Currently, the v-generate-ssl-cert file on the main branch of the GitHub repository also needs the \n newline character added in order to generate the .csr and .crt files.
root@debian:~# # 手动跑三次，看 key 类型是否随 key_algo 变化
root@debian:~# D=blog.example.com; E="info@$D"
root@debian:~# C=US; S=California; L="San Francisco"; O=Hestia; OU=IT
root@debian:~# for algo in ecdsa-256 ecdsa-384 rsa; do
> out=$(/usr/local/hestia/bin/v-generate-ssl-cert "$D" "$E" "$C" "$S" "$L" "$O" "$OU" "" shell "$algo" 2>&1)
> d=$(echo "$out" | sed -n 's/^Directory: //p')
> echo "=== $algo (dir=$d) ==="
> ls -la "$d" 2>/dev/null
> [ -f "$d/$D.csr" ] && echo "CSR EXISTS" || echo "CSR MISSING"
> openssl pkey -in "$d/$D.key" -noout -text 2>/dev/null | head -1
> done
=== ecdsa-256 (dir=/tmp/tmp.iVEedN4OT5) ===
总计 4
drw-rw---- 2 root root 60 10月24日 05:13 .
drwxrwxrwt 31 root root 740 10月24日 05:13 ..
-rw------- 1 root root 227 10月24日 05:13 blog.example.com.key
CSR MISSING
Private-Key: (256 bit)
=== ecdsa-384 (dir=/tmp/tmp.ej3iBc2poG) ===
总计 4
drw-rw---- 2 root root 60 10月24日 05:13 .
drwxrwxrwt 32 root root 760 10月24日 05:13 ..
-rw------- 1 root root 288 10月24日 05:13 blog.example.com.key
CSR MISSING
Private-Key: (384 bit)
=== rsa (dir=/tmp/tmp.HxCMP3tddP) ===
总计 4
drw-rw---- 2 root root 60 10月24日 05:13 .
drwxrwxrwt 33 root root 780 10月24日 05:13 ..
-rw-r--r-- 1 root root 3268 10月24日 05:13 blog.example.com.key
CSR MISSING
Private-Key: (4096 bit, 2 primes)
root@debian:~# # 手动跑三次，看 key 类型是否随 key_algo 变化
root@debian:~# D=blog.example.com; E="info@$D"
root@debian:~# C=US; S=California; L="San Francisco"; O=Hestia; OU=IT
root@debian:~# for algo in ecdsa-256 ecdsa-384 rsa; do
> out=$(/usr/local/hestia/bin/v-generate-ssl-cert "$D" "$E" "$C" "$S" "$L" "$O" "$OU" "" shell "$algo" 2>&1)
> d=$(echo "$out" | sed -n 's/^Directory: //p')
> echo "=== $algo (dir=$d) ==="
> ls -la "$d" 2>/dev/null
> [ -f "$d/$D.csr" ] && echo "CSR EXISTS" || echo "CSR MISSING"
> openssl pkey -in "$d/$D.key" -noout -text 2>/dev/null | head -1
> done
=== ecdsa-256 (dir=/tmp/tmp.UG5Z1FERdp) ===
总计 12
drw-rw---- 2 root root 100 10月24日 05:15 .
drwxrwxrwt 34 root root 800 10月24日 05:15 ..
-rw-r--r-- 1 root root 912 10月24日 05:15 blog.example.com.crt
-rw-r--r-- 1 root root 603 10月24日 05:15 blog.example.com.csr
-rw------- 1 root root 227 10月24日 05:15 blog.example.com.key
CSR EXISTS
Private-Key: (256 bit)
=== ecdsa-384 (dir=/tmp/tmp.bCcJDA6XHw) ===
总计 12
drw-rw---- 2 root root 100 10月24日 05:15 .
drwxrwxrwt 35 root root 820 10月24日 05:15 ..
-rw-r--r-- 1 root root 993 10月24日 05:15 blog.example.com.crt
-rw-r--r-- 1 root root 688 10月24日 05:15 blog.example.com.csr
-rw------- 1 root root 288 10月24日 05:15 blog.example.com.key
CSR EXISTS
Private-Key: (384 bit)
=== rsa (dir=/tmp/tmp.l9jQQR0llI) ===
总计 12
drw-rw---- 2 root root 100 10月24日 05:15 .
drwxrwxrwt 36 root root 840 10月24日 05:15 ..
