From 6c2465b4460c782a53112a7cce786d2e2d0b6715 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 21 Feb 2017 15:04:18 +0100 Subject: [PATCH 1/7] builder: Define a builder part for X.509 RFC 3779 address blocks --- src/libstrongswan/credentials/builder.c | 1 + src/libstrongswan/credentials/builder.h | 2 ++ 2 files changed, 3 insertions(+) diff --git a/src/libstrongswan/credentials/builder.c b/src/libstrongswan/credentials/builder.c index 243dfd7cf..baa17c47d 100644 --- a/src/libstrongswan/credentials/builder.c +++ b/src/libstrongswan/credentials/builder.c @@ -45,6 +45,7 @@ ENUM(builder_part_names, BUILD_FROM_FILE, BUILD_END, "BUILD_CRL_DISTRIBUTION_POINTS", "BUILD_OCSP_ACCESS_LOCATIONS", "BUILD_PATHLEN", + "BUILD_ADDRBLOCKS", "BUILD_PERMITTED_NAME_CONSTRAINTS", "BUILD_EXCLUDED_NAME_CONSTRAINTS", "BUILD_CERTIFICATE_POLICIES", diff --git a/src/libstrongswan/credentials/builder.h b/src/libstrongswan/credentials/builder.h index 7d1139348..1c6f5001b 100644 --- a/src/libstrongswan/credentials/builder.h +++ b/src/libstrongswan/credentials/builder.h @@ -100,6 +100,8 @@ enum builder_part_t { BUILD_OCSP_ACCESS_LOCATIONS, /** certificate path length constraint */ BUILD_PATHLEN, + /** RFC3779 addressBlock, linked_list_t* of traffic_selector_t* */ + BUILD_ADDRBLOCKS, /** permitted X509 name constraints, linked_list_t* of identification_t* */ BUILD_PERMITTED_NAME_CONSTRAINTS, /** excluded X509 name constraints, linked_list_t* of identification_t* */ From 6734d7a51aaf55002d97894a9ad0bd0a942769f5 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 21 Feb 2017 15:05:17 +0100 Subject: [PATCH 2/7] x509: Support encoding the RFC 3779 addrblock extension --- src/libstrongswan/plugins/x509/x509_cert.c | 137 ++++++++++++++++++++- 1 file changed, 134 insertions(+), 3 deletions(-) diff --git a/src/libstrongswan/plugins/x509/x509_cert.c b/src/libstrongswan/plugins/x509/x509_cert.c index 2b83f3328..2c03e972d 100644 --- a/src/libstrongswan/plugins/x509/x509_cert.c +++ b/src/libstrongswan/plugins/x509/x509_cert.c @@ -1992,6 +1992,72 @@ chunk_t x509_build_crlDistributionPoints(linked_list_t *list, int extn) asn1_wrap(ASN1_SEQUENCE, "m", crlDistributionPoints))); } +static chunk_t generate_ts(traffic_selector_t *ts) +{ + chunk_t from, to; + uint8_t minbits = 0, maxbits = 0, unused; + host_t *net; + int bit, byte; + + if (ts->to_subnet(ts, &net, &minbits)) + { + unused = round_up(minbits, BITS_PER_BYTE) - minbits; + from = asn1_wrap(ASN1_BIT_STRING, "m", + chunk_cat("cc", chunk_from_thing(unused), + chunk_create(net->get_address(net).ptr, + (minbits + unused) / BITS_PER_BYTE))); + net->destroy(net); + return from; + } + net->destroy(net); + + from = ts->get_from_address(ts); + for (byte = from.len - 1; byte >= 0; byte--) + { + if (from.ptr[byte] != 0) + { + minbits = byte * BITS_PER_BYTE + BITS_PER_BYTE; + for (bit = 0; bit < BITS_PER_BYTE; bit++) + { + if (from.ptr[byte] & 1 << bit) + { + break; + } + minbits--; + } + break; + } + } + to = ts->get_to_address(ts); + for (byte = to.len - 1; byte >= 0; byte--) + { + if (to.ptr[byte] != 0xFF) + { + maxbits = byte * BITS_PER_BYTE + BITS_PER_BYTE; + for (bit = 0; bit < BITS_PER_BYTE; bit++) + { + if ((to.ptr[byte] & 1 << bit) == 0) + { + break; + } + maxbits--; + } + break; + } + } + unused = round_up(minbits, BITS_PER_BYTE) - minbits; + from = asn1_wrap(ASN1_BIT_STRING, "m", + chunk_cat("cc", chunk_from_thing(unused), + chunk_create(from.ptr, + (minbits + unused) / BITS_PER_BYTE))); + unused = round_up(maxbits, BITS_PER_BYTE) - maxbits; + to = asn1_wrap(ASN1_BIT_STRING, "m", + chunk_cat("cc", chunk_from_thing(unused), + chunk_create(to.ptr, + (maxbits + unused) / BITS_PER_BYTE))); + return asn1_wrap(ASN1_SEQUENCE, "mm", from, to); +} + /** * Generate and sign a new certificate */ @@ -2008,6 +2074,7 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert, chunk_t crlDistributionPoints = chunk_empty, authorityInfoAccess = chunk_empty; chunk_t policyConstraints = chunk_empty, inhibitAnyPolicy = chunk_empty; chunk_t ikeIntermediate = chunk_empty, msSmartcardLogon = chunk_empty; + chunk_t ipAddrBlocks = chunk_empty; identification_t *issuer, *subject; chunk_t key_info; signature_scheme_t scheme; @@ -2184,6 +2251,53 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert, } } + if (cert->ipAddrBlocks->get_count(cert->ipAddrBlocks)) + { + chunk_t v4blocks = chunk_empty, v6blocks = chunk_empty, block; + traffic_selector_t *ts; + + enumerator = cert->ipAddrBlocks->create_enumerator(cert->ipAddrBlocks); + while (enumerator->enumerate(enumerator, &ts)) + { + switch (ts->get_type(ts)) + { + case TS_IPV4_ADDR_RANGE: + block = generate_ts(ts); + v4blocks = chunk_cat("mm", v4blocks, block); + break; + case TS_IPV6_ADDR_RANGE: + block = generate_ts(ts); + v6blocks = chunk_cat("mm", v6blocks, block); + break; + default: + break; + } + } + enumerator->destroy(enumerator); + + if (v4blocks.ptr) + { + v4blocks = asn1_wrap(ASN1_SEQUENCE, "mm", + asn1_wrap(ASN1_OCTET_STRING, "c", + chunk_from_chars(0x00,0x01)), + asn1_wrap(ASN1_SEQUENCE, "m", v4blocks)); + } + if (v6blocks.ptr) + { + v6blocks = asn1_wrap(ASN1_SEQUENCE, "mm", + asn1_wrap(ASN1_OCTET_STRING, "c", + chunk_from_chars(0x00,0x02)), + asn1_wrap(ASN1_SEQUENCE, "m", v6blocks)); + } + ipAddrBlocks = asn1_wrap(ASN1_SEQUENCE, "mmm", + asn1_build_known_oid(OID_IP_ADDR_BLOCKS), + asn1_wrap(ASN1_BOOLEAN, "c", chunk_from_chars(0xFF)), + asn1_wrap(ASN1_OCTET_STRING, "m", + asn1_wrap(ASN1_SEQUENCE, "mm", + v4blocks, v6blocks))); + cert->flags |= X509_IP_ADDR_BLOCKS; + } + if (cert->permitted_names->get_count(cert->permitted_names) || cert->excluded_names->get_count(cert->excluded_names)) { @@ -2321,15 +2435,16 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert, } if (basicConstraints.ptr || subjectAltNames.ptr || authKeyIdentifier.ptr || - crlDistributionPoints.ptr || nameConstraints.ptr) + crlDistributionPoints.ptr || nameConstraints.ptr || ipAddrBlocks.ptr) { extensions = asn1_wrap(ASN1_CONTEXT_C_3, "m", - asn1_wrap(ASN1_SEQUENCE, "mmmmmmmmmmmmm", + asn1_wrap(ASN1_SEQUENCE, "mmmmmmmmmmmmmm", basicConstraints, keyUsage, subjectKeyIdentifier, authKeyIdentifier, subjectAltNames, extendedKeyUsage, crlDistributionPoints, authorityInfoAccess, nameConstraints, certPolicies, - policyMappings, policyConstraints, inhibitAnyPolicy)); + policyMappings, policyConstraints, inhibitAnyPolicy, + ipAddrBlocks)); } cert->tbsCertificate = asn1_wrap(ASN1_SEQUENCE, "mmmcmcmm", @@ -2492,6 +2607,22 @@ x509_cert_t *x509_cert_gen(certificate_type_t type, va_list args) cert->pathLenConstraint = (constraint < 128) ? constraint : X509_NO_CONSTRAINT; continue; + case BUILD_ADDRBLOCKS: + { + enumerator_t *enumerator; + traffic_selector_t *ts; + linked_list_t *list; + + list = va_arg(args, linked_list_t*); + enumerator = list->create_enumerator(list); + while (enumerator->enumerate(enumerator, &ts)) + { + cert->ipAddrBlocks->insert_last(cert->ipAddrBlocks, + ts->clone(ts)); + } + enumerator->destroy(enumerator); + continue; + } case BUILD_PERMITTED_NAME_CONSTRAINTS: { enumerator_t *enumerator; From a115f4842880f1cf85de36e7d23652f9ddc93b73 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 21 Feb 2017 16:54:57 +0100 Subject: [PATCH 3/7] x509: Do not mark generated addrblock extension as critical While RFC 3779 says we SHOULD mark it is critical, this has severe side effects in practice. The addrblock extension is not widely used nor implemented, and only a few applications can handle this extension. By marking it critical, none of these applications can make use of such certificates where included addrblocks do not matter, such as TLS/HTTPS. If an application wants to make use of addrblocks, that is usually an explicit decision. Then the very same application obviously can handle addrblocks, and there is no need for the extension to be critical. In other words, for local policy checks it is a local matter to handle the extension, hence making it critical is usually not of much help. --- src/libstrongswan/plugins/x509/x509_cert.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/libstrongswan/plugins/x509/x509_cert.c b/src/libstrongswan/plugins/x509/x509_cert.c index 2c03e972d..b77c5db4d 100644 --- a/src/libstrongswan/plugins/x509/x509_cert.c +++ b/src/libstrongswan/plugins/x509/x509_cert.c @@ -2289,9 +2289,8 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert, chunk_from_chars(0x00,0x02)), asn1_wrap(ASN1_SEQUENCE, "m", v6blocks)); } - ipAddrBlocks = asn1_wrap(ASN1_SEQUENCE, "mmm", + ipAddrBlocks = asn1_wrap(ASN1_SEQUENCE, "mm", asn1_build_known_oid(OID_IP_ADDR_BLOCKS), - asn1_wrap(ASN1_BOOLEAN, "c", chunk_from_chars(0xFF)), asn1_wrap(ASN1_OCTET_STRING, "m", asn1_wrap(ASN1_SEQUENCE, "mm", v4blocks, v6blocks))); From 48a5b29fd35b607870306fe9b8b83970d0e73409 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 21 Feb 2017 15:06:15 +0100 Subject: [PATCH 4/7] pki: Add a helper function parse traffic selectors from CIDR subnets or ranges --- src/pki/pki.c | 22 ++++++++++++++++++++++ src/pki/pki.h | 9 +++++++++ 2 files changed, 31 insertions(+) diff --git a/src/pki/pki.c b/src/pki/pki.c index 472704945..00fffefa6 100644 --- a/src/pki/pki.c +++ b/src/pki/pki.c @@ -258,6 +258,28 @@ hash_algorithm_t get_default_digest(private_key_t *private) return alg == HASH_UNKNOWN ? HASH_SHA256 : alg; } +/* + * Described in header + */ +traffic_selector_t* parse_ts(char *str) +{ + ts_type_t type = TS_IPV4_ADDR_RANGE; + char *to, from[64]; + + if (strchr(str, ':')) + { + type = TS_IPV6_ADDR_RANGE; + } + to = strchr(str, '-'); + if (to) + { + snprintf(from, sizeof(from), "%.*s", to - str, str); + to++; + return traffic_selector_create_from_string(0, type, from, 0, to, 65535); + } + return traffic_selector_create_from_cidr(str, 0, 0, 65535); +} + /** * Callback credential set pki uses */ diff --git a/src/pki/pki.h b/src/pki/pki.h index 017e61df6..54be59f8f 100644 --- a/src/pki/pki.h +++ b/src/pki/pki.h @@ -26,6 +26,7 @@ #include "command.h" #include +#include #include /** @@ -63,4 +64,12 @@ void set_file_mode(FILE *stream, cred_encoding_type_t enc); */ hash_algorithm_t get_default_digest(private_key_t *private); +/** + * Create a traffic selector from a CIDR or range string. + * + * @param str input string, either a.b.c.d/e or a.b.c.d-e.f.g.h + * @return traffic selector, NULL on error + */ +traffic_selector_t* parse_ts(char *str); + #endif /** PKI_H_ @}*/ From b6c371fbf1433c82663ec6b9641ed58210b699c8 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 21 Feb 2017 15:07:03 +0100 Subject: [PATCH 5/7] pki: Support an --addrblock