legacy-tsys-ca/admin-code/init-offline-root-ca.sh
+226
View File
@@ -0,0 +1,226 @@
#!/bin/bash
###########################################################################
#user Variables
#Must changes these variables
###########################################################################
###########################################################################
#Program Variables #
#Dont change these variables unless you know what you are doing) #
###########################################################################
# Which OpenSSL config file are we using for this
export OPENSSL_CONF=$PWD/openssl.cnf
# Changed because this device is already previously initialized.
export FACTORY_DEFAULT_SOPIN="1636511164917894"
#OEM Default SOPIN
#export FACTORY_DEFAULT_SOPIN="3537363231383830"
###########################################################################
#Function definitions #
###########################################################################
function exit_error()
{
echo
echo " FATAL ERROR: $1"
echo " Script aborted."
echo
echo "-------------------------------------------------------------------------------"
exit 1
}
###########################################################################
# Preflight work, exit on any errors #
###########################################################################
# Banner and instructions for the user.
/usr/bin/clear
echo "==============================================================================="
echo " Offline Root CA Generator"
echo
echo "FAILURE TO FOLLOW SECURITY PROCEDURES CAN AND WILL RESULT IN CONSEQUENCES UP TO"
echo "AND INCLUDING LEGAL ACTION. YOU ARE WARNED."
echo
echo " Right now, you should be sitting inside the SCIF, reading this on the computer formerly contained in the safe. Before we begin, ensure that the only devices plugged into this machine are:"
echo
echo " * The *RED* PNY 8GB USB thumbdrive, with a GREEN 'PKI' tag."
echo " * The *ORANGE* USB Thumbdrive that was in the safe with the former."
echo
echo " When the process begins, you will be prompted to insert the 'R' HSM USB device, and you will then be prompted for the USER PIN set for the device a total of THREE times."
echo
echo "You may hit CTRL-C now to cancel execution of this script."
echo
read -p "==============================================================================="
#Check for prerequiste packages
echo "Preflight: Checking installed packages"
echo "-------------------------------------------------------------------------------"
echo
PKG_LIST="libccid pcscd pcsc-tools opensc libengine-pkcs11-openssl openssl"
for pkg in $PKG_LIST; do
echo -n "Checking for package $pkg: ";
if [ $(dpkg -l | grep $pkg -c) -lt 1 ]; then
echo "missing!"
exit_error "Required package '$pkg' is not installed."
else
echo "found.";
fi
done
echo
echo "-------------------------------------------------------------------------------"
echo "Preflight: Checking configuration file"
echo "-------------------------------------------------------------------------------"
echo
# Load in the SECRET variables
. ./offline-SECRETS.inc
#Check the SOPIN
if [ $SECRET_SOPIN = "0000000000000000" ] ; then
exit_error "SOPIN is still default. Check offline-SECRETS.inc."
fi
export SECRET_SOPIN_LENGTH=$(echo $SECRET_SOPIN|wc -c)
if [ $SECRET_SOPIN_LENGTH -lt 17 ]; then
exit_error "HSM SOPIN is too short. Check offline-SECRETS.inc."
fi
#Check the USERPIN
if [ "$SECRET_USER_PIN" = "0000000000000000" ] ; then
exit_error "USER PIN is still default. Check offline-SECRETS.inc."
fi
export SECRET_USERPIN_LENGTH=$(echo $SECRET_USER_PIN|wc -c)
if [ $SECRET_USERPIN_LENGTH -lt 7 ]; then
exit_error "USER PIN is too short. Check offline-SECRETS.inc."
fi
echo
echo "Length and content check complete."
echo
#Create directories to hold the bits
echo "-------------------------------------------------------------------------------"
echo "Preflight: Creating certificate directory structure"
echo "-------------------------------------------------------------------------------"
if [ -d "ca" ]; then
exit_error "Certificate directory exists. Please remove manually."
fi
mkdir -vp ca/root/{certs,crl,csr,newcerts}
mkdir -vp ca/{client,server}/{certs,csr,pfx,private}
touch ca/root/database
echo 1000 | tee ca/root/{serial,crlnumber}
chmod -v 700 ca/{client,server}/private
echo
echo "-------------------------------------------------------------------------------"
echo "Preflight: Verifying absence of HSM"
echo "-------------------------------------------------------------------------------"
echo
# Detect HSMs and prompt until gone.
DETECTLOOP=1;
while [ $DETECTLOOP = 1 ]; do
if [ $(pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -L 2>&1 | grep -c Slot) -gt 0 ]; then
read -p "WARNING: There is a hardware security module plugged into this machine. Please remove it now, and press ENTER."
echo
else
DETECTLOOP=0
fi
done
echo "No existing HSM present."
echo
echo "-------------------------------------------------------------------------------"
echo "==============================================================================="
echo "Offline Root CA Generation"
echo "==============================================================================="
echo
############################################################################
#offline Root HSM Stuff
############################################################################
read -p "Insert the Nitrokey HSM tagged as 'R' and press ENTER to continue."
echo
# Trust, but verify
if [ $(pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -L 2>&1 | grep -c Slot) -lt 1 ]; then
exit_error "No Hardware HSM found."
fi
echo "Device found:"
echo
#List the nitrokey
pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -L
echo
#Setup the HSM for use
echo "-------------------------------------------------------------------------------"
echo "Setting up the HSM for first use."
echo "-------------------------------------------------------------------------------"
echo
sc-hsm-tool --initialize --so-pin $FACTORY_DEFAULT_SOPIN --pin $SECRET_USER_PIN
pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so --login --login-type so --so-pin $FACTORY_DEFAULT_SOPIN --change-pin --new-pin $SECRET_SOPIN
#Create root key
echo "-------------------------------------------------------------------------------"
echo "Creating offline root key"
echo "-------------------------------------------------------------------------------"
echo
pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so --login --keypairgen --key-type EC:prime256v1 --label root
if [ "$?" -ne 0 ]; then exit_error "Key creation failed"; fi
#Create self-signed root certificate
echo "-------------------------------------------------------------------------------"
echo "Creating self-signed offline root certificate"
echo "-------------------------------------------------------------------------------"
echo
openssl req -engine pkcs11 -keyform engine -key label_root -new -extensions ext_root -out ca/root/certs/root.cert.pem -x509 -subj '/C=US/ST=Texas/O=TurnNetSystems/OU=Certificate Services/CN=TSYS Root CA' -days 10249
if [ "$?" -ne 0 ]; then exit_error "Certificate creation failed."; fi
echo "Changing permissions on root.cert.pm for sanity's sake"
chmod -v 444 ca/root/certs/root.cert.pem
#Verify root cert
echo "-------------------------------------------------------------------------------"
echo "Verifying root certificate generation"
echo "-------------------------------------------------------------------------------"
echo
openssl x509 -noout -text -in ca/root/certs/root.cert.pem
if [ "$?" -ne 0 ]; then exit_error "Verification failed."; fi
#Import root cert to root HSM
echo "-------------------------------------------------------------------------------"
echo "Importing offline root cert to HSM"
echo "-------------------------------------------------------------------------------"
echo
openssl x509 -in ca/root/certs/root.cert.pem -out ca/root/certs/root.cert.der -outform der
pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so --login --write-object ca/root/certs/root.cert.der --type cert --label root
if [ "$?" -ne 0 ]; then exit_error "Import failed."; fi
echo "-------------------------------------------------------------------------------"
echo "Visual certificate confirmation"
echo "-------------------------------------------------------------------------------"
echo
pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -L -O
echo
echo "Done."
echo
echo "-------------------------------------------------------------------------------"
legacy-tsys-ca/admin-code/init-online-root-ca.sh
+257
View File
@@ -0,0 +1,257 @@
#!/bin/bash
###########################################################################
#user Variables
#Must changes these variables
###########################################################################
###########################################################################
#Program Variables #
#Dont change these variables unless you know what you are doing) #
###########################################################################
# Which OpenSSL config file are we using for this
export OPENSSL_CONF=$PWD/openssl.cnf
# Changed because this device is already previously initialized.
export FACTORY_DEFAULT_SOPIN="1636511164917894"
#OEM Default SOPIN
#export FACTORY_DEFAULT_SOPIN="3537363231383830"
###########################################################################
#Function definitions #
###########################################################################
function exit_error()
{
echo
echo " FATAL ERROR: $1"
echo " Script aborted."
