This patch is for testing purposes/results only, please do not merge that. May there are new ideas and corrections for that?
It includes two new menus for configuring the keysize of the root CA and the host CA. The configured keylenght for the host CA will automatically investigated from the serverkey.pem and will be set in 'newkey' section while PKCS#12 client generation and will be used for the control channel enrcyption too. Have added also some more keylenghts which should only support some more testing results and a look behind the curtain. Have find also some bugs which i may can fix in the next time. One directly regarding to this topic is --> If a X509 and already generated clients will be removed, a 'malformed header from script. Bad header=Wrapper for OpenVPN ipfire-2.2: ovpnmain.cgi,' appears with a 'internal server error' subsequently where a reload of the page brings back the ovpnmain.cgi.
Have added also the '-rand' option which is possibly redundant since OpenSSL uses anyway /dev/urandom (tests can be made with an unpatched cgi with strace and the appropriate OpenSSL commands) .
I wanted also to suggest that OpenVPN-2.4.x will deliver EC crypto which might be also interessting to configure it via the WUI ?!
It may also be possible to deliver a flip menu for the Hashes but this should be for a first test o.k. i think.
--- ovpnmain.cgi.orig 2015-12-29 14:20:27.008228796 +0100
+++ ovpnmain.cgi 2016-01-05 12:48:09.014389131 +0100
@@ -1842,7 +1842,9 @@
}
} else { # child
unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes',
- '-days', '999999', '-newkey', 'rsa:4096', '-sha512',
+ '-days', '999999',
+ '-newkey', "$cgiparams{'ROOTKEYLENGHT'}", '-sha512',
+ '-rand', '/dev/urandom',
'-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
'-out', "${General::swroot}/ovpn/ca/cacert.pem",
'-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
@@ -1873,7 +1875,8 @@
}
} else { # child
unless (exec ('/usr/bin/openssl', 'req', '-nodes',
- '-newkey', 'rsa:2048',
+ '-newkey', "$cgiparams{'HOSTKEYLENGHT'}",
+ '-rand', '/dev/urandom',
'-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
'-out', "${General::swroot}/ovpn/certs/serverreq.pem",
'-extensions', 'server',
@@ -1993,6 +1996,34 @@
}
print <<END;
</select></td>
+ <tr><td> </td>
+ <tr><td class='base'>$Lang::tr{'ovpn keylenghtroot'}:</td>
+ <td class='base'><select name='ROOTKEYLENGHT'>
+ <option value='4096' $selected{'ROOTKEYLENGHT'}{'rsa:4096'}>4096 $Lang::tr{'bit'} RSA</option>
+ <option value='6144' $selected{'ROOTKEYLENGHT'}{'rsa:6144'}>6144 $Lang::tr{'bit'} RSA</option>
+ <option value='8192' $selected{'HOSTKEYLENGHT'}{'rsa:8192'}>8192 $Lang::tr{'bit'} RSA</option>
+ <option value='12288' $selected{'HOSTKEYLENGHT'}{'rsa:12288'}>12288 $Lang::tr{'bit'} RSA</option>
+ <option value='16384' $selected{'ROOTKEYLENGHT'}{'rsa:16384'}>16384 $Lang::tr{'bit'} RSA</option>
+ <option value='32768' $selected{'ROOTKEYLENGHT'}{'rsa:32768'}>32768 $Lang::tr{'bit'} RSA</option>
+ </select>
+ </tr>
+
+ <tr><td> </td>
+
+ <tr><td class='base'>$Lang::tr{'ovpn keylenghthost'}:</td>
+ <td class='base'>
+ <select name='HOSTKEYLENGHT'>
+ <option value='2048' $selected{'HOSTKEYLENGHT'}{'rsa:2048'}>2048 $Lang::tr{'bit'} RSA</option>
+ <option value='4096' $selected{'HOSTKEYLENGHT'}{'rsa:4096'}>4096 $Lang::tr{'bit'} RSA</option>
+ <option value='6144' $selected{'HOSTKEYLENGHT'}{'rsa:6144'}>6144 $Lang::tr{'bit'} RSA</option>
+ <option value='8192' $selected{'HOSTKEYLENGHT'}{'rsa:8192'}>8192 $Lang::tr{'bit'} RSA</option>
+ <option value='12288' $selected{'HOSTKEYLENGHT'}{'rsa:12288'}>12288 $Lang::tr{'bit'} RSA</option>
+ <option value='16384' $selected{'HOSTKEYLENGHT'}{'rsa:16384'}>16384 $Lang::tr{'bit'} RSA</option>
+ <option value='32768' $selected{'ROOTKEYLENGHT'}{'rsa:32768'}>32768 $Lang::tr{'bit'} RSA</option>
+ </select>
+ </td>
+ </tr>
+ <tr><td> </td></select></td>
<tr><td class='base'>$Lang::tr{'ovpn dh'}:</td>
<td class='base'><select name='DHLENGHT'>
<option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
@@ -2004,6 +2035,7 @@
</tr>
<tr><td> </td>
+ <tr><td> </td>
<td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
<td> </td><td> </td></tr>
<tr><td class='base' colspan='4' align='left'>
@@ -4202,6 +4234,10 @@
(my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
(my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
(my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
+ # Investigate host serverkey lenght
+ my $keylenght = `/usr/bin/openssl rsa -text -noout -in "${General::swroot}/ovpn/certs/serverkey.pem"`;
+ $keylenght =~ m/(\d+)/;
+ $keylenght = $1;
# Create the Host certificate request client
my $pid = open(OPENSSL, "|-");
@@ -4219,13 +4255,14 @@
close (OPENSSL);
if ($?) {
$errormessage = "$Lang::tr{'openssl produced an error'}: $?";
- unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
- unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
+ unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
+ unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
goto VPNCONF_ERROR;
}
} else { # child
unless (exec ('/usr/bin/openssl', 'req', '-nodes',
- '-newkey', 'rsa:2048',
+ '-newkey', "rsa:$keylenght",
+ '-rand', '/dev/urandom',
'-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
'-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
'-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {