2 files changed, 51 insertions, 9 deletions

diff --git a/hosts/vidhar/prometheus/tls.crt b/hosts/vidhar/prometheus/tls.crt
index f5c682fd..1a5bb7bb 100644
--- a/hosts/vidhar/prometheus/tls.crt
+++ b/hosts/vidhar/prometheus/tls.crt
@@ -1,11 +1,11 @@
 -----BEGIN CERTIFICATE-----
-MIIBljCCAUigAwIBAgIPQAAAAGNpZawFYkQ2knHlMAUGAytlcDAfMR0wGwYDVQQD
-DBRwcm9tZXRoZXVzLnlnZ2RyYXNpbDAeFw0yMjExMDcyMDAyMzVaFw0zMjExMDcy
-MDA3MzVaMBsxGTAXBgNVBAMMEHZpZGhhci55Z2dkcmFzaWwwKjAFBgMrZXADIQAT
+MIIBljCCAUigAwIBAgIPQAAAAGNpbKICZnRijYnYMAUGAytlcDAfMR0wGwYDVQQD
+DBRwcm9tZXRoZXVzLnlnZ2RyYXNpbDAeFw0yMjExMDcyMDMyMTdaFw0zMjExMDcy
+MDM3MTdaMBsxGTAXBgNVBAMMEHZpZGhhci55Z2dkcmFzaWwwKjAFBgMrZXADIQAT
 hKYBB3pejSuNg+5zHca4mq25PUBR7CzzUn2BkOesiKOBnjCBmzAfBgNVHSMEGDAW
 gBRoLn1ecDxcc35XFQG3esmYPTIisjAdBgNVHQ4EFgQURKqOzKvJp9Gh0Pp/24ce
 CKpuTVkwDgYDVR0PAQH/BAQDAgXgMAwGA1UdEwEB/wQCMAAwEwYDVR0lBAwwCgYI
-KwYBBQUHAwIwJgYDVR0RBB8wHYIbcHJvbWV0aGV1cy52aWRoYXIueWdnZHJhc2ls
-MAUGAytlcANBANhuOaE//pq/5VuYU4j9FU9nJ8KMb5xTruMZfBpribUvGW9Hhhc1
-4hIMtXflbPQCn7z6qfmobcw5y0zqRkjjSAk=
+KwYBBQUHAwEwJgYDVR0RBB8wHYIbcHJvbWV0aGV1cy52aWRoYXIueWdnZHJhc2ls
+MAUGAytlcANBAK3zsSMHBfdnimTyPeekILvkE/JCTADxPJTzsHrsqenrXTG9G1t7
+AwHrtfuB8xLGo+Jl2ofSy/Q3nGZDLNX+IQY=
 -----END CERTIFICATE-----
diff --git a/tools/ca/ca/__main__.py b/tools/ca/ca/__main__.py
index e3e4bbe6..118b3763 100644
--- a/tools/ca/ca/__main__.py
+++ b/tools/ca/ca/__main__.py
@@ -30,6 +30,7 @@ from tempfile import TemporaryFile
 import subprocess
 import json
 from leapseconddata import LeapSecondData
+from collections.abc import Iterable
 
 
 class KeyType(Enum):
@@ -76,6 +77,28 @@ class KeyType(Enum):
         except KeyError:
             raise ValueError()
 
+class SupportedKeyUsage(Enum):
+    SERVER_AUTH = 'server'
+    CLIENT_AUTH = 'client'
+
+    @property
+    def oid(self):
+        match self:
+            case SupportedKeyUsage.SERVER_AUTH:
+                return ExtendedKeyUsageOID.SERVER_AUTH
+            case SupportedKeyUsage.CLIENT_AUTH:
+                return ExtendedKeyUsageOID.CLIENT_AUTH
+
+    def __str__(self):
+        return self.value
+
+    @classmethod
+    def from_string(cls, s):
+        try:
+            return cls(s)
+        except KeyError:
+            raise ValueError()
+
 class ValidFQDN(FQDN):
     def __init__(self, *args, **kwds):
         super().__init__(*args, **kwds)
@@ -133,6 +156,19 @@ class BooleanAction(argparse.Action):
     def __call__(self, parser, namespace, values, option_string=None):
         setattr(namespace, self.dest, False if option_string.startswith('--no') else True)
 
