Added new rootCertCommonName option is config.json setting to change the default root common name when generating the root certificate, #4221
Ylian Saint-Hilaire committed
Jul 5, 2022 at 13:44 UTC
acd281c990359ee0279a74137ac8473e22778233
2 files changed
+9
-2
certoperations.js
+7
-1
@@ -1006,7 +1006,13 @@ module.exports.CertificateOperations = function (parent) {
1006
if (r.root == null) {
1007
// If the root certificate does not exist, create one
1008
console.log("Generating root certificate...");
1009
- rootCertAndKey = obj.GenerateRootCertificate(true, 'MeshCentralRoot', null, null, strongCertificate);
1009
+ if (typeof args.rootcertcommonname == 'string') {
1010
+ // If a root certificate common name is specified, use it.
1011
+ rootCertAndKey = obj.GenerateRootCertificate(false, args.rootcertcommonname, null, null, strongCertificate);
1012
+ } else {
1013
+ // A root certificate common name is not specified, use the default one.
1014
+ rootCertAndKey = obj.GenerateRootCertificate(true, 'MeshCentralRoot', null, null, strongCertificate);
1015
+ }
1016
rootCertificate = obj.pki.certificateToPem(rootCertAndKey.cert);
1017
rootPrivateKey = obj.pki.privateKeyToPem(rootCertAndKey.key);
1018
obj.fs.writeFileSync(parent.getConfigFilePath('root-cert-public.crt'), rootCertificate);
meshcentral-config-schema.json
+2
-1
@@ -199,7 +199,7 @@
199
"type": "object",
200
"properties": {
201
"mongoDumpPath": { "type": "string" },
202
- "mysqlDumpPath": { "type": "string"},
202
+ "mysqlDumpPath": { "type": "string" },
203
"backupIntervalHours": { "type": "integer" },
204
"keepLastDaysBackup": { "type": "integer" },
205
"zipPassword": { "type": "string" },
@@ -250,6 +250,7 @@
250
}
251
}
252
},
253
+ "rootCertCommonName" : { "type": "string", "default": "MeshCentralRoot-XXXXXX", "description": "The common name of the MeshCentral server root certificate. By default it's 'MeshCentralRoot-' followed by the first 6 HEX digits of the public key fingerprint. For this setting to take effect, all generated certificates need to be deleted and reset. Existing agents will not be able to connect anymore." },
254
"redirects": { "type": "object" },
255
"maxInvalidLogin": {
256
"type": "object",