riscv
/
qemu
mirror of https://gitea.goldendeliverer.com/riscv/qemu.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

crypto: stop requiring "key encipherment" usage in x509 certs 

This usage flag was deprecated by RFC8813, such that it is
forbidden to be present for certs using ECDSA/ECDH algorithms,
and in TLS 1.3 is conceptually obsolete.

As such many valid certs will no longer have this key usage
flag set, and QEMU should not be rejecting them, as this
prevents use of otherwise valid & desirable algorithms.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
pull/307/head
Daniel P. Berrangé 9 months ago
parent
87d6282e53
commit
3995fc238e
6 changed files with 34 additions and 49 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 10
      crypto/tlscredsx509.c
  2. 13
      docs/system/tls.rst
  3. 6
      tests/unit/crypto-tls-x509-helpers.h
  4. 36
      tests/unit/test-crypto-tlscredsx509.c
  5. 14
      tests/unit/test-crypto-tlssession.c
  6. 4
      tests/unit/test-io-channel-tls.c

10
crypto/tlscredsx509.c
View File

@ -144,7 +144,7 @@ qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
if (status < 0) { if (status < 0) {
if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) { if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN : usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN :
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT; GNUTLS_KEY_DIGITAL_SIGNATURE;
} else { } else {
error_setg(errp, error_setg(errp,
"Unable to query certificate %s key usage: %s", "Unable to query certificate %s key usage: %s",
@ -171,14 +171,6 @@ qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
return -1; return -1;
} }
} }
if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) {
if (critical) {
error_setg(errp,
"Certificate %s usage does not permit key "
"encipherment", certFile);
return -1;
}
}
} }
return 0; return 0;

13
docs/system/tls.rst
View File

@ -118,7 +118,6 @@ information for each server, and use it to issue server certificates.
ip_address = 2620:0:cafe::87 ip_address = 2620:0:cafe::87
ip_address = 2001:24::92 ip_address = 2001:24::92
tls_www_server tls_www_server
encryption_key
signing_key signing_key
EOF EOF
# certtool --generate-privkey > server-hostNNN-key.pem # certtool --generate-privkey > server-hostNNN-key.pem
@ -134,9 +133,8 @@ the subject alt name extension data. The ``tls_www_server`` keyword is
the key purpose extension to indicate this certificate is intended for the key purpose extension to indicate this certificate is intended for
usage in a web server. Although QEMU network services are not in fact usage in a web server. Although QEMU network services are not in fact
HTTP servers (except for VNC websockets), setting this key purpose is HTTP servers (except for VNC websockets), setting this key purpose is
still recommended. The ``encryption_key`` and ``signing_key`` keyword is still recommended. The ``signing_key`` keyword is the key usage extension
the key usage extension to indicate this certificate is intended for to indicate this certificate is intended for usage in the data session.
usage in the data session.
The ``server-hostNNN-key.pem`` and ``server-hostNNN-cert.pem`` files The ``server-hostNNN-key.pem`` and ``server-hostNNN-cert.pem`` files
should now be securely copied to the server for which they were should now be securely copied to the server for which they were
@ -171,7 +169,6 @@ certificates.
organization = Name of your organization organization = Name of your organization
cn = hostNNN.foo.example.com cn = hostNNN.foo.example.com
tls_www_client tls_www_client
encryption_key
signing_key signing_key
EOF EOF
# certtool --generate-privkey > client-hostNNN-key.pem # certtool --generate-privkey > client-hostNNN-key.pem
@ -187,9 +184,8 @@ the ``dns_name`` and ``ip_address`` fields are not included. The
``tls_www_client`` keyword is the key purpose extension to indicate this ``tls_www_client`` keyword is the key purpose extension to indicate this
certificate is intended for usage in a web client. Although QEMU network certificate is intended for usage in a web client. Although QEMU network
clients are not in fact HTTP clients, setting this key purpose is still clients are not in fact HTTP clients, setting this key purpose is still
recommended. The ``encryption_key`` and ``signing_key`` keyword is the recommended. The ``signing_key`` keyword is the key usage extension to
key usage extension to indicate this certificate is intended for usage indicate this certificate is intended for usage in the data session.
in the data session.
The ``client-hostNNN-key.pem`` and ``client-hostNNN-cert.pem`` files The ``client-hostNNN-key.pem`` and ``client-hostNNN-cert.pem`` files
should now be securely copied to the client for which they were should now be securely copied to the client for which they were
@ -222,7 +218,6 @@ client and server instructions in one.
ip_address = 2001:24::92 ip_address = 2001:24::92
tls_www_server tls_www_server
tls_www_client tls_www_client
encryption_key
signing_key signing_key
EOF EOF
# certtool --generate-privkey > both-hostNNN-key.pem # certtool --generate-privkey > both-hostNNN-key.pem