echo
echo "-------------------------------------------------------------------------------"
exit 1
}
###########################################################################
# Preflight work, exit on any errors #
###########################################################################
# Banner and instructions for the user.
/usr/bin/clear
echo "==============================================================================="
echo " Intermediate CA Generator"
echo
echo "FAILURE TO FOLLOW SECURITY PROCEDURES CAN AND WILL RESULT IN CONSEQUENCES UP TO"
echo "AND INCLUDING LEGAL ACTION. YOU ARE WARNED."
echo
echo " Right now, you should be sitting inside the SCIF, reading this on the computer formerly contained in the safe. Before we begin, ensure that the only devices plugged into this machine are:"
echo
echo " * The *RED* PNY 8GB USB thumbdrive, with a GREEN 'PKI' tag."
echo " * The *ORANGE* USB Thumbdrive that was in the safe with the former."
echo
echo " This process involves swapping between two different NitroKey HSM devices. Please ensure that you use the correct User PIN with the correct Nitrokey when prompted by the software, otherwise this process will fail."
echo
echo "You may hit CTRL-C now to cancel execution of this script."
echo
read -p "==============================================================================="
#Check for prerequiste packages
echo "Preflight: Checking installed packages"
echo "-------------------------------------------------------------------------------"
echo
PKG_LIST="libccid pcscd pcsc-tools opensc libengine-pkcs11-openssl openssl"
for pkg in $PKG_LIST; do
echo -n "Checking for package $pkg: ";
if [ $(dpkg -l | grep $pkg -c) -lt 1 ]; then
echo "missing!"
exit_error "Required package '$pkg' is not installed."
else
echo "found.";
fi
done
echo
echo "-------------------------------------------------------------------------------"
echo "Preflight: Checking configuration file"
echo "-------------------------------------------------------------------------------"
echo
# Load in the SECRET variables
. ./online-SECRETS.inc
#Check the SOPIN
if [ $SECRET_SOPIN = "0000000000000000" ] ; then
exit_error "SOPIN is still default. Check offline-SECRETS.inc."
fi
export SECRET_SOPIN_LENGTH=$(echo $SECRET_SOPIN|wc -c)
if [ $SECRET_SOPIN_LENGTH -lt 17 ]; then
exit_error "HSM SOPIN is too short. Check offline-SECRETS.inc."
fi
#Check the USERPIN
if [ "$SECRET_USER_PIN" = "0000000000000000" ] ; then
exit_error "USER PIN is still default. Check offline-SECRETS.inc."
fi
export SECRET_USERPIN_LENGTH=$(echo $SECRET_USER_PIN|wc -c)
if [ $SECRET_USERPIN_LENGTH -lt 7 ]; then
exit_error "USER PIN is too short. Check offline-SECRETS.inc."
fi
echo "Length and content check complete."
echo
#Create directories to hold the bits
echo "-------------------------------------------------------------------------------"
echo "Preflight: Creating certificate directory structure"
echo "-------------------------------------------------------------------------------"
echo
mkdir -vp ca/intermediate/{certs,crl,csr,newcerts}
mkdir -vp ca/{client,server}/{certs,csr,pfx,private}
touch ca/intermediate/database
echo 1000 | tee ca/intermediate/{serial,crlnumber}
chmod -v 700 ca/{client,server}/private
echo
echo "-------------------------------------------------------------------------------"
echo "Preflight: Verifying absence of HSM"
echo "-------------------------------------------------------------------------------"
echo
# Detect HSMs and prompt until gone.
DETECTLOOP=1;
while [ $DETECTLOOP = 1 ]; do
if [ $(pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -L 2>&1 | grep -c Slot) -gt 0 ]; then
read -p "WARNING: There is a hardware security module plugged into this machine. Please remove it now, and press ENTER."
echo
else
DETECTLOOP=0
fi
done
echo "No existing HSM present."
echo
echo "-------------------------------------------------------------------------------"
echo "==============================================================================="
echo "Intermediate CA Generation"
echo "==============================================================================="
echo
############################################################################
#offline Root HSM Stuff
############################################################################
read -p "Insert the INTERMEDIATE Nitrokey HSM (tagged as 'I') and press ENTER."
echo
# Trust, but verify
if [ $(pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -L 2>&1 | grep -c Slot) -lt 1 ]; then
exit_error "No Hardware HSM found."
fi
echo "Device found:"
echo
#List the nitrokey
pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -L
echo
#Setup the HSM for use
echo "-------------------------------------------------------------------------------"
echo "Setting up the HSM for first use."
echo "-------------------------------------------------------------------------------"
echo
pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so --login --login-type so --so-pin $FACTORY_DEFAULT_SOPIN --change-pin --new-pin $SECRET_SOPIN
sc-hsm-tool --initialize --so-pin $SECRET_SOPIN --pin $SECRET_USER_PIN
echo "-------------------------------------------------------------------------------"
echo "Creating intermediate key"
echo "-------------------------------------------------------------------------------"
echo
pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so --login --keypairgen --key-type EC:prime256v1 --label intermediate
if [ "$?" -ne 0 ]; then exit_error "Key creation failed"; fi
echo
echo "-------------------------------------------------------------------------------"
echo "Creating intermediate certificate CSR"
echo "-------------------------------------------------------------------------------"
echo
openssl req -engine pkcs11 -keyform engine -new -key label_intermediate -out ca/intermediate/csr/intermediate.csr.pem -days 10240 -subj '/C=US/ST=Texas/O=TurnNetSystems/OU=Certificate Services/CN=TSYS Intermediate CA'
if [ "$?" -ne 0 ]; then exit_error "Create CSR failed"; fi
echo
echo "-------------------------------------------------------------------------------"
echo "Signing intermediate certificate"
echo "-------------------------------------------------------------------------------"
echo
echo "Please REMOVE the INTERMEDIATE Nitrokey (marked 'I')"
echo "and INSERT the ROOT Nitrokey (marked 'R')"
read -p " and press ENTER to continue."
openssl ca -engine pkcs11 -keyform engine -name ca_root -extensions ext_intermediate -notext -in ca/intermediate/csr/intermediate.csr.pem -out ca/intermediate/certs/intermediate.cert.pem
if [ "$?" -ne 0 ]; then exit_error "Certificate signing failed."; fi
echo
echo "-------------------------------------------------------------------------------"
echo "Verifying intermediate certificate"
echo "-------------------------------------------------------------------------------"
echo
openssl x509 -noout -text -in ca/intermediate/certs/intermediate.cert.pem
if [ "$?" -ne 0 ]; then exit_error "Verification failed."; fi
openssl verify -CAfile ca/root/certs/root.cert.pem ca/intermediate/certs/intermediate.cert.pem
if [ "$?" -ne 0 ]; then exit_error "Verification failed."; fi
echo
echo "-------------------------------------------------------------------------------"
echo "Store Root and Intermediate Certificates on HSM"
echo "-------------------------------------------------------------------------------"
echo
echo "Please REMOVE the ROOT Nitrokey (marked 'R')"
echo "and INSERT the INTERMEDIATE Nitrokey (marked 'I')"
read -p " and press ENTER to continue."
openssl x509 -in ca/intermediate/certs/intermediate.cert.pem -out ca/intermediate/certs/intermediate.cert.der -outform der
if [ "$?" -ne 0 ]; then exit_error "Certificate conversion failed"; fi
pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so --login --write-object ca/root/certs/root.cert.der --type cert --label root
if [ "$?" -ne 0 ]; then exit_error "Failed to store root certificate"; fi
pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so --login --write-object ca/intermediate/certs/intermediate.cert.der --type cert --label intermediate
if [ "$?" -ne 0 ]; then exit_error "Failed to store intermediate certificate"; fi
echo
echo "-------------------------------------------------------------------------------"
echo "Creating chain certificate"
echo "-------------------------------------------------------------------------------"
echo
cat ca/intermediate/certs/intermediate.cert.pem ca/root/certs/root.cert.pem > ca/intermediate/certs/chain.cert.pem
chmod 444 ca/intermediate/certs/chain.cert.pem
echo
echo "-------------------------------------------------------------------------------"
echo "Visual verification"
echo "-------------------------------------------------------------------------------"
echo
pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -L -O
echo
echo "Done."
echo
echo "-------------------------------------------------------------------------------"
legacy-tsys-ca/admin-code/live-build-pki.tar.gz
BIN
View File
Binary file not shown.
