RepoMirrors/openwrt
1
0
Fork 0
mirror of git://git.openwrt.org/openwrt/openwrt.git synced 2025-02-18 04:56:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

uhttpd: Decrease the default validity time of certificate

Browse Source 
The recommended maximum validity period is currently 397 days
and some browsers throw warning with longer periods.

Reference to
https://cabforum.org/working-groups/server/baseline-requirements/
 6.3.2 Certificate operational periods and key pair usage periods
 Subscriber Certificates issued on or after 1 September 2020
 SHOULD NOT have a Validity Period greater than 397 days and
 MUST NOT have a Validity Period greater than 398 days.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Link: https://github.com/openwrt/openwrt/pull/15366
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit is contained in:
Hannu Nyman 2024-05-01 13:53:34 +03:00 committed by Robert Marko
parent db4e8ef952
commit 0b7d99147b
3 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
package/network/services/uhttpd/Makefile
View File

@ -8,7 +8,7 @@
include $(TOPDIR)/rules.mk include $(TOPDIR)/rules.mk
PKG_NAME:=uhttpd PKG_NAME:=uhttpd
PKG_RELEASE:=3 PKG_RELEASE:=4
PKG_SOURCE_PROTO:=git PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL=$(PROJECT_GIT)/project/uhttpd.git PKG_SOURCE_URL=$(PROJECT_GIT)/project/uhttpd.git

4
package/network/services/uhttpd/files/uhttpd.config
View File

@ -123,8 +123,8 @@ config uhttpd main
# Defaults for automatic certificate and key generation # Defaults for automatic certificate and key generation
config cert defaults config cert defaults
# Validity time # Validity time, 397 days is maximum allowed by CA/Browser forum
option days 730 option days 397
# key type: rsa or ec # key type: rsa or ec
option key_type ec option key_type ec

2
package/network/services/uhttpd/files/uhttpd.init
View File

@ -56,7 +56,7 @@ generate_keys() {
[ -x "$PX5G_BIN" ] && GENKEY_CMD="$PX5G_BIN selfsigned -der" [ -x "$PX5G_BIN" ] && GENKEY_CMD="$PX5G_BIN selfsigned -der"
[ -n "$GENKEY_CMD" ] && { [ -n "$GENKEY_CMD" ] && {
$GENKEY_CMD \ $GENKEY_CMD \
-days ${days:-730} -newkey ${KEY_OPTS} -keyout "${UHTTPD_KEY}.new" -out "${UHTTPD_CERT}.new" \ -days ${days:-397} -newkey ${KEY_OPTS} -keyout "${UHTTPD_KEY}.new" -out "${UHTTPD_CERT}.new" \
-subj /C="${country:-ZZ}"/ST="${state:-Somewhere}"/L="${location:-Unknown}"/O="${organization:-OpenWrt$UNIQUEID}"/CN="${commonname:-OpenWrt}" \ -subj /C="${country:-ZZ}"/ST="${state:-Somewhere}"/L="${location:-Unknown}"/O="${organization:-OpenWrt$UNIQUEID}"/CN="${commonname:-OpenWrt}" \
-addext extendedKeyUsage=serverAuth -addext subjectAltName=DNS:"${commonname:-OpenWrt}" -addext extendedKeyUsage=serverAuth -addext subjectAltName=DNS:"${commonname:-OpenWrt}"
sync sync