将自签名证书作为受信任的根证书添加到 Apple 钥匙串
Adding a self-signed certificate as a trusted root certificate to an Apple keychain
我正在尝试使用以下 Go 脚本将自签名证书添加到 MacOS 设备上的系统钥匙串：
package main
import (
"crypto/rand"
"crypto/rsa"
"crypto/x509"
"crypto/x509/pkix"
"encoding/pem"
"math/big"
"os"
"os/exec"
"time"
"github.com/sirupsen/logrus"
)
func main() {
keyFileName := "key.pem"
certFileName := "cert.pem"
// Generate a self-signed certificate (adapted from https://golang.org/src/crypto/tls/generate_cert.go)
key, err := rsa.GenerateKey(rand.Reader, 4096)
if err != nil {
logrus.WithError(err).Fatal("generate key")
}
keyFile, err := os.Create(keyFileName)
if err != nil {
logrus.WithError(err).Fatal("create key file")
}
if err = pem.Encode(keyFile, &pem.Block{
Type: "RSA PRIVATE KEY",
Bytes: x509.MarshalPKCS1PrivateKey(key),
}); err != nil {
logrus.WithError(err).Fatal("marshal private key")
}
keyFile.Close()
template := x509.Certificate{
SerialNumber: big.NewInt(42),
Subject: pkix.Name{
Country: []string{"US"},
Organization: []string{"Awesomeness, Inc."},
OrganizationalUnit: []string{"Awesomeness Dept."},
CommonName: "Awesomeness, Inc.",
},
NotBefore: time.Now(),
NotAfter: time.Now().AddDate(10, 0, 0),
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
IsCA: true,
BasicConstraintsValid: true,
}
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
if err != nil {
logrus.WithError(err).Fatal("failed to create certificate")
}
certFile, err := os.Create(certFileName)
if err != nil {
logrus.WithError(err).Fatal("create cert file")
}
if err = pem.Encode(certFile, &pem.Block{
Type: "CERTIFICATE",
Bytes: derBytes,
}); err != nil {
logrus.WithError(err).Fatal("encode certificate")
}
certFile.Close()
/*
add-trusted-cert [-d] [-r resultType] [-p policy] [-a appPath] [-s policyString] [-e allowedError] [-u
keyUsage] [-k keychain] [-i settingsFileIn] [-o settingsFileOut] certFile
Add certificate (in DER or PEM format) from certFile to per-user or local Admin Trust Settings. When
modifying per-user Trust Settings, user authentication is required via an authentication dialog. When
modifying admin Trust Settings, the process must be running as root, or admin authentication is
required.
Options:
-d Add to admin cert store; default is user.
-r resultType resultType = trustRoot|trustAsRoot|deny|unspecified; default is trustRoot.
-p policy Specify policy constraint (ssl, smime, codeSign, IPSec, basic, swUpdate, pkgSign,
eap, macappstore, appleID, timestamping).
-a appPath Specify application constraint.
-s policyString
Specify policy-specific string.
-e allowedError
Specify allowed error (an integer value, or one of: certExpired, hostnameMismatch)
-u keyUsage Specify key usage, an integer.
-k keychain Specify keychain to which cert is added.
-i settingsFileIn
Input trust settings file; default is user domain.
-o settingsFileOut
Output trust settings file; default is user domain.
Key usage codes:
-1 - Any
1 - Sign
2 - Encrypt/Decrypt Data
4 - Encrypt/Decrypt Key
8 - Sign certificate
16 - Sign revocation
32 - Key exchange
To specify more than one usage, add values together (except -1 - Any).
*/
args := []string{"add-trusted-cert", "-k", "/Library/Keychains/System.keychain", "-r", "trustAsRoot", certFileName}
output, err := exec.Command("/usr/bin/security", args...).CombinedOutput()
if err != nil {
logrus.Fatalf("add-trusted-cert: %v - %s", err, output)
}
}
但是，当我 运行 使用 sudo 这个脚本时，我得到一个相当不明确的 "One or more parameters passed to a function were not valid." 错误：
> sudo go run add_to_keychain_trusted.go
Password:
FATA[0002] add-trusted-cert: exit status 1 - SecTrustSettingsSetTrustSettings: One or more parameters passed to a function were not valid.
exit status 1
我注意到的一件事是，如果我使用 -r trustRoot 选项而不是 -r trustAsRoot，该命令会起作用。也许 -r trustAsRoot 选项不再受支持（尽管它在 man security 页面中有记录）？
在 https://www.jamf.com/jamf-nation/discussions/13812/problems-importing-cert-via-terminal 之后，我通过编写一个包含证书的配置文件并使用 profiles 命令行工具而不是直接使用 security 来安装它来解决这个问题。这是改编后的脚本：
package main
import (
"crypto/rand"
"crypto/rsa"
"crypto/x509"
"crypto/x509/pkix"
"encoding/pem"
"io/ioutil"
"math/big"
"os"
"os/exec"
"strings"
"time"
uuid "github.com/satori/go.uuid"
"github.com/sirupsen/logrus"
"howett.net/plist"
)
// Payload represents a configuration profile's payload. (Adapted from https://github.com/micromdm/micromdm/blob/master/mdm/enroll/profile.go).
type Payload struct {
PayloadType string `json:"type"`
PayloadVersion int `json:"version"`
PayloadIdentifier string `json:"identifier"`
PayloadUUID string `json:"uuid"`
PayloadDisplayName string `json:"displayname" plist:",omitempty"`
PayloadDescription string `json:"description,omitempty" plist:",omitempty"`
PayloadOrganization string `json:"organization,omitempty" plist:",omitempty"`
PayloadScope string `json:"scope" plist:",omitempty"`
PayloadContent interface{} `json:"content,omitempty" plist:"PayloadContent,omitempty"`
}
// Profile represents a configuration profile (cf. https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf)
type Profile struct {
PayloadContent []interface{} `json:"content,omitempty"`
PayloadDescription string `json:"description,omitempty" plist:",omitempty"`
PayloadDisplayName string `json:"displayname,omitempty" plist:",omitempty"`
PayloadExpirationDate *time.Time `json:"expiration_date,omitempty" plist:",omitempty"`
PayloadIdentifier string `json:"identifier"`
PayloadOrganization string `json:"organization,omitempty" plist:",omitempty"`
PayloadUUID string `json:"uuid"`
PayloadRemovalDisallowed bool `json:"removal_disallowed" plist:",omitempty"`
PayloadType string `json:"type"`
PayloadVersion int `json:"version"`
PayloadScope string `json:"scope" plist:",omitempty"`
RemovalDate *time.Time `json:"removal_date" plist:"-" plist:",omitempty"`
DurationUntilRemoval float32 `json:"duration_until_removal" plist:",omitempty"`
ConsentText map[string]string `json:"consent_text" plist:",omitempty"`
}
type CertificatePayload struct {
Payload
PayloadContent []byte
PayloadCertificateFileName string `plist:",omitempty"`
Password string `plist:",omitempty"`
AllowAllAppsAccess bool `plist:",omitempty"`
}
// NewProfile creates a new configuration profile
func NewProfile() *Profile {
payloadUUID := uuid.NewV4()
return &Profile{
PayloadVersion: 1,
PayloadType: "Configuration",
PayloadUUID: payloadUUID.String(),
}
}
// NewPayload creates a new payload
func NewPayload(payloadType string) *Payload {
payloadUUID := uuid.NewV4()
return &Payload{
PayloadVersion: 1,
PayloadType: payloadType,
PayloadUUID: payloadUUID.String(),
}
}
func NewCertificateProfile(certPEM []byte) *Profile {
profile := NewProfile()
profile.PayloadDescription = "Awesome Payload"
profile.PayloadDisplayName = "Awesome Certificate"
profile.PayloadIdentifier = "com.awesomeness.certificate"
profile.PayloadScope = "System"
profile.PayloadOrganization = "Awesomeness, Inc."
payload := NewPayload("com.apple.security.pem")
payload.PayloadDescription = "Awesome Certificate"
payload.PayloadDisplayName = "Awesome Certificate"
payload.PayloadOrganization = "Awesomeness, Inc."