option for self-signed certificates --- src/pki/commands/self.c | 17 +++++++++++++++++ src/pki/man/pki---self.1.in | 6 ++++++ 2 files changed, 23 insertions(+) diff --git a/src/pki/commands/self.c b/src/pki/commands/self.c index 1899daac9..b894ac190 100644 --- a/src/pki/commands/self.c +++ b/src/pki/commands/self.c @@ -22,6 +22,7 @@ #include #include #include +#include #include /** @@ -57,6 +58,7 @@ static int self() char *file = NULL, *dn = NULL, *hex = NULL, *error = NULL, *keyid = NULL; identification_t *id = NULL; linked_list_t *san, *ocsp, *permitted, *excluded, *policies, *mappings; + linked_list_t *addrblocks; int pathlen = X509_NO_CONSTRAINT, inhibit_any = X509_NO_CONSTRAINT; int inhibit_mapping = X509_NO_CONSTRAINT; int require_explicit = X509_NO_CONSTRAINT; @@ -66,6 +68,7 @@ static int self() char *datenb = NULL, *datena = NULL, *dateform = NULL; x509_flag_t flags = 0; x509_cert_policy_t *policy = NULL; + traffic_selector_t *ts; char *arg; san = linked_list_create(); @@ -74,6 +77,7 @@ static int self() excluded = linked_list_create(); policies = linked_list_create(); mappings = linked_list_create(); + addrblocks = linked_list_create(); while (TRUE) { @@ -153,6 +157,15 @@ static int self() case 'p': pathlen = atoi(arg); continue; + case 'B': + ts = parse_ts(arg); + if (!ts) + { + error = "invalid addressBlock"; + goto usage; + } + addrblocks->insert_last(addrblocks, ts); + continue; case 'n': permitted->insert_last(permitted, identification_create_from_string(arg)); @@ -360,6 +373,7 @@ static int self() BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial, BUILD_DIGEST_ALG, digest, BUILD_X509_FLAG, flags, BUILD_PATHLEN, pathlen, BUILD_SUBJECT_ALTNAMES, san, + BUILD_ADDRBLOCKS, addrblocks, BUILD_OCSP_ACCESS_LOCATIONS, ocsp, BUILD_PERMITTED_NAME_CONSTRAINTS, permitted, BUILD_EXCLUDED_NAME_CONSTRAINTS, excluded, @@ -394,6 +408,7 @@ end: san->destroy_offset(san, offsetof(identification_t, destroy)); permitted->destroy_offset(permitted, offsetof(identification_t, destroy)); excluded->destroy_offset(excluded, offsetof(identification_t, destroy)); + addrblocks->destroy_offset(addrblocks, offsetof(traffic_selector_t, destroy)); policies->destroy_function(policies, (void*)destroy_cert_policy); mappings->destroy_function(mappings, (void*)destroy_policy_mapping); ocsp->destroy(ocsp); @@ -411,6 +426,7 @@ usage: san->destroy_offset(san, offsetof(identification_t, destroy)); permitted->destroy_offset(permitted, offsetof(identification_t, destroy)); excluded->destroy_offset(excluded, offsetof(identification_t, destroy)); + addrblocks->destroy_offset(addrblocks, offsetof(traffic_selector_t, destroy)); policies->destroy_function(policies, (void*)destroy_cert_policy); mappings->destroy_function(mappings, (void*)destroy_policy_mapping); ocsp->destroy(ocsp); @@ -449,6 +465,7 @@ static void __attribute__ ((constructor))reg() {"serial", 's', 1, "serial number in hex, default: random"}, {"ca", 'b', 0, "include CA basicConstraint, default: no"}, {"pathlen", 'p', 1, "set path length constraint"}, + {"addrblock", 'B', 1, "RFC 3779 addrBlock to include"}, {"nc-permitted", 'n', 1, "add permitted NameConstraint"}, {"nc-excluded", 'N', 1, "add excluded NameConstraint"}, {"cert-policy", 'P', 1, "certificatePolicy OID to include"}, diff --git a/src/pki/man/pki---self.1.in b/src/pki/man/pki---self.1.in index 81f59bbb2..ec38e6d48 100644 --- a/src/pki/man/pki---self.1.in +++ b/src/pki/man/pki---self.1.in @@ -22,6 +22,7 @@ pki \-\-self \- Create a self-signed certificate .OP \-\-ca .OP \-\-ocsp uri .OP \-\-pathlen len +.OP \-\-addrblock block .OP \-\-nc-permitted name .OP \-\-nc-excluded name .OP \-\-policy\-mapping mapping @@ -127,6 +128,11 @@ times. .BI "\-p, \-\-pathlen " len Set path length constraint. .TP +.BI "\-B, \-\-addrblock " block +RFC 3779 address block to include in certificate. \fIblock\fR is either a +CIDR subnet (such as \fI10.0.0.0/8\fR) or an arbitrary address range +(\fI192.168.1.7-192.168.1.13\fR). Can be repeated to include multiple blocks. +.TP .BI "\-n, \-\-nc-permitted " name Add permitted NameConstraint extension to certificate. For DNS or email constraints, the identity type is not always detectable by the given name. Use From ead1dd3bcbdb3632d611840d2a67a508015ec779 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 21 Feb 2017 15:07:42 +0100 Subject: [PATCH 6/7] pki: Support an --addrblock option for issued certificates --- src/pki/commands/issue.c | 17 ++++++++++++++++- src/pki/man/pki---issue.1.in | 6 ++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/src/pki/commands/issue.c b/src/pki/commands/issue.c index d95f53c03..333c6ebb3 100644 --- a/src/pki/commands/issue.c +++ b/src/pki/commands/issue.c @@ -71,6 +71,7 @@ static int issue() char *error = NULL, *keyid = NULL; identification_t *id = NULL; linked_list_t *san, *cdps, *ocsp, *permitted, *excluded, *policies, *mappings; + linked_list_t *addrblocks; int pathlen = X509_NO_CONSTRAINT, inhibit_any = X509_NO_CONSTRAINT; int inhibit_mapping = X509_NO_CONSTRAINT, require_explicit = X509_NO_CONSTRAINT; chunk_t serial = chunk_empty; @@ -81,6 +82,7 @@ static int issue() x509_t *x509; x509_cdp_t *cdp = NULL; x509_cert_policy_t *policy = NULL; + traffic_selector_t *ts; char *arg; san = linked_list_create(); @@ -90,6 +92,7 @@ static int issue() excluded = linked_list_create(); policies = linked_list_create(); mappings = linked_list_create(); + addrblocks = linked_list_create(); while (TRUE) { @@ -184,6 +187,15 @@ static int issue() case 'p': pathlen = atoi(arg); continue; + case 'B': + ts = parse_ts(arg); + if (!ts) + { + error = "invalid addressBlock"; + goto usage; + } + addrblocks->insert_last(addrblocks, ts); + continue; case 'n': permitted->insert_last(permitted, identification_create_from_string(arg)); @@ -519,7 +531,7 @@ static int issue() BUILD_NOT_BEFORE_TIME, not_before, BUILD_DIGEST_ALG, digest, BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial, BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags, - BUILD_PATHLEN, pathlen, + BUILD_PATHLEN, pathlen, BUILD_ADDRBLOCKS, addrblocks, BUILD_CRL_DISTRIBUTION_POINTS, cdps, BUILD_OCSP_ACCESS_LOCATIONS, ocsp, BUILD_PERMITTED_NAME_CONSTRAINTS, permitted, @@ -557,6 +569,7 @@ end: san->destroy_offset(san, offsetof(identification_t, destroy)); permitted->destroy_offset(permitted, offsetof(identification_t, destroy)); excluded->destroy_offset(excluded, offsetof(identification_t, destroy)); + addrblocks->destroy_offset(addrblocks, offsetof(traffic_selector_t, destroy)); policies->destroy_function(policies, (void*)destroy_cert_policy); mappings->destroy_function(mappings, (void*)destroy_policy_mapping); cdps->destroy_function(cdps, (void*)destroy_cdp); @@ -575,6 +588,7 @@ usage: san->destroy_offset(san, offsetof(identification_t, destroy)); permitted->destroy_offset(permitted, offsetof(identification_t, destroy)); excluded->destroy_offset(excluded, offsetof(identification_t, destroy)); + addrblocks->destroy_offset(addrblocks, offsetof(traffic_selector_t, destroy)); policies->destroy_function(policies, (void*)destroy_cert_policy); mappings->destroy_function(mappings, (void*)destroy_policy_mapping); cdps->destroy_function(cdps, (void*)destroy_cdp); @@ -616,6 +630,7 @@ static void __attribute__ ((constructor))reg() {"serial", 's', 1, "serial number in hex, default: random"}, {"ca", 'b', 0, "include CA basicConstraint, default: no"}, {"pathlen", 'p', 1, "set path length constraint"}, + {"addrblock", 'B', 1, "RFC 3779 addrBlock to include"}, {"nc-permitted", 'n', 1, "add permitted NameConstraint"}, {"nc-excluded", 'N', 1, "add excluded NameConstraint"}, {"cert-policy", 'P', 1, "certificatePolicy OID to include"}, diff --git a/src/pki/man/pki---issue.1.in b/src/pki/man/pki---issue.1.in index ba5886f5f..3f9382e9a 100644 --- a/src/pki/man/pki---issue.1.in +++ b/src/pki/man/pki---issue.1.in @@ -24,6 +24,7 @@ pki \-\-issue \- Issue a certificate using a CA certificate and key .OP \-\-ocsp uri .OP \-\-pathlen len .OP \-\-nc-permitted name +.OP \-\-addrblock block .OP \-\-nc-excluded name .OP \-\-policy\-mapping mapping .OP \-\-policy\-explicit len @@ -148,6 +149,11 @@ times. .BI "\-p, \-\-pathlen " len Set path length constraint. .TP +.BI "\-B, \-\-addrblock " block +RFC 3779 address block to include in certificate. \fIblock\fR is either a +CIDR subnet (such as \fI10.0.0.0/8\fR) or an arbitrary address range +(\fI192.168.1.7-192.168.1.13\fR). Can be repeated to include multiple blocks. +.TP .BI "\-n, \-\-nc-permitted " name Add permitted NameConstraint extension to certificate. For DNS or email constraints, the identity type is not always detectable by the given name. Use From 2d7f940f11f14cf38f0d374ffd74aeb81a68f143 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Wed, 22 Feb 2017 08:52:00 +0100 Subject: [PATCH 7/7] pki: Add a note about constructing RFC 3779 compliant certificates to manpage --- src/pki/man/pki---issue.1.in | 3 +++ src/pki/man/pki---self.1.in | 3 +++ 2 files changed, 6 insertions(+) diff --git a/src/pki/man/pki---issue.1.in b/src/pki/man/pki---issue.1.in index 3f9382e9a..d1fa3473f 100644 --- a/src/pki/man/pki---issue.1.in +++ b/src/pki/man/pki---issue.1.in @@ -153,6 +153,9 @@ Set path length constraint. RFC 3779 address block to include in certificate. \fIblock\fR is either a CIDR subnet (such as \fI10.0.0.0/8\fR) or an arbitrary address range (\fI192.168.1.7-192.168.1.13\fR). Can be repeated to include multiple blocks. +Please note that the supplied blocks are included in the certificate as is, +so for standards compliance, multiple blocks must be supplied in correct +order and adjacent blocks must be combined. Refer to RFC 3779 for details. .TP .BI "\-n, \-\-nc-permitted " name Add permitted NameConstraint extension to certificate. For DNS or email diff --git a/src/pki/man/pki---self.1.in b/src/pki/man/pki---self.1.in index ec38e6d48..4384fa72d 100644 --- a/src/pki/man/pki---self.1.in +++ b/src/pki/man/pki---self.1.in @@ -132,6 +132,9 @@ Set path length constraint. RFC 3779 address block to include in certificate. \fIblock\fR is either a CIDR subnet (such as \fI10.0.0.0/8\fR) or an arbitrary address range (\fI192.168.1.7-192.168.1.13\fR). Can be repeated to include multiple blocks. +Please note that the supplied blocks are included in the certificate as is, +so for standards compliance, multiple blocks must be supplied in correct +order and adjacent blocks must be combined. Refer to RFC 3779 for details. .TP .BI "\-n, \-\-nc-permitted " name Add permitted NameConstraint extension to certificate. For DNS or email