Changed EC types for all X509 certificates

This was done because because the previously used P512 EC isn't supported by Chrome anymore. Moved from P521 to P384 for CA certificiates Moved from P384 to P256 for SVID certificates Signed-off-by: Lukas Eichler <[email protected]>
spiffe · May 14, 2018 · 40a7958 · 40a7958
1 parent 351a5eb
commit 40a7958
Show file tree

Hide file tree

Showing 8 changed files with 29 additions and 34 deletions.
diff --git a/conf/agent/dummy_root_ca.crt b/conf/agent/dummy_root_ca.crt
@@ -1,14 +1,12 @@
 -----BEGIN CERTIFICATE-----
-MIICGDCCAXmgAwIBAgIJAOHE9guUAAT+MAoGCCqGSM49BAMEMB4xCzAJBgNVBAYT
-AlVTMQ8wDQYDVQQKDAZTUElGRkUwHhcNMTgwMjA5MjMyMDMzWhcNMjMwMjA4MjMy
-MDMzWjAeMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGU1BJRkZFMIGbMBAGByqGSM49
-AgEGBSuBBAAjA4GGAAQAFdIuWYoD5N1OW7BOaGLrBA8UKKMQFGj8ca04rhyWTmWx
-vLbQNIQASR/7zkKfy0RBpVO4lIpJuBYZ5F1JOCbXZw0BUsM4Ep/fZyU9R/HFicC/
-i+FFwOvysdqzTRio+be9gj0ffDutZnlE65Kfq2rO0tAi24Oy6OasCXABp3DevaaP
-zjejXTBbMB0GA1UdDgQWBBRGyozl9Mjue0Y3w4c2Q+3u+wVkCjAPBgNVHRMBAf8E
-BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAZBgNVHREEEjAQhg5zcGlmZmU6Ly9sb2Nh
-bDAKBggqhkjOPQQDBAOBjAAwgYgCQgH88iOV1aEVC8o7ObMarJo3NopVyeiWwgO9
-gVH/zNfG0MREdgqv+63/+r5OhYOBst9r+vG+d6blnKWtPEQg19GVYwJCAfKb78x6
-l1p6Yykvd7B76PziL16EuXfplRiqMxG7BK/dxwHjrE0xLyqQMNHRbWi382tT8xd0
-YfMt9+olA+qjcjoH
+MIIBzDCCAVOgAwIBAgIJAJM4DhRH0vmuMAoGCCqGSM49BAMEMB4xCzAJBgNVBAYT
+AlVTMQ8wDQYDVQQKDAZTUElGRkUwHhcNMTgwNTEzMTkzMzQ3WhcNMjMwNTEyMTkz
+MzQ3WjAeMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGU1BJRkZFMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAEWjB+nSGSxIYiznb84xu5WGDZj80nL7W1c3zf48Why0ma7Y7m
+CBKzfQkrgDguI4j0Z+0/tDH/r8gtOtLLrIpuMwWHoe4vbVBFte1vj6Xt6WeE8lXw
+cCvLs/mcmvPqVK9jo10wWzAdBgNVHQ4EFgQUh6XzV6LwNazA+GTEVOdu07o5yOgw
+DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwGQYDVR0RBBIwEIYOc3Bp
+ZmZlOi8vbG9jYWwwCgYIKoZIzj0EAwQDZwAwZAIwE4Me13qMC9i6Fkx0h26y09QZ
+IbuRqA9puLg9AeeAAyo5tBzRl1YL0KNEp02VKSYJAjBdeJvqjJ9wW55OGj1JQwDF
+D7kWeEB6oMlwPbI/5hEY3azJi16I0uN1JSYTSWGSqWc=
 -----END CERTIFICATE-----
diff --git a/conf/server/dummy_upstream_ca.crt b/conf/server/dummy_upstream_ca.crt
@@ -1,14 +1,12 @@
 -----BEGIN CERTIFICATE-----
-MIICGDCCAXmgAwIBAgIJAOHE9guUAAT+MAoGCCqGSM49BAMEMB4xCzAJBgNVBAYT
-AlVTMQ8wDQYDVQQKDAZTUElGRkUwHhcNMTgwMjA5MjMyMDMzWhcNMjMwMjA4MjMy
-MDMzWjAeMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGU1BJRkZFMIGbMBAGByqGSM49
-AgEGBSuBBAAjA4GGAAQAFdIuWYoD5N1OW7BOaGLrBA8UKKMQFGj8ca04rhyWTmWx
-vLbQNIQASR/7zkKfy0RBpVO4lIpJuBYZ5F1JOCbXZw0BUsM4Ep/fZyU9R/HFicC/
-i+FFwOvysdqzTRio+be9gj0ffDutZnlE65Kfq2rO0tAi24Oy6OasCXABp3DevaaP
-zjejXTBbMB0GA1UdDgQWBBRGyozl9Mjue0Y3w4c2Q+3u+wVkCjAPBgNVHRMBAf8E
-BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAZBgNVHREEEjAQhg5zcGlmZmU6Ly9sb2Nh
-bDAKBggqhkjOPQQDBAOBjAAwgYgCQgH88iOV1aEVC8o7ObMarJo3NopVyeiWwgO9
-gVH/zNfG0MREdgqv+63/+r5OhYOBst9r+vG+d6blnKWtPEQg19GVYwJCAfKb78x6
-l1p6Yykvd7B76PziL16EuXfplRiqMxG7BK/dxwHjrE0xLyqQMNHRbWi382tT8xd0
-YfMt9+olA+qjcjoH
+MIIBzDCCAVOgAwIBAgIJAJM4DhRH0vmuMAoGCCqGSM49BAMEMB4xCzAJBgNVBAYT
+AlVTMQ8wDQYDVQQKDAZTUElGRkUwHhcNMTgwNTEzMTkzMzQ3WhcNMjMwNTEyMTkz
+MzQ3WjAeMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGU1BJRkZFMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAEWjB+nSGSxIYiznb84xu5WGDZj80nL7W1c3zf48Why0ma7Y7m
+CBKzfQkrgDguI4j0Z+0/tDH/r8gtOtLLrIpuMwWHoe4vbVBFte1vj6Xt6WeE8lXw
+cCvLs/mcmvPqVK9jo10wWzAdBgNVHQ4EFgQUh6XzV6LwNazA+GTEVOdu07o5yOgw
+DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwGQYDVR0RBBIwEIYOc3Bp
+ZmZlOi8vbG9jYWwwCgYIKoZIzj0EAwQDZwAwZAIwE4Me13qMC9i6Fkx0h26y09QZ
+IbuRqA9puLg9AeeAAyo5tBzRl1YL0KNEp02VKSYJAjBdeJvqjJ9wW55OGj1JQwDF
+D7kWeEB6oMlwPbI/5hEY3azJi16I0uN1JSYTSWGSqWc=
 -----END CERTIFICATE-----
diff --git a/conf/server/dummy_upstream_ca.key b/conf/server/dummy_upstream_ca.key
@@ -1,7 +1,6 @@
 -----BEGIN EC PRIVATE KEY-----
-MIHcAgEBBEIBaB7PXZ7ISu9nSaC24XL36n3CNCSPyqr4G7NMAb1pQZyBpFNR/5X/
-/klPmetQQpdF0cHMosDRfAYZiI866pFKz02gBwYFK4EEACOhgYkDgYYABAAV0i5Z
-igPk3U5bsE5oYusEDxQooxAUaPxxrTiuHJZOZbG8ttA0hABJH/vOQp/LREGlU7iU
-ikm4FhnkXUk4JtdnDQFSwzgSn99nJT1H8cWJwL+L4UXA6/Kx2rNNGKj5t72CPR98
-O61meUTrkp+ras7S0CLbg7Lo5qwJcAGncN69po/ONw==
+MIGkAgEBBDAg2LbulXzQX1NF+2Di0RKzMWfEGioBhh/fFpx7yOEqka//TpaeU3O5
+QJRZXdWHKuagBwYFK4EEACKhZANiAARaMH6dIZLEhiLOdvzjG7lYYNmPzScvtbVz
+fN/jxaHLSZrtjuYIErN9CSuAOC4jiPRn7T+0Mf+vyC060susim4zBYeh7i9tUEW1
+7W+Ppe3pZ4TyVfBwK8uz+Zya8+pUr2M=
 -----END EC PRIVATE KEY-----
diff --git a/pkg/agent/manager/sync.go b/pkg/agent/manager/sync.go
@@ -251,7 +251,7 @@ func (m *manager) rotateSVID() error {
 }
 