payload.PayloadIdentifier = profile.PayloadIdentifier + "." + payload.PayloadUUID
certificatePayload := CertificatePayload{
Payload: *payload,
PayloadContent: certPEM,
}
profile.PayloadContent = []interface{}{certificatePayload}
return profile
}
func generateSelfSignedCertificate(keyFileName, certFileName string) {
// Generate a self-signed certificate (adapted from https://golang.org/src/crypto/tls/generate_cert.go)
key, err := rsa.GenerateKey(rand.Reader, 4096)
if err != nil {
logrus.WithError(err).Fatal("generate key")
}
keyFile, err := os.Create(keyFileName)
if err != nil {
logrus.WithError(err).Fatal("create key file")
}
if err = pem.Encode(keyFile, &pem.Block{
Type: "RSA PRIVATE KEY",
Bytes: x509.MarshalPKCS1PrivateKey(key),
}); err != nil {
logrus.WithError(err).Fatal("marshal private key")
}
keyFile.Close()
template := x509.Certificate{
SerialNumber: big.NewInt(42),
Subject: pkix.Name{
Country: []string{"US"},
Organization: []string{"Awesomeness, Inc."},
OrganizationalUnit: []string{"Awesomeness Dept."},
CommonName: "Awesomeness 4, Inc.",
},
NotBefore: time.Now(),
NotAfter: time.Now().AddDate(10, 0, 0),
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
IsCA: true,
BasicConstraintsValid: true,
}
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
if err != nil {
logrus.WithError(err).Fatal("failed to create certificate")
}
certFile, err := os.Create(certFileName)
if err != nil {
logrus.WithError(err).Fatal("create cert file")
}
if err = pem.Encode(certFile, &pem.Block{
Type: "CERTIFICATE",
Bytes: derBytes,
}); err != nil {
logrus.WithError(err).Fatal("encode certificate")
}
certFile.Close()
}
func main() {
keyFileName := "key.pem"
certFileName := "cert.pem"
profileFileName := "certificate.mobileconfig"
generateSelfSignedCertificate(keyFileName, certFileName)
certPEM, err := ioutil.ReadFile(certFileName)
if err != nil {
logrus.WithError(err).Fatal("read certificate file")
}
certificateProfile := NewCertificateProfile(certPEM)
mobileconfig, err := plist.MarshalIndent(certificateProfile, plist.XMLFormat, "\t")
if err != nil {
logrus.WithError(err).Fatal("marshal plist")
}
if err := ioutil.WriteFile(profileFileName, mobileconfig, 0755); err != nil {
logrus.WithError(err).Fatal("write mobileconfig to file")
}
args := []string{"install", "-path", profileFileName}
output, err := exec.Command("/usr/bin/profiles", args...).CombinedOutput()
if err != nil {
logrus.Fatalf("%s: %v - %s", "/usr/bin/profiles"+strings.Join(args, " "), err, output)
}
}
在 运行 sudo -E go run add_certificate.go 之后，具有通用名称 Awesomeness 4, Inc. 的证书在我的钥匙串中显示为受信任的证书：
我正在尝试使用以下 Go 脚本将自签名证书添加到 MacOS 设备上的系统钥匙串：
package main
import (
"crypto/rand"
"crypto/rsa"
"crypto/x509"
"crypto/x509/pkix"
"encoding/pem"
"math/big"
"os"
"os/exec"
"time"
"github.com/sirupsen/logrus"
)
func main() {
keyFileName := "key.pem"
certFileName := "cert.pem"
// Generate a self-signed certificate (adapted from https://golang.org/src/crypto/tls/generate_cert.go)
key, err := rsa.GenerateKey(rand.Reader, 4096)
if err != nil {
logrus.WithError(err).Fatal("generate key")
}
keyFile, err := os.Create(keyFileName)
if err != nil {
logrus.WithError(err).Fatal("create key file")
}
if err = pem.Encode(keyFile, &pem.Block{
Type: "RSA PRIVATE KEY",
Bytes: x509.MarshalPKCS1PrivateKey(key),
}); err != nil {
logrus.WithError(err).Fatal("marshal private key")
}
keyFile.Close()
template := x509.Certificate{
SerialNumber: big.NewInt(42),
Subject: pkix.Name{
Country: []string{"US"},
Organization: []string{"Awesomeness, Inc."},
OrganizationalUnit: []string{"Awesomeness Dept."},
CommonName: "Awesomeness, Inc.",
},
NotBefore: time.Now(),
NotAfter: time.Now().AddDate(10, 0, 0),
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
IsCA: true,
BasicConstraintsValid: true,
}
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
if err != nil {
logrus.WithError(err).Fatal("failed to create certificate")
}
certFile, err := os.Create(certFileName)
if err != nil {
logrus.WithError(err).Fatal("create cert file")
}
if err = pem.Encode(certFile, &pem.Block{
Type: "CERTIFICATE",
Bytes: derBytes,
}); err != nil {
logrus.WithError(err).Fatal("encode certificate")
}
certFile.Close()
/*
add-trusted-cert [-d] [-r resultType] [-p policy] [-a appPath] [-s policyString] [-e allowedError] [-u
keyUsage] [-k keychain] [-i settingsFileIn] [-o settingsFileOut] certFile
Add certificate (in DER or PEM format) from certFile to per-user or local Admin Trust Settings. When
modifying per-user Trust Settings, user authentication is required via an authentication dialog. When
modifying admin Trust Settings, the process must be running as root, or admin authentication is
required.
