YaPI::CaManagement
This package is the public Yast2 API to the CA management.
use YaPI::CaManagement
$caList = ReadCAList()
returns a list of available CAs
$bool = AddRootCA($valueMap)
create a new selfsigned root CA
$certValueMap = ReadCertificateDefaults($valueMap)
returns a map with defaults for the requested certificate type
$bool = WriteCertificateDefaults($valueMap)
write the default values for the available certificate types
$ca = ReadCA($valueMap)
returns a CA certificate as plain text or parsed map
$name = AddRequest($valueMap)
create a request for a special CA and returns the name $name = IssueCertificate($valueMap)
issue a certificate and returns the name of the new certificate
$name = AddCertificate($valueMap)
create a new Certificate and returns the name
$certList = ReadCertificateList($valueMap)
returns a list of maps with all certificates of a special CA
$bool = UpdateDB($valueMap)
update the internal openssl database
$cert = ReadCertificate($valueMap)
returns a certificate as plain text or parsed map $bool = RevokeCertificate($valueMap)
revoke a certificate
$bool = AddCRL($valueMap)
create a CRL
$crl = ReadCRL($valueMap)
returns a CRL as plain text or parsed map
$file = ExportCA($valueMap)
Export a CA to a file or returns it in different formats
$file = ExportCertificate($valueMap)
Export a certificate to a file or returns it in different formats
$file = ExportCRL($valueMap)
Export a CRL to a file or returns it in different formats
$bool = Verify($valueMap)
verify a certificate
$bool = AddSubCA($valueMap)
Create a new CA which signed by another CA
$bool = ExportCAToLDAP($valueMap)
Export a CA to a LDAP directory
$bool = ExportCRLToLDAP($valueMap)
Export a CRL to a LDAP directory
$bool = ExportCertificateToLDAP($valueMap)
Export a Certificate in a LDAP Directory.
$defaultsMap = ReadLDAPExportDefaults($valueMap)
Return the defaults for export CA, CRL or certificates to LDAP.
$bool = InitLDAPcaManagement($valueMap)
Creates the default configuration structure in LDAP
$bool = DeleteCertificate($valueMap)
Delete a Certificate. This function removes also the request and the private key.
$bool = ImportCommonServerCertificate($valueMap)
Import a server certificate plus correspondenting CA and copy them to a place where other YaST modules look for such a common certificate.
$bool = ReadFile($valueMap)
Returns a certificate or CRL as plain text or parsed map.
Here is a list of common parameter which are often used in $valueMap
allowed values are:
client, server, ca
(without suffix)
(without suffix)
(ascii)
( must be greater or equal 512 )
allowed values are:
unspecified, keyCompromise, CACompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold
X509v3 extensions. All values can have the parameter critical as first value. Combinations can be done via ',' if they are allowed.
CA:TRUE, CA:FALSE, pathlen:<integer>
allowed values are:
client, server, email, objsign, reserved, sslCA, emailCA, objCA
allowed values are:
digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly
allowed values are:
"hash" or a Hex String
allowed values are:
issuer[:always], keyid[:always]
allowed values are:
email:<email-address>, URI:<URL>, DNS:<domain_name>, RID:<object_identifier>, IP:<ip_address>, email:copy
allowed values are:
email:<email-address>, URI:<URL>, DNS:<domain_name>, RID:<object_identifier>, IP:<ip_address>, issuer:copy
allowed values are:
serverAuth, clientAuth, codeSigning, emailProtection, timeStamping, msCodeInd, msCodeCom, msCTLSign, msSGC, msEFS, nsSGC, <object_identifier>
a list of explanation:
"serverAuth" SSL/TLS Web Server Authentication. "clientAuth" SSL/TLS Web Client Authentication. "codeSigning" Code signing. "emailProtection" E-mail Protection (S/MIME). "timeStamping" Trusted Timestamping "msCodeInd" Microsoft Individual Code Signing (authenticode) "msCodeCom" Microsoft Commercial Code Signing (authenticode) "msCTLSign" Microsoft Trust List Signing "msSGC" Microsoft Server Gated Crypto "msEFS" Microsoft Encrypted File System "nsSGC" Netscape Server Gated Crypto
accessOID can be: OCSP, caIssuers or a <object_identifier>
location can be: email:<email-address>, URI:<URL>, DNS:<domain_name>, RID:<object_identifier>, IP:<ip_address>
$caList = ReadCAList()
EXAMPLE:
my $caList = YaPI::CaManagement->ReadCAList(); if(not defined $caList) { #error }