legacy-tsys-ca/admin-code/openssl.cnf
+115
View File
@@ -0,0 +1,115 @@
openssl_conf = openssl_init
[ openssl_init ]
engines = engines
[ ca ]
default_ca = ca_intermediate
[ ca_root ]
dir = ca/root
certs = $dir/certs
crl_dir = $dir/crl
new_certs_dir = $dir/newcerts
database = $dir/database
serial = $dir/serial
crlnumber = $dir/crlnumber
private_key = label_root
certificate = $dir/certs/root.cert.pem
crl = $dir/crl/root.crl.pem
crl_extensions = ext_crl
default_md = sha256
name_opt = ca_default
cert_opt = ca_default
default_crl_days = 30
default_days = 3650
preserve = no
policy = policy_strict
[ ca_intermediate ]
dir = intermediate
certs = $dir/certs
crl_dir = $dir/crl
new_certs_dir = $dir/newcerts
database = $dir/database
serial = $dir/serial
crlnumber = $dir/crlnumber
private_key = label_intermediate
certificate = $dir/certs/intermediate.cert.pem
crl = $dir/crl/intermediate.crl.pem
crl_extensions = ext_crl
default_md = sha256
name_opt = ca_default
cert_opt = ca_default
default_crl_days = 30
default_days = 375
preserve = no
policy = policy_loose
[ policy_strict ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ policy_loose ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ req ]
default_bits = 2048
string_mask = utf8only
default_md = sha256
distinguished_name = req_distinguished_name
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
stateOrProvinceName = State or Province Name
localityName = Locality Name
0.organizationName = Organization Name
organizationalUnitName = Organizational Unit Name
commonName = Common Name
emailAddress = Email Address
[ ext_root ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
[ ext_intermediate ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
[ ext_client ]
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, emailProtection
[ ext_server ]
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
[ ext_crl ]
authorityKeyIdentifier = keyid:always
[ ext_ocsp ]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid, issuer
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, OCSPSigning
[ engines ]
pkcs11 = engine_pkcs11
[ engine_pkcs11 ]
engine_id = pkcs11
dynamic_path = /usr/lib/x86_64-linux-gnu/engines-1.1/pkcs11.so
MODULE_PATH = /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
init = 1
legacy-tsys-ca/admin-code/pki.diag
+14
View File
@@ -0,0 +1,14 @@
blockdiag {
"Offline Root CA" -> "Online Long Lived Intermediate CA";
"Offline Root CA" -> "Online Long Lived Intermediate CA" -> "TSYS - Corporate CA - USA";
"Offline Root CA" -> "Online Long Lived Intermediate CA" -> "TSYS - Corporate CA - International";
"Offline Root CA" -> "Online Long Lived Intermediate CA" -> "Suborbital - PocketMesh - General CA - USA";
"Offline Root CA" -> "Online Long Lived Intermediate CA" -> "Suborbital - PocketMesh - General CA - International";