6
tests/unit/crypto-tls-x509-helpers.h
View File

@ -148,8 +148,7 @@ void test_tls_cleanup(const char *keyfile);
.basicConstraintsIsCA = false, \ .basicConstraintsIsCA = false, \
.keyUsageEnable = true, \ .keyUsageEnable = true, \
.keyUsageCritical = true, \ .keyUsageCritical = true, \
.keyUsageValue = \ .keyUsageValue = GNUTLS_KEY_DIGITAL_SIGNATURE, \
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, \
.keyPurposeEnable = true, \ .keyPurposeEnable = true, \
.keyPurposeCritical = true, \ .keyPurposeCritical = true, \
.keyPurposeOID1 = GNUTLS_KP_TLS_WWW_CLIENT, \ .keyPurposeOID1 = GNUTLS_KP_TLS_WWW_CLIENT, \
@ -168,8 +167,7 @@ void test_tls_cleanup(const char *keyfile);
.basicConstraintsIsCA = false, \ .basicConstraintsIsCA = false, \
.keyUsageEnable = true, \ .keyUsageEnable = true, \
.keyUsageCritical = true, \ .keyUsageCritical = true, \
.keyUsageValue = \ .keyUsageValue = GNUTLS_KEY_DIGITAL_SIGNATURE, \
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, \
.keyPurposeEnable = true, \ .keyPurposeEnable = true, \
.keyPurposeCritical = true, \ .keyPurposeCritical = true, \
.keyPurposeOID1 = GNUTLS_KP_TLS_WWW_SERVER, \ .keyPurposeOID1 = GNUTLS_KP_TLS_WWW_SERVER, \

36
tests/unit/test-crypto-tlscredsx509.c
View File

@ -169,14 +169,14 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL, "UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
TLS_CERT_REQ(clientcertreq, cacertreq, TLS_CERT_REQ(clientcertreq, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL, "UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0); 0, 0);
@ -199,7 +199,7 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL, "UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
@ -214,7 +214,7 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL, "UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
@ -229,7 +229,7 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL, "UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
@ -253,7 +253,7 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL, "UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
/* no-basic */ /* no-basic */
@ -267,7 +267,7 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL, "UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
/* Key usage:dig-sig:critical */ /* Key usage:dig-sig:critical */
@ -281,7 +281,7 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL, "UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
@ -306,7 +306,7 @@ int main(int argc, char **argv)
"UK", "qemu", NULL, NULL, NULL, NULL, "UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT | GNUTLS_KEY_DIGITAL_SIGNATURE |
GNUTLS_KEY_KEY_CERT_SIGN, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL, false, false, NULL, NULL,
0, 0); 0, 0);
@ -409,7 +409,7 @@ int main(int argc, char **argv)
"UK", "qemu", NULL, NULL, NULL, NULL, "UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT | GNUTLS_KEY_DIGITAL_SIGNATURE |
GNUTLS_KEY_KEY_CERT_SIGN, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL, false, false, NULL, NULL,
0, 0); 0, 0);
@ -511,21 +511,21 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL, "UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
TLS_CERT_REQ(servercertexp1req, cacertreq, TLS_CERT_REQ(servercertexp1req, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL, "UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, -1); 0, -1);
TLS_CERT_REQ(clientcertexp1req, cacertreq, TLS_CERT_REQ(clientcertexp1req, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL, "UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, -1); 0, -1);
@ -549,21 +549,21 @@ int main(int argc, char **argv)
"UK", "qemu", NULL, NULL, NULL, NULL, "UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
TLS_CERT_REQ(servercertnew1req, cacertreq, TLS_CERT_REQ(servercertnew1req, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL, "UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
1, 2); 1, 2);
TLS_CERT_REQ(clientcertnew1req, cacertreq, TLS_CERT_REQ(clientcertnew1req, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL, "UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
1, 2); 1, 2);
@ -614,14 +614,14 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL, "UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq, TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
"UK", "qemu client level 2b", NULL, NULL, NULL, NULL, "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0); 0, 0);

14
tests/unit/test-crypto-tlssession.c
View File

@ -472,14 +472,14 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL, "UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
TLS_CERT_REQ(clientcertreq, cacertreq, TLS_CERT_REQ(clientcertreq, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL, "UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0); 0, 0);
@ -487,7 +487,7 @@ int main(int argc, char **argv)
"UK", "qemu", NULL, NULL, NULL, NULL, "UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0); 0, 0);
@ -506,7 +506,7 @@ int main(int argc, char **argv)
"192.168.122.1", "fec0::dead:beaf", "192.168.122.1", "fec0::dead:beaf",
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
/* This intentionally doesn't replicate */ /* This intentionally doesn't replicate */
@ -515,7 +515,7 @@ int main(int argc, char **argv)
"192.168.122.1", "fec0::dead:beaf", "192.168.122.1", "fec0::dead:beaf",
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
@ -619,14 +619,14 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL, "UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq, TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
"UK", "qemu client level 2b", NULL, NULL, NULL, NULL, "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0); 0, 0);

4
tests/unit/test-io-channel-tls.c
View File

@ -302,14 +302,14 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL, "UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0); 0, 0);
TLS_CERT_REQ(clientcertreq, cacertreq, TLS_CERT_REQ(clientcertreq, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL, "UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false, true, true, false,
true, true, true, true,
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0); 0, 0);

Write Preview
Loading…
Cancel
Save