foreach my $ca (@$caList) { print $ca."\n"; }
$bool = AddRootCA($valueMap)
$valueMap supports the following Keys:
* caName (required)
* keyPasswd (required)
* commonName (required)
* emailAddress (depending on CA policy)
* keyLength (default 2048 min: 512 max: 9999)
* days (default 3650)
* countryName (depending on CA policy)
* stateOrProvinceName (depending on CA policy)
* localityName (depending on CA policy)
* organizationName (depending on CA policy)
* organizationalUnitName (depending on CA policy)
* challengePassword
* unstructuredName
* basicConstraints (required)
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* authorityKeyIdentifier
* subjectAltName
* issuerAltName
* nsBaseUrl
* nsRevocationUrl
* nsCaRevocationUrl
* nsRenewalUrl
* nsCaPolicyUrl
* nsSslServerName
* extendedKeyUsage
* authorityInfoAccess
* crlDistributionPoints
The syntax of these values are explained in the COMMON PARAMETER section.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'keyPasswd' => 'system', 'commonName' => 'My CA', 'emailAddress' => 'my@example.com', 'keyLength' => '2048', 'days' => '3650', 'countryName' => 'US', 'localityName' => 'New York', 'organizationName' => 'My Inc.', };
my $res = YaPI::CaManagement->AddRootCA($data); if( not defined $res ) { # error } else { print "OK\n"; }
$certValueMap = ReadCertificateDefaults($valueMap)
* caName (if not defined, read defaults for a Root CA)
* certType
Returns a map with defaults for the requested certificate type. The return value is ``undef'' on an error.
On success the return value is a hash which can contain the following keys:
* basicConstraints
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* authorityKeyIdentifier
* subjectAltName
* issuerAltName
* nsBaseUrl
* nsRevocationUrl
* nsCaRevocationUrl
* nsRenewalUrl
* nsCaPolicyUrl
* nsSslServerName
* extendedKeyUsage
* authorityInfoAccess
* crlDistributionPoints
* keyLength
* days
* DN
DN is a hash which contains some values of the subject of the CA Certificate (if caName is defined)
The syntax of these values are explained in the COMMON PARAMETER section.
EXAMPLE:
use Data::Dumper;
my $data = { 'caName' => 'My_CA', 'certType' => 'client' } $certValueMap = YaPI::CaManagement->ReadCertificateDefaults($data) if( not defined $certValueMap ) { # error } else { print Data::Dumper->Dump([$certValueMap])."\n"; }
$bool = WriteCertificateDefaults($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* certType (required)
* basicConstraints
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* authorityKeyIdentifier
* subjectAltName
* issuerAltName
* nsBaseUrl
* nsRevocationUrl
* nsCaRevocationUrl
* nsRenewalUrl
* nsCaPolicyUrl
* nsSslServerName
* extendedKeyUsage
* authorityInfoAccess
* crlDistributionPoints
* days
* keyLength
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'certType' => 'server', 'nsComment' => '"My Server Certificate"' }; my $res = YaPI::CaManagement->WriteCertificateDefaults($data); if( not defined $res ) { # error } else { print "OK\n"; } }
$ca = ReadCA($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* type (required; can be ``plain'' or ``parsed'')
The return value is ``undef'' on an error.
On success and type = ``plain'' the plain text view of the CA is returned.
If the type = ``parsed'' a complex structure with the single values is returned.
EXAMPLE:
use Data::Dumper;
foreach my $type ("parsed", "plain") { my $data = { 'caName' => 'My_CA', 'type' => $type }; my $res = YaPI::CaManagement->ReadCA($data); if( not defined $res ) { # error } else { print Data::Dumper->Dump([$res])."\n"; } }
$name = AddRequest($valueMap)
The keys in $valueMap are:
* caName (required)
* keyPasswd (required)
* commonName (required)
* emailAddress (depending on CA policy)
* keyLength (required)
* countryName (depending on CA policy)
* stateOrProvinceName (depending on CA policy)
* localityName (depending on CA policy)
* organizationName (depending on CA policy)
* oganizationalUnitName (depending on CA policy)
* challengePassword
* unstructuredName
* basicConstraints
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* subjectAltName
* nsSslServerName
* extendedKeyUsage
* authorityInfoAccess
The return value is ``undef'' on an error and the filename(without suffix) of the request on success.