"Offline Root CA" -> "Online Long Lived Intermediate CA" -> "Suborbital - SkyMesh - General CA - USA";
"Offline Root CA" -> "Online Long Lived Intermediate CA" -> "RackRental- General CA - USA";
"Offline Root CA" -> "Online Long Lived Intermediate CA" -> "RackRental- International CA";
"Offline Root CA" -> "Online Long Lived Intermediate CA" -> "USG CA" -> "RackRental - USG CA";
"Offline Root CA" -> "Online Long Lived Intermediate CA" -> "USG CA" -> "Suborbital - PocketMesh - USG CA";
"Offline Root CA" -> "Online Long Lived Intermediate CA" -> "USG CA" -> "Suborbital - SkyMesh - USG CA";
}
legacy-tsys-ca/admin-code/pki.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 22 KiB

legacy-tsys-ca/tsys-bits/intermediate/certs/chain.cert.pem
+28
View File
@@ -0,0 +1,28 @@
-----BEGIN CERTIFICATE-----
MIICNTCCAdygAwIBAgICEAAwCgYIKoZIzj0EAwIwbDELMAkGA1UEBhMCVVMxDjAM
BgNVBAgMBVRleGFzMRcwFQYDVQQKDA5UdXJuTmV0U3lzdGVtczEdMBsGA1UECwwU
Q2VydGlmaWNhdGUgU2VydmljZXMxFTATBgNVBAMMDFRTWVMgUm9vdCBDQTAeFw0x
ODA1MjYwMTM1NTNaFw0yODA1MjMwMTM1NTNaMHQxCzAJBgNVBAYTAlVTMQ4wDAYD
VQQIDAVUZXhhczEXMBUGA1UECgwOVHVybk5ldFN5c3RlbXMxHTAbBgNVBAsMFENl
cnRpZmljYXRlIFNlcnZpY2VzMR0wGwYDVQQDDBRUU1lTIEludGVybWVkaWF0ZSBD
QTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOvDEmYWB9j42XbS8vreHl6V7jx7
eAw7uJGx80NwnUxDNsr+mTlSUMB3Z+7ppAG8q56AYaYCmJ0EeLquI4j48cyjZjBk
MB0GA1UdDgQWBBS/2ufN7K3FSVsaRdOyVtRD0j+ZhzAfBgNVHSMEGDAWgBREJ92X
kahcElWwHaNEYzJ6jbHU+TASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQE
AwIBhjAKBggqhkjOPQQDAgNHADBEAiB0Szlopj/4m5Gh10GM3cJVIKSaIEhpbZn1
e9DDh6boWwIgHmZUCaDV1F+3yAHC2Ua+bJPKkmcsmGWc956F76mj21E=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIICMTCCAdigAwIBAgIJAP0coUv+FyQYMAoGCCqGSM49BAMCMGwxCzAJBgNVBAYT
AlVTMQ4wDAYDVQQIDAVUZXhhczEXMBUGA1UECgwOVHVybk5ldFN5c3RlbXMxHTAb
BgNVBAsMFENlcnRpZmljYXRlIFNlcnZpY2VzMRUwEwYDVQQDDAxUU1lTIFJvb3Qg
Q0EwHhcNMTgwNTI2MDEzMjUzWhcNNDYwNjE3MDEzMjUzWjBsMQswCQYDVQQGEwJV
UzEOMAwGA1UECAwFVGV4YXMxFzAVBgNVBAoMDlR1cm5OZXRTeXN0ZW1zMR0wGwYD
VQQLDBRDZXJ0aWZpY2F0ZSBTZXJ2aWNlczEVMBMGA1UEAwwMVFNZUyBSb290IENB
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQwCbkoUzB2WRAP4JgXzBQ/0qrXKV
LfSAzr6MH9Y8SsIIgE4YBd3ROiudAcUjIObbfJcgZTmjkDtig+hHRCwMa6NjMGEw
HQYDVR0OBBYEFEQn3ZeRqFwSVbAdo0RjMnqNsdT5MB8GA1UdIwQYMBaAFEQn3ZeR
qFwSVbAdo0RjMnqNsdT5MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGG
MAoGCCqGSM49BAMCA0cAMEQCICw1tWHkvCwo6FJrmWqLlzrR3AsZaU0Fv7sL2GTE
R06yAiBAsiGtwNTaN+L3wgyhMt+ybmNlrDpgqFJVzKrfbGbQCA==
-----END CERTIFICATE-----
legacy-tsys-ca/tsys-bits/intermediate/certs/intermediate.cert.der
BIN
View File
Binary file not shown.
legacy-tsys-ca/tsys-bits/intermediate/certs/intermediate.cert.pem
+14
View File
@@ -0,0 +1,14 @@
-----BEGIN CERTIFICATE-----
MIICNTCCAdygAwIBAgICEAAwCgYIKoZIzj0EAwIwbDELMAkGA1UEBhMCVVMxDjAM
BgNVBAgMBVRleGFzMRcwFQYDVQQKDA5UdXJuTmV0U3lzdGVtczEdMBsGA1UECwwU
