Allow to configure validity period of generated certificates

fhessel · fhessel · commit b18fc3724891 · 2019-01-15T03:35:51.000+01:00
diff --git a/examples/Self-Signed-Certificate/Self-Signed-Certificate.ino b/examples/Self-Signed-Certificate/Self-Signed-Certificate.ino
@@ -56,7 +56,15 @@ void setup() {
   // - Distinguished name: The name of the host as used in certificates.
   //   If you want to run your own DNS, the part after CN (Common Name) should match the DNS
   //   entry pointing to your ESP32. You can try to insert an IP there, but that's not really good style.
-  int createCertResult = createSelfSignedCert(*cert, KEYSIZE_2048, "CN=myesp32.local,O=FancyCompany,C=DE");
+  // - Dates for certificate validity (optional, default is 2019-2029, both included)
+  //   Format is YYYYMMDDhhmmss
+  int createCertResult = createSelfSignedCert(
+    *cert,
+    KEYSIZE_2048,
+    "CN=myesp32.local,O=FancyCompany,C=DE",
+    "20190101000000",
+    "20300101000000"
+  );
 
   // Now check if creating that worked
   if (createCertResult != 0) {
diff --git a/src/SSLCert.cpp b/src/SSLCert.cpp
@@ -151,7 +151,7 @@ static int gen_key(SSLCert &certCtx, SSLKeySize keySize) {
  *
  * Based on programs/x509/cert_write.c
  */
-static int cert_write(SSLCert &certCtx, std::string dn) {
+static int cert_write(SSLCert &certCtx, std::string dn, std::string validityFrom, std::string validityTo) {
 	int funcRes = 0;
 	int stepRes = 0;
 
@@ -210,7 +210,7 @@ static int cert_write(SSLCert &certCtx, std::string dn) {
 	}
 
   // Set the validity of the certificate. At the moment, it's fixed from 2019 to end of 2029.
-	stepRes = mbedtls_x509write_crt_set_validity( &crt, "20190101000000", "20300101000000");
+	stepRes = mbedtls_x509write_crt_set_validity( &crt, validityFrom.c_str(), validityTo.c_str());
 	if (stepRes != 0) {
 		funcRes = HTTPS_SERVER_ERROR_CERTGEN_VALIDITY;
 		goto error_after_cert;
@@ -284,8 +284,8 @@ static int cert_write(SSLCert &certCtx, std::string dn) {
 	return funcRes;
 }
 
-int createSelfSignedCert(SSLCert &certCtx, SSLKeySize keySize, std::string dn) {
-	
+int createSelfSignedCert(SSLCert &certCtx, SSLKeySize keySize, std::string dn, std::string validFrom, std::string validUntil) {
+
 	// Add the private key
 	int keyRes = gen_key(certCtx, keySize);
 	if (keyRes != 0) {
@@ -294,7 +294,7 @@ int createSelfSignedCert(SSLCert &certCtx, SSLKeySize keySize, std::string dn) {
 	}
 
 	// Add the self-signed certificate
-	int certRes = cert_write(certCtx, dn);
+	int certRes = cert_write(certCtx, dn, validFrom, validUntil);
 	if (certRes != 0) {
 		// Cert writing failed, reset the pk and return failure code
 		certCtx.setPK(NULL, 0);
diff --git a/src/SSLCert.hpp b/src/SSLCert.hpp
@@ -77,10 +77,13 @@ enum SSLKeySize {
  * would be:
  *   CN=myesp.local,O=acme,C=US
  * 
+ * The strings validFrom and validUntil have to be formatted like this:
+ * "20190101000000", "20300101000000"
+ * 
  * This will take some time, so you should probably write the certificate data to non-volatile
  * storage when you are done.
  */
-int createSelfSignedCert(SSLCert &certCtx, SSLKeySize keySize, std::string dn);
+int createSelfSignedCert(SSLCert &certCtx, SSLKeySize keySize, std::string dn, std::string validFrom = "20190101000000", std::string validUntil = "20300101000000");
 
 #endif // !HTTPS_DISABLE_SELFSIGNING
 