The syntax of these values are explained in the COMMON PARAMETER section.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'keyPasswd' => 'system', 'commonName' => 'My New Request', 'emailAddress' => 'my@example.com', 'keyLength' => '2048', 'days' => '365', 'countryName' => 'DE', 'localityName' => 'Nuremberg', 'stateOrProvinceName' => 'Bavaria', 'organizationName' => 'My Linux AG', 'nsComment' => "YaST Generated Certificate" }; my $res = YaPI::CaManagement->AddRequest($data); if( not defined $res ) { # error } else { print "OK Name of the request is: '$res'\n"; }
$name = IssueCertificate($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* request (required - the name of the request without suffix)
* certType (required - allowed values are: ``client'', ``server'' and ``ca'')
* caPasswd (required)
* days (required)
* basicConstraints (required)
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* authorityKeyIdentifier
* subjectAltName
* issuerAltName
* nsBaseUrl
* nsRevocationUrl
* nsCaRevocationUrl
* nsRenewalUrl
* nsCaPolicyUrl
* nsSslServerName
* extendedKeyUsage
* authorityInfoAccess
* crlDistributionPoints
The return value is ``undef'' on an error and the filename(without suffix) of the certificate on success.
The syntax of these values are explained in the COMMON PARAMETER section.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'request' => $request, 'certType' => 'client', 'caPasswd' => 'system', 'days' => '365', 'crlDistributionPoints' => "URI:ldap://my.linux.tux/?cn=My_CA%2Cou=PKI%2Cdc=example%2Cdc=com", 'nsComment' => "YaST Generated Certificate", }; my $res = YaPI::CaManagement->IssueCertificate($data); if( not defined $res ) { # error } else { print STDERR "OK: '$res'\n"; }
$name = AddCertificate($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* certType (required - ``client'', ``server'' or ``ca'' )
* keyPasswd (required)
* caPasswd (required)
* commonName (required)
* emailAddress (depending on CA policy)
* keyLength (required)
* days (required)
* countryName (depending on CA policy)
* stateOrProvinceName (depending on CA policy)
* localityName (depending on CA policy)
* organizationName (depending on CA policy)
* organizationalUnitName (depending on CA policy)
* challengePassword
* unstructuredName
* basicConstraints (required)
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* authorityKeyIdentifier
* subjectAltName
* issuerAltName
* nsBaseUrl
* nsRevocationUrl
* nsCaRevocationUrl
* nsRenewalUrl
* nsCaPolicyUrl
* nsSslServerName
* extendedKeyUsage
* authorityInfoAccess
* crlDistributionPoints
The return value is ``undef'' on an error and the filename(without suffix) of the certificate on success.
The syntax of these values are explained in the COMMON PARAMETER section.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'certType' => 'client', 'keyPasswd' => 'system', 'caPasswd' => 'system', 'commonName' => 'John Doe', 'emailAddress' => 'John.Doe@example.com', 'keyLength' => '2048', 'days' => '365', 'countryName' => 'US', 'localityName' => 'New York', 'organizationalUnitName'=> 'IT', 'organizationName' => 'My Inc.', 'crlDistributionPoints' => "URI:ldap://ldap.example.com/?cn=My_CA%2Cou=PKI%2Cdc=example%2Cdc=com", 'nsComment' => "YaST Generated Certificate", };
my $res = YaPI::CaManagement->AddCertificate($data); if( not defined $res ) { # error } else { print "OK: '$res'\n"; }
$certList = ReadCertificateList($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* caPasswd (optional)
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error.
On success it returns an array of hashes with all certificates of this CA. @ret[0..X] can have the following Hash keys:
* certificate (the name of the certificate)
* commonName
* emailAddress
* countryName
* stateOrProvinceName
* localityName
* organizationName
* organizationalUnitName
* status (The status of the certificate: ``valid'', ``revoked'', ``expired'')
EXAMPLE:
use Data::Dumper;
my $data = { 'caName' => 'My_CA', 'caPasswd' => 'system' };
my $res = YaPI::CaManagement->ReadCertificateList($data); if( not defined $res ) { # error } else { my $certificateName = $res->[0]->{'certificate'}; print Data::Dumper->Dump([$res])."\n"; }
$bool = UpdateDB($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* caPasswd (required)
The return value is ``undef'' on an error and ``1'' on success.
The syntax of these values are explained in the COMMON PARAMETER section.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'caPasswd' => 'system' };
my $res = YaPI::CaManagement->UpdateDB($data); if( not defined $res ) { # error } else { print "OK \n"; }
$cert = ReadCertificate($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* certificate (required - name without suffix)
* type (required - allowed values: ``parsed'' or ``plain'')
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error.
