shimun/ssh-cert-dist
1
0
Fork 0
Code Issues 1 Pull Requests 1 Packages Projects Releases Wiki Activity

added: ensure vailidy range stays same

Browse Source
This commit is contained in:
shimun 2023-02-22 15:43:23 +01:00
parent c299a4e132
commit bccaa6935f
Signed by: shimun
GPG Key ID: E0420647856EA39E
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
server/src/api.rs
View File

@ -4,7 +4,7 @@ use std::collections::HashMap;
use std::net::SocketAddr; use std::net::SocketAddr;
use std::path::{self, PathBuf}; use std::path::{self, PathBuf};
use std::sync::Arc; use std::sync::Arc;
use std::time::SystemTime; use std::time::{SystemTime, UNIX_EPOCH};
use anyhow::Context; use anyhow::Context;
use axum::body; use axum::body;
@ -270,7 +270,8 @@ impl From<&Certificate> for CertInfo {
.valid_before_time() .valid_before_time()
.duration_since(cert.valid_after_time()) .duration_since(cert.valid_after_time())
.unwrap(); .unwrap();
let validity_days = validity.as_secs() / ((60 * 60) * 24); let expiry = cert.valid_before_time().checked_add(validity).unwrap();
let expiry_date = expiry.duration_since(UNIX_EPOCH).unwrap();
let host_key = if cert.cert_type().is_host() { let host_key = if cert.cert_type().is_host() {
" -h" " -h"
} else { } else {
@ -291,9 +292,12 @@ impl From<&Certificate> for CertInfo {
.join(" "); .join(" ");
let opts = opts.trim(); let opts = opts.trim();
let renew_command = format!( let renew_command = format!(
"ssh-keygen -s ./ca_key {host_key} -I {} -n {} -V {validity_days}d {opts} {}.pub", "ssh-keygen -s ./ca_key {host_key} -I {} -n {} -V {:#x}:{:#x} {opts} {}.pub",
escape(cert.key_id().into()), escape(cert.key_id().into()),
escape(cert.valid_principals().join(",").into()), escape(cert.key_id().into()) escape(cert.valid_principals().join(",").into()),
cert.valid_after(),
expiry_date.as_secs(),
escape(cert.key_id().into())
); );
CertInfo { CertInfo {
principals: cert.valid_principals().to_vec(), principals: cert.valid_principals().to_vec(),