 func (m *manager) newCSR(spiffeID string) (pk *ecdsa.PrivateKey, csr []byte, err error) {
-	pk, err = ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+	pk, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
 		return
 	}

diff --git a/pkg/agent/plugin/keymanager/disk/disk.go b/pkg/agent/plugin/keymanager/disk/disk.go
@@ -38,7 +38,7 @@ func (d *diskPlugin) GenerateKeyPair(*keymanager.GenerateKeyPairRequest) (*keyma
 	keyPath := path.Join(d.dir, keyFileName)
 	d.mtx.RUnlock()
 
-	key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
 		return nil, err
 	}

diff --git a/pkg/agent/plugin/keymanager/memory/memory.go b/pkg/agent/plugin/keymanager/memory/memory.go
@@ -15,7 +15,7 @@ type MemoryPlugin struct {
 }
 
 func (m *MemoryPlugin) GenerateKeyPair(*keymanager.GenerateKeyPairRequest) (key *keymanager.GenerateKeyPairResponse, err error) {
-	m.key, err = ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+	m.key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	privateKey, err := x509.MarshalECPrivateKey(m.key)
 	if err != nil {
 		return

diff --git a/pkg/server/plugin/ca/memory/memory.go b/pkg/server/plugin/ca/memory/memory.go
@@ -148,7 +148,7 @@ func (m *MemoryPlugin) GenerateCsr(*ca.GenerateCsrRequest) (*ca.GenerateCsrRespo
 	m.mtx.Lock()
 	defer m.mtx.Unlock()
 
-	newKey, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+	newKey, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
 	if err != nil {
 		return nil, errors.New("Can't generate private key: " + err.Error())
 	}

diff --git a/script/generate_dummy_ca.sh b/script/generate_dummy_ca.sh
@@ -5,7 +5,7 @@
 # and key in the configuration directory, replacing any existing dummy certificates.
 #
 
-openssl ecparam -name secp521r1 -genkey -noout -out dummy_upstream_ca.key
+openssl ecparam -name secp384r1 -genkey -noout -out dummy_upstream_ca.key
 openssl req -new -x509 -key dummy_upstream_ca.key -out dummy_upstream_ca.crt -days 1825 -subj "/C=US/ST=/L=/O=SPIFFE/OU=/CN=/"  -config <(
 cat <<-EOF
 [req]