-rw-r--r-- 1 root root 2143 10月24日 05:15 blog.example.com.crt
-rw-r--r-- 1 root root 1830 10月24日 05:15 blog.example.com.csr
-rw-r--r-- 1 root root 3272 10月24日 05:15 blog.example.com.key
CSR EXISTS
Private-Key: (4096 bit, 2 primes)
root@debian:~# cat /usr/local/hestia/bin/v-generate-ssl-cert
#!/bin/bash
# info: generate self signed certificate and CSR request
# options: DOMAIN EMAIL COUNTRY STATE CITY ORG UNIT [ALIASES] [FORMAT] [KEY_ALGO]
#
# example: v-generate-ssl-cert example.com [email protected] USA California Monterey ACME.COM IT
#
# This function generates self signed SSL certificate and CSR request
#----------------------------------------------------------#
# Variables & Functions #
#----------------------------------------------------------#
# Argument definition
domain=$1
domain=$(echo "$domain" | sed -e 's/\.*$//g' -e 's/^\.*//g')
domain_alias=$domain
email=$2
country=$3
state=$4
city=$5
org=$6
org_unit=$7
aliases=$8
format=${9-shell}
# Key algorithm: ecdsa-256 (default) | ecdsa-384 | rsa
key_algo="${10:-ecdsa-256}"
key_algo="${key_algo,,}"
# Set curve based on key_algo
if [ "$key_algo" = 'ecdsa-256' ]; then
ec_curve='prime256v1'
elif [ "$key_algo" = 'ecdsa-384' ]; then
ec_curve='secp384r1'
fi
KEY_SIZE=4096
DAYS=365
# Includes
# shellcheck source=/etc/hestiacp/hestia.conf
source /etc/hestiacp/hestia.conf
# shellcheck source=/usr/local/hestia/func/main.sh
source $HESTIA/func/main.sh
# load config file
source_conf "$HESTIA/conf/hestia.conf"
# Json function
json_list_ssl() {
jq -n \
--arg domain "$domain" \
--arg crt "$crt" \
--arg key "$key" \
--arg csr "$csr" \
--arg dir "$workdir" \
'{
($domain): {
CRT: $crt,
KEY: $key,
CSR: $csr,
DIR: $dir
}
}'
}
# Shell function
shell_list_ssl() {
if [ -n "$crt" ]; then
printf '%s\n' "$crt"
fi
if [ -n "$key" ]; then
printf '\n%s\n' "$key"
fi
if [ -n "$csr" ]; then
printf '\n%s\n' "$csr"
fi
printf '\nDirectory: %s\n' "$workdir"
}
# Additional argument formatting
format_domain_idn
if [[ "$email" = *[![:ascii:]]* ]]; then
local=$(echo "$email" | cut -f1 -d'@')
email_domain=$(echo "$email" | cut -f2 -d'@')
email_domain_idn=$(idn2 --quiet $email_domain)
email="$local"@"$email_domain_idn"
fi
#----------------------------------------------------------#
# Verifications #
#----------------------------------------------------------#
args_usage='DOMAIN EMAIL COUNTRY STATE CITY ORG UNIT [ALIASES] [FORMAT] [KEY_ALGO]'
check_args '7' "$#" "$args_usage"
is_format_valid 'domain' 'aliases' 'format' 'email' 'key_algo'
is_common_format_valid "$country" "country"
is_common_format_spaces_valid "$state" "state"
is_common_format_spaces_valid "$org" "org"
is_common_format_spaces_valid "$unit" "unit"
release="$(lsb_release -s -r)"
if [ -z "$email" ] && [ "$release" = "18.04" ]; then
echo "Email address is required"
exit 2
fi
if [ ! -f /root/.rnd ]; then
touch /root/.rnd
fi
# Perform verification if read-only mode is enabled
check_hestia_demo_mode
#----------------------------------------------------------#
# Action #
#----------------------------------------------------------#
# Create temporary work directory
workdir=$(mktemp -d)
cd $workdir
# Generate private key
if [[ "$key_algo" = "ecdsa-256" || "$key_algo" = "ecdsa-384" ]]; then
openssl ecparam -name "$ec_curve" -genkey -noout -out "$domain.key" 2> /dev/null
else
openssl genrsa "$KEY_SIZE" > "$domain.key" 2> /dev/null
fi
subj=""
# Generate the CSR
if [ -n "$email" ]; then
subj="/emailAddress=$email"
fi
subj="$subj/C=$country/ST=$state/L=$city/O=$org"
subj="$subj/OU=$org_unit"