Options:
-d Add to admin cert store; default is user.
-r resultType resultType = trustRoot|trustAsRoot|deny|unspecified; default is trustRoot.
-p policy Specify policy constraint (ssl, smime, codeSign, IPSec, basic, swUpdate, pkgSign,
eap, macappstore, appleID, timestamping).
-a appPath Specify application constraint.
-s policyString
Specify policy-specific string.
-e allowedError
Specify allowed error (an integer value, or one of: certExpired, hostnameMismatch)
-u keyUsage Specify key usage, an integer.
-k keychain Specify keychain to which cert is added.
-i settingsFileIn
Input trust settings file; default is user domain.
-o settingsFileOut
Output trust settings file; default is user domain.
Key usage codes:
-1 - Any
1 - Sign
2 - Encrypt/Decrypt Data
4 - Encrypt/Decrypt Key
8 - Sign certificate
16 - Sign revocation
32 - Key exchange
To specify more than one usage, add values together (except -1 - Any).
*/
args := []string{"add-trusted-cert", "-k", "/Library/Keychains/System.keychain", "-r", "trustAsRoot", certFileName}
output, err := exec.Command("/usr/bin/security", args...).CombinedOutput()
if err != nil {
logrus.Fatalf("add-trusted-cert: %v - %s", err, output)
}
}
但是，当我 运行 使用 sudo 这个脚本时，我得到一个相当不明确的 "One or more parameters passed to a function were not valid." 错误：
> sudo go run add_to_keychain_trusted.go
Password:
FATA[0002] add-trusted-cert: exit status 1 - SecTrustSettingsSetTrustSettings: One or more parameters passed to a function were not valid.
exit status 1
我注意到的一件事是，如果我使用 -r trustRoot 选项而不是 -r trustAsRoot，该命令会起作用。也许 -r trustAsRoot 选项不再受支持（尽管它在 man security 页面中有记录）？
在 https://www.jamf.com/jamf-nation/discussions/13812/problems-importing-cert-via-terminal 之后，我通过编写一个包含证书的配置文件并使用 profiles 命令行工具而不是直接使用 security 来安装它来解决这个问题。这是改编后的脚本：
package main
import (
"crypto/rand"
"crypto/rsa"
"crypto/x509"
"crypto/x509/pkix"
"encoding/pem"
"io/ioutil"
"math/big"
"os"
"os/exec"
"strings"
"time"
uuid "github.com/satori/go.uuid"
"github.com/sirupsen/logrus"
"howett.net/plist"
)
// Payload represents a configuration profile's payload. (Adapted from https://github.com/micromdm/micromdm/blob/master/mdm/enroll/profile.go).