On success and type = plain the plain text view of the Certificate is returned.
If the type is ``parsed'' a complex structure with the single values is returned.
EXAMPLE:
use Data::Dumper;
foreach my $type ("parsed", "plain") { my $data = { 'caName' => 'My_CA', 'type' => $type, 'certificate' => $certName };
my $res = YaPI::CaManagement->ReadCertificate($data); if( not defined $res ) { # error } else { print Data::Dumper->Dump([$res])."\n"; } }
$bool = RevokeCertificate($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* caPasswd (required)
* certificate (required)
* crlReason
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'caPasswd' => 'system', 'certificate' => $certName, 'crlReason' => 'keyCompromise' };
my $res = YaPI::CaManagement->RevokeCertificate($data); if( not defined $res ) { # error } else { print "Revoke successful\n"; }
$bool = AddCRL($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* caPasswd (required)
* days (required)
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'caPasswd' => 'system', 'days' => 8 };
my $res = YaPI::CaManagement->AddCRL($data); if( not defined $res ) { # error } else { print "AddCRL successful\n"; }
$crl = ReadCRL($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* type (required - allowed values: ``parsed'' or ``plain'')
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error.
On success and type = plain the plain text view of the CRL is returned.
If the type is ``parsed'' a complex structure with the single values is returned.
EXAMPLE:
use Data::Dumper;
foreach my $type ("parsed", "plain") { my $data = { 'caName' => 'My_CA', 'type' => $type, };
my $res = YaPI::CaManagement->ReadCRL($data); if( not defined $res ) { # error } else { print Data::Dumper->Dump([$res])."\n"; } }
$file = ExportCA($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* caPassword (required)
* exportFormat <format> (required)
PEM_CERT (export only the Certificate im PEM format)
PEM_CERT_KEY (export the Certificate and the Key unencrypted in PEM Format)
PEM_CERT_ENCKEY (export the Certificate and the Key encrypted in PEM Format)
DER_CERT (export the Certificate in DER Format)
PKCS12 (export the Certificate and the Key in PKCS12 Format)
PKCS12_CHAIN (like PKCS12 + include the CA Chain )
* destinationFile (optional)
* P12Password (only for creating PKCS12 password)
The return value is ``undef'' on an error and ``1'' on success if destinationFile is defined. If destinationFile is not defined, the CA is directly returned. If the exportFormat is PEM_CERT_KEY or PEM_CERT_ENCKEY the certificate and the key are returned. Because of the PEM format it is easy to split them later.
EXAMPLE:
foreach my $ef ("PEM_CERT", "PEM_CERT_KEY", "PEM_CERT_ENCKEY","DER_CERT", "PKCS12", "PKCS12_CHAIN") { my $data = { 'caName' => 'My_CA', 'exportFormat' => $ef, 'caPasswd' => "system", }; if($ef =~ /^PKCS12/) { $data->{'P12Password'} = "p12pass"; }
my $res = YaPI::CaManagement->ExportCA($data); if( not defined $res ) { # error } else { if(! open(OUT, "> /tmp/certs/$ef")) { print STDERR "OPEN_FAILED\n"; exit 1; } print OUT $res; close OUT; } }
$file = ExportCertificate($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* keyPassword (required)
* certificate (required)
* exportFormat <format> (required)
PEM_CERT (export only the Certificate im PEM format)
PEM_CERT_KEY (export the Certificate and the Key unencrypted in PEM Format)
PEM_CERT_ENCKEY (export the Certificate and the Key encrypted in PEM Format)
DER_CERT (export the Certificate in DER Format)
PKCS12 (export the Certificate and the Key in PKCS12 Format)
PKCS12_CHAIN (like PKCS12 + include the CA Chain )
* destinationFile (optional)
* P12Password (only for creating PKCS12 password)
The return value is ``undef'' on an error and ``1'' on success if destinationFile is defined. If destinationFile is not defined, the certificate is directly returned. If the exportFormat is PEM_CERT_KEY or PEM_CERT_ENCKEY the certificate and the key are returned. Because of the PEM format it is easy to split them later.
EXAMPLE:
foreach my $ef ("PEM_CERT", "PEM_CERT_KEY", "PEM_CERT_ENCKEY","DER_CERT", "PKCS12", "PKCS12_CHAIN") { my $data = { 'caName' => 'My_CA', 'certificate' => $certName, 'exportFormat' => $ef, 'keyPasswd' => "system", }; if($ef =~ /^PKCS12/) { $data->{'P12Password'} = "p12pass"; }
my $res = YaPI::CaManagement->ExportCertificate($data); if( not defined $res ) { # error } else { if(! open(OUT, "> /tmp/certs/$ef")) { print STDERR "OPEN_FAILED\n"; exit 1; } print OUT $res; close OUT; } }
$file = ExportCRL($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* exportFormat <format> (required)
PEM - Export the CRL in PEM format
DER - Export the CRL in DER format
* destinationFile (optional)
The return value is ``undef'' on an error and ``1'' on success, if 'destinationFile' is defined. If 'destinationFile' is not defined the CRL is returned.
EXAMPLE:
foreach my $ef ("PEM", "DER") { my $data = { 'caName' => 'My_CA', 'exportFormat' => $ef, }; my $res = YaPI::CaManagement->ExportCRL($data); if( not defined $res ) { # error } else { if(! open(OUT, "> /tmp/certs/CRL_$ef")) { print STDERR "OPEN_FAILED\n"; } print OUT $res; close OUT; } }
$bool = Verify($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* certificate (required)
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' if the verification failed. On success it returns ``1''.
EXAMPLE:
$data = { 'caName' => 'My_CA', 'certificate' => $certName };
my $Vret = YaPI::CaManagement->Verify($data); if(not defined $Vret) { # verification failed } else { print "OK \n"; }
$bool = AddSubCA($valueMap)
In $valueMap you can define the following keys:
* newCaName (required - the name of the new CA)
* caName (required - the name of the CA which should issue the new CA)
* keyPasswd (required - password for the new CA)
* caPasswd (required - password for the CA which should issue the new CA)
* commonName (required)
* emailAddress (depending on CA policy)
* keyLength (required)
* days (required)
* countryName (depending on CA policy)
* stateOrProvinceName (depending on CA policy)
* localityName (depending on CA policy)
* organizationName (depending on CA policy)
* organizationalUnitName (depending on CA policy)
* challengePassword
* unstructuredName
* basicConstraints (required)
* nsComment
* nsCertType
* keyUsage
* subjectKeyIdentifier
* authorityKeyIdentifier
* subjectAltName
* issuerAltName
* nsBaseUrl
* nsRevocationUrl
* nsCaRevocationUrl
* nsRenewalUrl
* nsCaPolicyUrl
* nsSslServerName
* extendedKeyUsage
* authorityInfoAccess
* crlDistributionPoints
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { 'caName' => 'My_CA', 'newCaName' => 'My_New_Sub_CA', 'keyPasswd' => 'newPasswd', 'caPasswd' => 'system', 'commonName' => 'My CA New Sub CA', 'emailAddress' => 'my@example.com', 'keyLength' => '2048', 'days' => '3000', 'countryName' => 'US', 'localityName' => 'New York', 'organizationName' => 'My Inc.', 'basicConstraints' => 'CA:TRUE', 'crlDistributionPoints' => 'URI:http://my.example.com/', };
my $res = YaPI::CaManagement->AddSubCA($data); if( not defined $res ) { # error } else { print "OK\n"; }
$bool = ExportCAToLDAP($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* ldapHostname (required - hostname or IP address)
* ldapPort (default: 389)
* destinationDN (required)
* bindDN (required)
* ldapPasswd (required)
destinationDN is the DN to the entry where to store the CA. The following objectclasses are used:
* cRLDistributionPoint
* pkiCA
The first attribute type of the DN must be 'cn'.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { caName => 'My_CA', ldapHostname => 'myhost.example.com', ldapPort => 389, destinationDN => "cn=My_CA,ou=PKI,dc=suse,dc=de", BindDN => "cn=Admin,dc=example,dc=com", ldapPasswd => "system" };
my $res = YaPI::CaManagement->ExportCAToLDAP($data); if( not defined $res ) { # error } else { print STDERR "OK\n"; }
$bool = ExportCRLToLDAP($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* ldapHostname (required - hostname or IP address)
* ldapPort (default: 389)
* destinationDN (required)
* bindDN (required)
* ldapPasswd (required)
destinationDN is the DN to the entry where to store the CA. The following objectclasses are used:
* cRLDistributionPoint
* pkiCA
The first attribute type of the DN must be 'cn'.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { caName => 'My_CA', ldapHostname => 'myhost.example.com', ldapPort => 389, destinationDN => "cn=My_CA,ou=PKI,dc=suse,dc=de", BindDN => "cn=Admin,dc=example,dc=com", ldapPasswd => "system" };
my $res = YaPI::CaManagement->ExportCRLToLDAP($data); if( not defined $res ) { # error } else { print STDERR "OK\n"; }
$defaultsMap = ReadLDAPExportDefaults($valueMap)
In $valueMap you can define the following keys:
* type (required - allowed values are: ``ca'', ``crl'', ``certificate'')
* caName (optional)
* commonName (required - only if 'type' is 'certificate')
* emailAddress (optional - only if 'type' is 'certificate')
The return value is ``undef'' on an error.