# The CN (CommonName) has an ASN.1 limit of 64 characters in OpenSSL.
# If the domain exceeds this limit, the CN is omitted and only the SAN
# (subjectAltName) is trusted, which is what modern browsers validate.
if [ ${#domain_idn} -le 64 ]; then
subj="$subj/CN=$domain_idn"
fi
if [ -e "/etc/ssl/openssl.cnf" ]; then
ssl_conf='/etc/ssl/openssl.cnf'
else
ssl_conf="/etc/pki/tls/openssl.cnf"
fi
if [ -z "$aliases" ]; then
openssl req -sha256 -new \
-batch \
-subj "$subj" \
-key $domain.key \
-reqexts SAN \
-config <(cat $ssl_conf \
<(printf "\n[SAN]\nsubjectAltName=DNS:$domain")) \
-out $domain.csr > /dev/null 2>&1
else
for alias in $(echo $domain,$aliases | tr ',' '\n' | sort -u); do
if [[ "$alias" = *[![:ascii:]]* ]]; then
alias=$(idn2 --quiet $alias)
fi
dns_aliases="${dns_aliases}DNS:$alias,"
done
dns_aliases=$(echo $dns_aliases | sed "s/,$//")
openssl req -sha256 -new \
-batch \
-subj "$subj" \
-key $domain.key \
-reqexts SAN \
-config <(cat $ssl_conf \
<(printf "\n[SAN]\nsubjectAltName=$dns_aliases")) \
-out $domain.csr > /dev/null 2>&1
fi
# Generate the cert 1 year
if [ -z "$aliases" ]; then
openssl x509 -req -sha256 \
-days $DAYS \
-in $domain.csr \
-signkey $domain.key \
-extfile <(printf "\n[SAN]\nsubjectAltName=DNS:$domain") \
-extensions SAN \
-out $domain.crt > /dev/null 2>&1
else
openssl x509 -req -sha256 \
-days $DAYS \
-in $domain.csr \
-signkey $domain.key \
-extfile <(printf "\n[SAN]\nsubjectAltName=$dns_aliases") \
-extensions SAN \
-out $domain.crt > /dev/null 2>&1
fi
# Listing certificates
if [ -e "$domain.crt" ]; then
crt=$(< "$domain.crt")
fi
if [ -e "$domain.key" ]; then
key=$(< "$domain.key")
fi
if [ -e "$domain.csr" ]; then
csr=$(< "$domain.csr")
fi
case $format in
json) json_list_ssl ;;
plain | shell) shell_list_ssl ;;
*) check_args '1' '0' '[FORMAT]' ;;
esac
# Don't allow non root users view folder
chmod 660 $workdir
# Clean up the mess
echo "rm -rf $workdir" | at -M "now +15 minute" > /dev/null 2>&1
# Delete tmp dir
#rm -rf $workdir
#----------------------------------------------------------#
# Hestia #
#----------------------------------------------------------#
# Logging
log_event "$OK" "$ARGUMENTS"
exitroot@debian:~# cat -A /etc/ssl/openssl.cnf
#$
# OpenSSL example configuration file.$
# See doc/man5/config.pod for more info.$
#$
# This is mostly being used for generation of certificate requests,$
# but may be used for auto loading of providers$
$
# Note that you can include other files from the main configuration$
# file using the .include directive.$
#.include filename$
$
# This definition stops the following lines choking if HOME isn't$
# defined.$
HOME^I^I^I= .$
$
# Use this in order to automatically load providers.$
openssl_conf = openssl_init$
$
# Comment out the next line to ignore configuration errors$
config_diagnostics = 1$
$
# Extra OBJECT IDENTIFIER info:$
# oid_file = $ENV::HOME/.oid$
oid_section = new_oids$
$
# To use this configuration file with the "-extfile" option of the$
# "openssl x509" utility, name here the section containing the$
# X.509v3 extensions to use:$
# extensions^I^I=$
# (Alternatively, use a configuration file that has only$
# X.509v3 extensions in its main [= default] section.)$
$
[ new_oids ]$
# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.$
# Add a simple OID like this:$
# testoid1=1.2.3.4$
# Or use config file substitution like this:$
# testoid2=${testoid1}.5.6$
$
# Policies used by the TSA examples.$
tsa_policy1 = 1.2.3.4.1$
tsa_policy2 = 1.2.3.4.5.6$
tsa_policy3 = 1.2.3.4.5.7$
$
# For FIPS$
# Optionally include a file that is generated by the OpenSSL fipsinstall$
# application. This file contains configuration data required by the OpenSSL$
# fips provider. It contains a named section e.g. [fips_sect] which is$
# referenced from the [provider_sect] below.$
# Refer to the OpenSSL security policy for more information.$
# .include fipsmodule.cnf$
$