Q2VydGlmaWNhdGUgU2VydmljZXMxFTATBgNVBAMMDFRTWVMgUm9vdCBDQTAeFw0x
ODA1MjYwMTM1NTNaFw0yODA1MjMwMTM1NTNaMHQxCzAJBgNVBAYTAlVTMQ4wDAYD
VQQIDAVUZXhhczEXMBUGA1UECgwOVHVybk5ldFN5c3RlbXMxHTAbBgNVBAsMFENl
cnRpZmljYXRlIFNlcnZpY2VzMR0wGwYDVQQDDBRUU1lTIEludGVybWVkaWF0ZSBD
QTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOvDEmYWB9j42XbS8vreHl6V7jx7
eAw7uJGx80NwnUxDNsr+mTlSUMB3Z+7ppAG8q56AYaYCmJ0EeLquI4j48cyjZjBk
MB0GA1UdDgQWBBS/2ufN7K3FSVsaRdOyVtRD0j+ZhzAfBgNVHSMEGDAWgBREJ92X
kahcElWwHaNEYzJ6jbHU+TASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQE
AwIBhjAKBggqhkjOPQQDAgNHADBEAiB0Szlopj/4m5Gh10GM3cJVIKSaIEhpbZn1
e9DDh6boWwIgHmZUCaDV1F+3yAHC2Ua+bJPKkmcsmGWc956F76mj21E=
-----END CERTIFICATE-----
legacy-tsys-ca/tsys-bits/intermediate/crlnumber
+1
View File
@@ -0,0 +1 @@
1000
legacy-tsys-ca/tsys-bits/intermediate/csr/intermediate.csr.pem
+9
View File
@@ -0,0 +1,9 @@
-----BEGIN CERTIFICATE REQUEST-----
MIIBMDCB1gIBADB0MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxFzAVBgNV
BAoMDlR1cm5OZXRTeXN0ZW1zMR0wGwYDVQQLDBRDZXJ0aWZpY2F0ZSBTZXJ2aWNl
czEdMBsGA1UEAwwUVFNZUyBJbnRlcm1lZGlhdGUgQ0EwWTATBgcqhkjOPQIBBggq
hkjOPQMBBwNCAATrwxJmFgfY+Nl20vL63h5ele48e3gMO7iRsfNDcJ1MQzbK/pk5
UlDAd2fu6aQBvKuegGGmApidBHi6riOI+PHMoAAwCgYIKoZIzj0EAwIDSQAwRgIh
APnVJ+ccmmmBbpvg4Y+NqOAxkG8j1JRfZivxmmCp4CmQAiEA4geKErqT/UQ5BEOj
OnmVupYmsMIFHZhF4GSh84ImN4g=
-----END CERTIFICATE REQUEST-----
legacy-tsys-ca/tsys-bits/intermediate/database
View File
legacy-tsys-ca/tsys-bits/intermediate/serial
+1
View File
@@ -0,0 +1 @@
1000
legacy-tsys-ca/tsys-bits/root/certs/root.cert.der
BIN
View File
Binary file not shown.
legacy-tsys-ca/tsys-bits/root/certs/root.cert.pem
+14
View File
@@ -0,0 +1,14 @@
-----BEGIN CERTIFICATE-----
MIICMTCCAdigAwIBAgIJAP0coUv+FyQYMAoGCCqGSM49BAMCMGwxCzAJBgNVBAYT
AlVTMQ4wDAYDVQQIDAVUZXhhczEXMBUGA1UECgwOVHVybk5ldFN5c3RlbXMxHTAb
BgNVBAsMFENlcnRpZmljYXRlIFNlcnZpY2VzMRUwEwYDVQQDDAxUU1lTIFJvb3Qg
Q0EwHhcNMTgwNTI2MDEzMjUzWhcNNDYwNjE3MDEzMjUzWjBsMQswCQYDVQQGEwJV
UzEOMAwGA1UECAwFVGV4YXMxFzAVBgNVBAoMDlR1cm5OZXRTeXN0ZW1zMR0wGwYD
VQQLDBRDZXJ0aWZpY2F0ZSBTZXJ2aWNlczEVMBMGA1UEAwwMVFNZUyBSb290IENB
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQwCbkoUzB2WRAP4JgXzBQ/0qrXKV
LfSAzr6MH9Y8SsIIgE4YBd3ROiudAcUjIObbfJcgZTmjkDtig+hHRCwMa6NjMGEw
HQYDVR0OBBYEFEQn3ZeRqFwSVbAdo0RjMnqNsdT5MB8GA1UdIwQYMBaAFEQn3ZeR
qFwSVbAdo0RjMnqNsdT5MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGG
MAoGCCqGSM49BAMCA0cAMEQCICw1tWHkvCwo6FJrmWqLlzrR3AsZaU0Fv7sL2GTE
R06yAiBAsiGtwNTaN+L3wgyhMt+ybmNlrDpgqFJVzKrfbGbQCA==
-----END CERTIFICATE-----
legacy-tsys-ca/tsys-bits/root/crlnumber
+1
View File
@@ -0,0 +1 @@
1000
legacy-tsys-ca/tsys-bits/root/database
+1
View File
@@ -0,0 +1 @@
V 280523013553Z 1000 unknown /C=US/ST=Texas/O=TurnNetSystems/OU=Certificate Services/CN=TSYS Intermediate CA
legacy-tsys-ca/tsys-bits/root/database.attr
