From 0dca40222b5cd71087708e845c6c6b7193660f88 Mon Sep 17 00:00:00 2001 From: Pat Fruth Date: Sun, 20 Oct 2019 14:51:34 -0600 Subject: [PATCH] Include new extensions in uhttpd self-signed certs The introduction of MacOS Catalina includes new requirements for self-signed certificates. See: https://support.apple.com/en-us/HT210176 These new requirements include the addition of two TLS server certificate extensions. - extendedKeyUsage - subjectAltName The extendedKeyUsage must be set to serverAuth. The subjectAltName must be set to the DNS name of the server. In the absense of these new extensions, when the LUCI web interface is configured to use HTTPS and self-signed certs, MacOS user running Google Chrome browsers will not be able to access the LUCI web enterface. If you are generating self-signed certs which do not include that extension, Chrome will report "NET::ERR_CERT_INVALID" instead of "NET::ERR_CERT_AUTHORITY_INVALID". You can click through to ignore the latter, but not the former. This change updates the uhttpd init script to generate self-signed cert that meets the new requirements. Signed-off-by: Pat Fruth --- package/network/services/uhttpd/files/uhttpd.init | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/package/network/services/uhttpd/files/uhttpd.init b/package/network/services/uhttpd/files/uhttpd.init index c4d0025d69..d9e742024d 100755 --- a/package/network/services/uhttpd/files/uhttpd.init +++ b/package/network/services/uhttpd/files/uhttpd.init @@ -57,7 +57,8 @@ generate_keys() { [ -n "$GENKEY_CMD" ] && { $GENKEY_CMD \ -days ${days:-730} -newkey ${KEY_OPTS} -keyout "${UHTTPD_KEY}.new" -out "${UHTTPD_CERT}.new" \ - -subj /C="${country:-ZZ}"/ST="${state:-Somewhere}"/L="${location:-Unknown}"/O="${organization:-OpenWrt$UNIQUEID}"/CN="${commonname:-OpenWrt}" + -subj /C="${country:-ZZ}"/ST="${state:-Somewhere}"/L="${location:-Unknown}"/O="${organization:-OpenWrt$UNIQUEID}"/CN="${commonname:-OpenWrt}" \ + -addext extendedKeyUsage=serverAuth -addext subjectAltName=DNS:"${commonname:-OpenWrt}" sync mv "${UHTTPD_KEY}.new" "${UHTTPD_KEY}" mv "${UHTTPD_CERT}.new" "${UHTTPD_CERT}" -- 2.30.2