[openssl_init]$
providers = provider_sect$
ssl_conf = ssl_sect$
$
# List of providers to load$
[provider_sect]$
default = default_sect$
# The fips section name should match the section name inside the$
# included fipsmodule.cnf.$
# fips = fips_sect$
$
# If no providers are activated explicitly, the default one is activated implicitly.$
# See man 7 OSSL_PROVIDER-default for more details.$
#$
# If you add a section explicitly activating any other provider(s), you most$
# probably need to explicitly activate the default provider, otherwise it$
# becomes unavailable in openssl. As a consequence applications depending on$
# OpenSSL may not work correctly which could lead to significant system$
# problems including inability to remotely access the system.$
[default_sect]$
# activate = 1$
$
$
####################################################################$
[ ca ]$
default_ca^I= CA_default^I^I# The default ca section$
$
####################################################################$
[ CA_default ]$
$
dir^I^I= ./demoCA^I^I# Where everything is kept$
certs^I^I= $dir/certs^I^I# Where the issued certs are kept$
crl_dir^I^I= $dir/crl^I^I# Where the issued crl are kept$
database^I= $dir/index.txt^I# database index file.$
#unique_subject^I= no^I^I^I# Set to 'no' to allow creation of$
^I^I^I^I^I# several certs with same subject.$
new_certs_dir^I= $dir/newcerts^I^I# default place for new certs.$
$
certificate^I= $dir/cacert.pem ^I# The CA certificate$
serial^I^I= $dir/serial ^I^I# The current serial number$
crlnumber^I= $dir/crlnumber^I# the current crl number$
^I^I^I^I^I# must be commented out to leave a V1 CRL$
crl^I^I= $dir/crl.pem ^I^I# The current CRL$
private_key^I= $dir/private/cakey.pem # The private key$
$
x509_extensions^I= usr_cert^I^I# The extensions to add to the cert$
$
# Comment out the following two lines for the "traditional"$
# (and highly broken) format.$
name_opt ^I= ca_default^I^I# Subject Name options$
cert_opt ^I= ca_default^I^I# Certificate field options$
$
# Extension copying option: use with caution.$
# copy_extensions = copy$
$
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs$
# so this is commented out by default to leave a V1 CRL.$
# crlnumber must also be commented out to leave a V1 CRL.$
# crl_extensions^I= crl_ext$
$
default_days^I= 365^I^I^I# how long to certify for$
default_crl_days= 30^I^I^I# how long before next CRL$
default_md^I= default^I^I# use public key default MD$
preserve^I= no^I^I^I# keep passed DN ordering$
$
# A few difference way of specifying how similar the request should look$
# For type CA, the listed attributes must be the same, and the optional$
# and supplied fields are just that :-)$
policy^I^I= policy_match$
$
# For the CA policy$
[ policy_match ]$
countryName^I^I= match$
stateOrProvinceName^I= match$
organizationName^I= match$
organizationalUnitName^I= optional$
commonName^I^I= supplied$
emailAddress^I^I= optional$
$
# For the 'anything' policy$
# At this point in time, you must list all acceptable 'object'$
# types.$
[ policy_anything ]$
countryName^I^I= optional$
stateOrProvinceName^I= optional$
localityName^I^I= optional$
organizationName^I= optional$
organizationalUnitName^I= optional$
commonName^I^I= supplied$
emailAddress^I^I= optional$
$
####################################################################$
[ req ]$
default_bits^I^I= 2048$
default_keyfile ^I= privkey.pem$
distinguished_name^I= req_distinguished_name$
attributes^I^I= req_attributes$
x509_extensions^I= v3_ca^I# The extensions to add to the self signed cert$
$
# Passwords for private keys if not present they will be prompted for$
# input_password = secret$
# output_password = secret$
$