On success a map is returned with the following keys:
* ldapHostname
* ldapPort
* BindDN
* destinationDN
The value of destinationDN is an array.
EXAMPLE:
use Data::Dumper;
my $data = { 'caName' => 'My_CA', 'type' => 'ca' };
my $res = YaPI::CaManagement->ReadLDAPExportDefaults($data);
if( not defined $res ) { # error } else { print Data::Dumper->Dump([$res]).``\n''; }
$bool = InitLDAPcaManagement($valueMap)
In $valueMap you can define the following keys:
* ldapPasswd (required)
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { 'ldapPasswd' => 'system' };
my $res = YaPI::CaManagement->InitLDAPcaManagement($data); if( not defined $res ) { # error } else { print "OK\n"; }
$bool = ExportCertificateToLDAP($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* certificate (required)
* keyPasswd (optional - if defined, then p12Passwd is required)
* p12Passwd (optional)
* ldapHostname (required - hostname or IP address)
* ldapPort (default: 389)
* destinationDN (required)
* bindDN (required)
* ldapPasswd (required)
If the private key of the certificate is available and the parameter 'keyPasswd' and 'p12Passwd' are defined, an export in PKCS12 format is also done.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { caName => 'My_CA', certificate => $certificateName, ldapHostname => 'myhost.example.com', ldapPort => 389, destinationDN => "uid=me,ou=people,dc=suse,dc=de", BindDN => "cn=Admin,dc=example,dc=com", ldapPasswd => "system" };
my $res = YaPI::CaManagement->ExportCertificateToLDAP($data); if( not defined $res ) { # error } else { print STDERR "OK\n"; }
$bool = DeleteCertificate($valueMap)
In $valueMap you can define the following keys:
* caName (required)
* certificate (required)
* caPasswd (required)
The syntax of these values are explained in the COMMON PARAMETER section.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { caName => 'My_CA', certificate => $certificateName, caPasswd => 'system' };
my $res = YaPI::CaManagement->DeleteCertificate($data); if( not defined $res ) { # error } else { print STDERR "OK\n"; }
$bool = ImportCommonServerCertificate($valueMap)
The CA(s)
are copied to '/etc/ssl/certs/YaST-CA.pem'.
The server certificate is copied to '/etc/ssl/servercerts/servercert.pem' .
The private key is copied to '/etc/ssl/servercerts/serverkey.pem' . The private key is unencrypted and only for root readable.
In $valueMap you can define the following keys:
* inFile (required)
* passwd (required)
inFile is the path to a certificate in PKCS12 format.
passwd is the password which is needed to decrypt the PKCS12 certificate. A second password is not needed, because the private key will be unencrypted.
The return value is ``undef'' on an error and ``1'' on success.
EXAMPLE:
my $data = { inFile => '/media/floppy/YaST-Servercert.p12', passwd => 'system' };
my $res = YaPI::CaManagement->ImportCommonServerCertificate($data); if( not defined $res ) { # error } else { print STDERR "OK\n"; }
$bool = ReadFile($valueMap)
In $valueMap you can define the following keys:
* inFile (required)
* type (required; can be ``plain'' or ``parsed'')
* datatype (can be ``CERTIFICATE'' or ``CRL'')
* inForm (required; ``PEM'', ``DER'')
The return value is ``undef'' on an error.
On success and type = ``plain'' the plain text view of the CA is returned.
If the type = ``parsed'' a complex structure with the single values is returned.
EXAMPLE:
use Data::Dumper;
foreach my $type ("parsed", "plain") { my $data = { 'datatype' => "certificate", 'inFile' => '/path/to/a/certificate.pem', 'inForm' => "PEM" 'type' => $type, };
my $res = YaPI::CaManagement->ReadFile($data); if( not defined $res ) { # error } else { print Data::Dumper->Dump([$res])."\n"; } }