I got really busy this last week, so didn’t show up to social media as much as I would have liked. I also didn’t respond to the comment from last week’s post right away. Since the question came up, I thought I’d mention it here, on top of my direct response about Google HangOuts on the OpenBSD laptop.
The short answer is, I don’t use HangOuts, so I didn’t test it before the question was raised. The long answer is that Google has some restrictions about which browsers the Video chat will work on, and the newest versions of Firefox aren’t on the list. I believe I read somewhere that Google is working on correcting this, but until they do, Video chat is a no go for this set up. On the other hand, the text chat works fine.
I also wanted to mention the program that I was going to test for temporarily disabling the touchpad. The program is “syndaemon” and if it worked, I could just drop a line in my .xinitrc file that has “syndaemon -d” on it. Unfortunately, it doesn’t work on this laptop. I get an error about it being “Unable to find a synaptics device.” I’ll have to dig further into how the pointer is recognized and see if there are any alternatives.
Now that that’s out of the way, I thought I’d dive into the discussion about using “subject alternative names” with a certificate signing request.
In the past, I’ve recommended tacking on a “subjectAltName=DNS.1=host.domain.tld,DNS.2=althost.domain.tld” type of string onto the end of your -subj flag that contains the OU information for the request. This apparently doesn’t generate a certificate that some authorities will recognize, so we’re forced to use the x509 extensions to pull it in. Almost every recommendation out there says to create a temporary openssl.cnf file, append the SAN section to it, and then generate your certificate, pointing at that cert. There is a good reason for this. The way to do without a hard coded temporary file is to take advantage of BASH’s “process substitution” ability. KSH93 supposedly has this feature as well, but when I tested ksh93 on AIX, it didn’t work, so I will say to test your own ksh93 before just assuming this will benefit you. Otherwise, stick with bash.
The temporary file would normally be a copy of whatever the openssl.cnf default configuration file is, plus the appended [SAN] section so that the extensions can be requested. In order to find the location of the default configuration file, we would run this command:
openssl version -d | awk '{print $NF}' | tr -d '"'
This gives us the directory where it lives. We then tack on the “openssl.cnf” for the full path like so:
$( openssl version -d | awk '{print $NF}' | tr -d '"' )/openssl.cnf
So, if we wanted to create that temporary file, we might do this:
$( cat $( openssl version -d | awk '{print $NF}' | tr -d '"' )/openssl.cnf ); printf "\n[SAN]\nsubjectAltName=DNS:%s.domain.tld,DNS:alt%s.domain.tld" ${HOSTNAME} ${HOSTNAME} ) >>openssl.temp.cnf
Then we would point the -extfile or -config flag at this temporary file. However, since we’re being stubborn, we’ll use BASH’s process substitution to do this, instead.
openssl req -nodes -newkey rsa:4096 -keyout ${HOSTNAME}.domain.tld.key -out ${HOSTNAME}.domain.tld.csr -sha256 -subj="/C=US/ST=Arkansas/L=Conway/O=UnixSecLab/OU=TheLab/CN=${HOSTNAME}.domain.tld/subjectAltName=DNS.1=${HOSTNAME}.domain.tld,DNS.2=alt${HOSTNAME}.domain.tld" -config <( cat $( openssl version -d | awk '{print $NF}' | tr -d '"' )/openssl.cnf ); printf "\n[SAN]\nsubjectAltName=DNS:%s.domain.tld,DNS:alt%s.domain.tld" ${HOSTNAME} ${HOSTNAME} ) -reqexts SAN -extensions SAN
Whew. That’s a lot to take in. The “<( cat … )” is BASH process substitution. Instead of creating a variable that contains all of the output from the “cat” and “printf” commands, it sticks those into a file descriptor located at /dev/fd/## (where ## is the file descriptor number in use.) Think of this as kind of a temporary named pipe/FIFO. Since the openssl command requires an actual file it can do an “open” on when dealing with the -config or -extfile flags, we can’t pipe things in normally. Our only option is to create an actual temporary file, or create a named FIFO to talk to (which is overkill, so temp file is better.) BASH lets us kind of sort of create that with process substitution without having to clean up after ourselves by removing the FIFO file.
Is this practical? Probably not. It is less effort to do the temporary file and clean it up after, and more portable, as well.
Am I stubborn? Absolutely. That’s what led to my whipping up the abomination above. Would I recommend this to others? Not really. Again, just go with what’s practical. There’s a reason people recommend it in most of the online commentary on this Subject Alternative Names (SAN) discussion.