# This sets a mask for permitted string types. There are several options.$
# default: PrintableString, T61String, BMPString.$
# pkix^I : PrintableString, BMPString (PKIX recommendation before 2004)$
# utf8only: only UTF8Strings (PKIX recommendation after 2004).$
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).$
# MASK:XXXX a literal mask value.$
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.$
string_mask = utf8only$
$
req_extensions = v3_req # The extensions to add to a certificate request$
$
[ req_distinguished_name ]$
countryName^I^I^I= Country Name (2 letter code)$
countryName_default^I^I= AU$
countryName_min^I^I^I= 2$
countryName_max^I^I^I= 2$
$
stateOrProvinceName^I^I= State or Province Name (full name)$
stateOrProvinceName_default^I= Some-State$
$
localityName^I^I^I= Locality Name (eg, city)$
$
0.organizationName^I^I= Organization Name (eg, company)$
0.organizationName_default^I= Internet Widgits Pty Ltd$
$
# we can do this but it is not needed normally :-)$
#1.organizationName^I^I= Second Organization Name (eg, company)$
#1.organizationName_default^I= World Wide Web Pty Ltd$
$
organizationalUnitName^I^I= Organizational Unit Name (eg, section)$
#organizationalUnitName_default^I=$
$
commonName^I^I^I= Common Name (e.g. server FQDN or YOUR name)$
commonName_max^I^I^I= 64$
$
emailAddress^I^I^I= Email Address$
emailAddress_max^I^I= 64$
$
# SET-ex3^I^I^I= SET extension number 3$
$
[ req_attributes ]$
challengePassword^I^I= A challenge password$
challengePassword_min^I^I= 4$
challengePassword_max^I^I= 20$
$
unstructuredName^I^I= An optional company name$
$
[ usr_cert ]$
$
# These extensions are added when 'ca' signs a request.$
$
# This goes against PKIX guidelines but some CAs do it and some software$
# requires this to avoid interpreting an end user certificate as a CA.$
$
basicConstraints=CA:FALSE$
$
# This is typical in keyUsage for a client certificate.$
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment$
$
# PKIX recommendations harmless if included in all certificates.$
subjectKeyIdentifier=hash$
authorityKeyIdentifier=keyid,issuer$
$
# This stuff is for subjectAltName and issuerAltname.$
# Import the email address.$
# subjectAltName=email:copy$
# An alternative to produce certificates that aren't$
# deprecated according to PKIX.$
# subjectAltName=email:move$
$
# Copy subject details$
# issuerAltName=issuer:copy$
$
# This is required for TSA certificates.$
# extendedKeyUsage = critical,timeStamping$
$
[ v3_req ]$
$
# Extensions to add to a certificate request$
$
basicConstraints = CA:FALSE$
keyUsage = nonRepudiation, digitalSignature, keyEncipherment$
$
[ v3_ca ]$
$
$
# Extensions for a typical CA$
$
$
# PKIX recommendation.$
$
subjectKeyIdentifier=hash$
$
authorityKeyIdentifier=keyid:always,issuer$
$
basicConstraints = critical,CA:true$
$
# Key usage: this is typical for a CA certificate. However since it will$
# prevent it being used as an test self-signed certificate it is best$
# left out by default.$
# keyUsage = cRLSign, keyCertSign$
$
# Include email address in subject alt name: another PKIX recommendation$
# subjectAltName=email:copy$
# Copy issuer details$
# issuerAltName=issuer:copy$
$
# DER hex encoding of an extension: beware experts only!$
# obj=DER:02:03$
# Where 'obj' is a standard or added object$
# You can even override a supported extension:$
# basicConstraints= critical, DER:30:03:01:01:FF$
$
[ crl_ext ]$
$
# CRL extensions.$
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.$
$
# issuerAltName=issuer:copy$
authorityKeyIdentifier=keyid:always$
$
[ proxy_cert_ext ]$
# These extensions should be added when creating a proxy certificate$
$
# This goes against PKIX guidelines but some CAs do it and some software$
# requires this to avoid interpreting an end user certificate as a CA.$
$
basicConstraints=CA:FALSE$
$
# This is typical in keyUsage for a client certificate.$
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment$