+1
View File
@@ -0,0 +1 @@
unique_subject = yes
legacy-tsys-ca/tsys-bits/root/database.old
View File
legacy-tsys-ca/tsys-bits/root/newcerts/1000.pem
+14
View File
@@ -0,0 +1,14 @@
-----BEGIN CERTIFICATE-----
MIICNTCCAdygAwIBAgICEAAwCgYIKoZIzj0EAwIwbDELMAkGA1UEBhMCVVMxDjAM
BgNVBAgMBVRleGFzMRcwFQYDVQQKDA5UdXJuTmV0U3lzdGVtczEdMBsGA1UECwwU
Q2VydGlmaWNhdGUgU2VydmljZXMxFTATBgNVBAMMDFRTWVMgUm9vdCBDQTAeFw0x
ODA1MjYwMTM1NTNaFw0yODA1MjMwMTM1NTNaMHQxCzAJBgNVBAYTAlVTMQ4wDAYD
VQQIDAVUZXhhczEXMBUGA1UECgwOVHVybk5ldFN5c3RlbXMxHTAbBgNVBAsMFENl
cnRpZmljYXRlIFNlcnZpY2VzMR0wGwYDVQQDDBRUU1lTIEludGVybWVkaWF0ZSBD
QTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOvDEmYWB9j42XbS8vreHl6V7jx7
eAw7uJGx80NwnUxDNsr+mTlSUMB3Z+7ppAG8q56AYaYCmJ0EeLquI4j48cyjZjBk
MB0GA1UdDgQWBBS/2ufN7K3FSVsaRdOyVtRD0j+ZhzAfBgNVHSMEGDAWgBREJ92X
kahcElWwHaNEYzJ6jbHU+TASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQE
AwIBhjAKBggqhkjOPQQDAgNHADBEAiB0Szlopj/4m5Gh10GM3cJVIKSaIEhpbZn1
e9DDh6boWwIgHmZUCaDV1F+3yAHC2Ua+bJPKkmcsmGWc956F76mj21E=
-----END CERTIFICATE-----
legacy-tsys-ca/tsys-bits/root/serial
+1
View File
@@ -0,0 +1 @@
1001
legacy-tsys-ca/tsys-bits/root/serial.old
+1
View File
@@ -0,0 +1 @@
1000
scripts/check-rules.sh
+2 -2
View File
@@ -41,7 +41,7 @@ TODAY="$(date +%Y-%m-%d)"
# Runs in Docker so the host stays clean (no native shellcheck required).
# ----------------------------------------------------------------------------
$RULE_VERBOSE && log_step "Shell scripts (shellcheck)"
mapfile -d '' SH_FILES < <(find . -path ./.git -prune -o -path ./.tmp -prune -o -path ./.crush -prune -o -path ./vendor -prune -o -path ./oam/librenms-agent/agent -prune -o -path ./archive -prune -o -path ./node_modules -prune -o \( -name '*.sh' -o -name '*.bash' \) -print0 2>/dev/null)
mapfile -d '' SH_FILES < <(find . -path ./.git -prune -o -path ./.tmp -prune -o -path ./.crush -prune -o -path ./vendor -prune -o -path ./oam/librenms-agent/agent -prune -o -path ./archive -prune -o -path ./node_modules -prune -o -path ./legacy-tsys-ca -prune -o \( -name '*.sh' -o -name '*.bash' \) -print0 2>/dev/null)
if [ "${#SH_FILES[@]}" -gt 0 ]; then
if have shellcheck; then
if shellcheck "${SH_FILES[@]}" >/dev/null 2>&1; then
@@ -163,7 +163,7 @@ while IFS= read -r -d '' f; do
POINTER_MISSING=$((POINTER_MISSING + 1))
$RULE_VERBOSE && printf ' %s\n' "$f"
fi
done < <(find . -path ./.git -prune -o -path ./.crush -prune -o -path ./.tmp -prune -o -path ./vendor -prune -o -path ./archive -prune -o -name '*.md' -print0 2>/dev/null)
done < <(find . -path ./.git -prune -o -path ./.crush -prune -o -path ./.tmp -prune -o -path ./vendor -prune -o -path ./archive -prune -o -path "./legacy-*" -prune -o -name "*.md" -print0 2>/dev/null)
if [ "$POINTER_MISSING" -eq 0 ]; then
check "All non-exempt .md cite Discourse ($DISCOURSE_HOST)" "pass"
else