+class ExtendAction(argparse.Action):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.reset_dest = False
+    def __call__(self, parser, namespace, values, option_string=None):
+        if not self.reset_dest:
+            setattr(namespace, self.dest, [])
+            self.reset_dest = True
+        if isinstance(values, Iterable):
+            getattr(namespace, self.dest).extend(values)
+        else:
+            getattr(namespace, self.dest).append(values)
+
 
 def load_key(keyfile, prompt='CA private key password: '):
     key = None
@@ -294,7 +330,10 @@ def initca(ca_cert, ca_key, key_type, subject, clock_skew, validity, sops):
         logger.debug('Adjusting permissions for ‘%s’...', ca_cert)
         os.chmod(ca_cert, 0o0444)
 
-def signcsr(ca_cert, ca_key, clock_skew, validity, subject, alternative_name, ignore_alternative_names, csr, output):
+def signcsr(ca_cert, ca_key, clock_skew, validity, subject, alternative_name, key_usage, ignore_alternative_names, csr, output):
+    if not key_usage:
+        raise InvalidParamsError('No extended key usages specified')
+
     csr_bytes = None
     try:
         csr_bytes = csr.read()
@@ -348,7 +387,7 @@ def signcsr(ca_cert, ca_key, clock_skew, validity, subject, alternative_name, ig
         x509.BasicConstraints(ca=False, path_length=None),
         True
     ).add_extension(
-        x509.ExtendedKeyUsage([ExtendedKeyUsageOID.CLIENT_AUTH]),
+        x509.ExtendedKeyUsage(list(map(lambda ku: ku.oid, key_usage))),
         False
     )
 
@@ -374,7 +413,7 @@ def signcsr(ca_cert, ca_key, clock_skew, validity, subject, alternative_name, ig
     logger.debug('Adjusting permissions for ‘%s’...', output)
     os.chmod(output, 0o0444)
 
-def new_client(ca_cert, ca_key, key_type, clock_skew, validity, subject, alternative_name, sops, output):
+def new_client(ca_cert, ca_key, key_type, clock_skew, validity, subject, alternative_name, key_usage, sops, output):
     key_file = output.with_suffix('.key')
     cert_file = output.with_suffix('.crt')
 
@@ -417,6 +456,7 @@ def new_client(ca_cert, ca_key, key_type, clock_skew, validity, subject, alterna
         validity=validity,
         subject=None,
         alternative_name=[],
+        key_usage=key_usage,
         ignore_alternative_names=False,
         output=cert_file,
         csr=csr.sign(
@@ -524,6 +564,7 @@ def main():
     subparser.add_argument('--validity', metavar='DURATION', type=duration, default=timedelta(days=ceil(365.2425*10)))
     subparser.add_argument('--subject', metavar='CN', type=str, required=False)
     subparser.add_argument('--ignore-alternative-names', '--no-ignore-alternative-names', action=BooleanAction, default=True)
+    subparser.add_argument('--key-usage', metavar='KEY_USAGE', type=SupportedKeyUsage, action=ExtendAction, default=[SupportedKeyUsage.CLIENT_AUTH])
     subparser.add_argument('--alternative-name', metavar='CN', type=str, action='append')
     subparser.add_argument('--output', type=Path, required=True)
     subparser.add_argument('csr', metavar='FILE', type=argparse.FileType(mode='rb'))
@@ -537,6 +578,7 @@ def main():
     subparser.add_argument('--validity', metavar='DURATION', type=duration, default=timedelta(days=ceil(365.2425*10)))
     subparser.add_argument('--sops', '--no-sops', action=BooleanAction, default=True)
     subparser.add_argument('--subject', metavar='CN', type=str, required=True)
+    subparser.add_argument('--key-usage', metavar='KEY_USAGE', type=SupportedKeyUsage, action=ExtendAction, default=[SupportedKeyUsage.CLIENT_AUTH])
     subparser.add_argument('--alternative-name', metavar='CN', type=str, action='append')
     subparser.add_argument('--output', type=Path, required=True)
     subparser.set_defaults(cmd=new_client)