$
# PKIX recommendations harmless if included in all certificates.$
subjectKeyIdentifier=hash$
authorityKeyIdentifier=keyid,issuer$
$
# This stuff is for subjectAltName and issuerAltname.$
# Import the email address.$
# subjectAltName=email:copy$
# An alternative to produce certificates that aren't$
# deprecated according to PKIX.$
# subjectAltName=email:move$
$
# Copy subject details$
# issuerAltName=issuer:copy$
$
# This really needs to be in place for it to be a proxy certificate.$
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo$
$
####################################################################$
[ tsa ]$
$
default_tsa = tsa_config1^I# the default TSA section$
$
[ tsa_config1 ]$
$
# These are used by the TSA reply generation only.$
dir^I^I= ./demoCA^I^I# TSA root directory$
serial^I^I= $dir/tsaserial^I# The current serial number (mandatory)$
crypto_device^I= builtin^I^I# OpenSSL engine to use for signing$
signer_cert^I= $dir/tsacert.pem ^I# The TSA signing certificate$
^I^I^I^I^I# (optional)$
certs^I^I= $dir/cacert.pem^I# Certificate chain to include in reply$
^I^I^I^I^I# (optional)$
signer_key^I= $dir/private/tsakey.pem # The TSA private key (optional)$
signer_digest = sha256^I^I^I# Signing digest to use. (Optional)$
default_policy^I= tsa_policy1^I^I# Policy if request did not specify it$
^I^I^I^I^I# (optional)$
other_policies^I= tsa_policy2, tsa_policy3^I# acceptable policies (optional)$
digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory)$
accuracy^I= secs:1, millisecs:500, microsecs:100^I# (optional)$
clock_precision_digits = 0^I# number of digits after dot. (optional)$
ordering^I^I= yes^I# Is ordering defined for timestamps?$
^I^I^I^I# (optional, default: no)$
tsa_name^I^I= yes^I# Must the TSA name be included in the reply?$
^I^I^I^I# (optional, default: no)$
ess_cert_id_chain^I= no^I# Must the ESS cert id chain be included?$
^I^I^I^I# (optional, default: no)$
ess_cert_id_alg^I^I= sha256^I# algorithm to compute certificate$
^I^I^I^I# identifier (optional, default: sha256)$
$
[insta] # CMP using Insta Demo CA$
# Message transfer$
server = pki.certificate.fi:8700$
# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080$
# tls_use = 0$
path = pkix/$
$
# Server authentication$
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer$
ignore_keyusage = 1 # quirk needed to accept Insta CA cert not including digitalsignature$
unprotected_errors = 1 # quirk needed to accept negative responses possibly not protected$
extracertsout = insta.extracerts.pem$
$
# Client authentication$
ref = 3078 # user identification$
secret = pass:insta # can be used for both client and server side$
$
# Generic message options$
cmd = ir # default operation, can be overridden on cmd line with, e.g., kur$
$
# Certificate enrollment$
subject = "/CN=openssl-cmp-test"$
newkey = insta.priv.pem$
out_trusted = apps/insta.ca.crt # does not include keyUsage digitalSignature$
certout = insta.cert.pem$
$
[pbm] # Password-based protection for Insta CA$
# Server and client authentication$
ref = $insta::ref # 3078$
secret = $insta::secret # pass:insta$
$
[signature] # Signature-based protection for Insta CA$
# Server authentication$
trusted = $insta::out_trusted # apps/insta.ca.crt$
$
# Client authentication$
secret = # disable PBM$
key = $insta::newkey # insta.priv.pem$
cert = $insta::certout # insta.cert.pem$
$
[ir]$
cmd = ir$
$
[cr]$
cmd = cr$
$
[kur]$
# Certificate update$
cmd = kur$
oldcert = $insta::certout # insta.cert.pem$
$
[rr]$
# Certificate revocation$
cmd = rr $
oldcert = $insta::certout # insta.cert.pem$
$
[ssl_sect] $
system_default = hestia_openssl_sect $
$
[hestia_openssl_sect] $
Ciphersuites = TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384$
Options = PrioritizeChaCharoot@debian:~#
PR submitted: #5831 — fixes OpenSSL 3.x compatibility in