type Payload struct {
PayloadType string `json:"type"`
PayloadVersion int `json:"version"`
PayloadIdentifier string `json:"identifier"`
PayloadUUID string `json:"uuid"`
PayloadDisplayName string `json:"displayname" plist:",omitempty"`
PayloadDescription string `json:"description,omitempty" plist:",omitempty"`
PayloadOrganization string `json:"organization,omitempty" plist:",omitempty"`
PayloadScope string `json:"scope" plist:",omitempty"`
PayloadContent interface{} `json:"content,omitempty" plist:"PayloadContent,omitempty"`
}
// Profile represents a configuration profile (cf. https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf)
type Profile struct {
PayloadContent []interface{} `json:"content,omitempty"`
PayloadDescription string `json:"description,omitempty" plist:",omitempty"`
PayloadDisplayName string `json:"displayname,omitempty" plist:",omitempty"`
PayloadExpirationDate *time.Time `json:"expiration_date,omitempty" plist:",omitempty"`
PayloadIdentifier string `json:"identifier"`
PayloadOrganization string `json:"organization,omitempty" plist:",omitempty"`
PayloadUUID string `json:"uuid"`
PayloadRemovalDisallowed bool `json:"removal_disallowed" plist:",omitempty"`
PayloadType string `json:"type"`
PayloadVersion int `json:"version"`
PayloadScope string `json:"scope" plist:",omitempty"`
RemovalDate *time.Time `json:"removal_date" plist:"-" plist:",omitempty"`
DurationUntilRemoval float32 `json:"duration_until_removal" plist:",omitempty"`
ConsentText map[string]string `json:"consent_text" plist:",omitempty"`
}
type CertificatePayload struct {
Payload
PayloadContent []byte
PayloadCertificateFileName string `plist:",omitempty"`
Password string `plist:",omitempty"`
AllowAllAppsAccess bool `plist:",omitempty"`
}
// NewProfile creates a new configuration profile
func NewProfile() *Profile {
payloadUUID := uuid.NewV4()
return &Profile{
PayloadVersion: 1,
PayloadType: "Configuration",
PayloadUUID: payloadUUID.String(),
}
}
// NewPayload creates a new payload
func NewPayload(payloadType string) *Payload {
payloadUUID := uuid.NewV4()
return &Payload{
PayloadVersion: 1,
PayloadType: payloadType,
PayloadUUID: payloadUUID.String(),
}
}
func NewCertificateProfile(certPEM []byte) *Profile {
profile := NewProfile()
profile.PayloadDescription = "Awesome Payload"
profile.PayloadDisplayName = "Awesome Certificate"
profile.PayloadIdentifier = "com.awesomeness.certificate"
profile.PayloadScope = "System"
profile.PayloadOrganization = "Awesomeness, Inc."
payload := NewPayload("com.apple.security.pem")
payload.PayloadDescription = "Awesome Certificate"
payload.PayloadDisplayName = "Awesome Certificate"
payload.PayloadOrganization = "Awesomeness, Inc."
payload.PayloadIdentifier = profile.PayloadIdentifier + "." + payload.PayloadUUID
certificatePayload := CertificatePayload{
Payload: *payload,
PayloadContent: certPEM,
}
profile.PayloadContent = []interface{}{certificatePayload}
return profile
}
func generateSelfSignedCertificate(keyFileName, certFileName string) {
// Generate a self-signed certificate (adapted from https://golang.org/src/crypto/tls/generate_cert.go)
key, err := rsa.GenerateKey(rand.Reader, 4096)
if err != nil {
logrus.WithError(err).Fatal("generate key")
}
keyFile, err := os.Create(keyFileName)
if err != nil {
logrus.WithError(err).Fatal("create key file")
}
if err = pem.Encode(keyFile, &pem.Block{
Type: "RSA PRIVATE KEY",
Bytes: x509.MarshalPKCS1PrivateKey(key),
}); err != nil {
logrus.WithError(err).Fatal("marshal private key")
}
keyFile.Close()
template := x509.Certificate{
SerialNumber: big.NewInt(42),
Subject: pkix.Name{
Country: []string{"US"},
Organization: []string{"Awesomeness, Inc."},
OrganizationalUnit: []string{"Awesomeness Dept."},
CommonName: "Awesomeness 4, Inc.",
},
NotBefore: time.Now(),
NotAfter: time.Now().AddDate(10, 0, 0),
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
IsCA: true,
BasicConstraintsValid: true,
}
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
if err != nil {
logrus.WithError(err).Fatal("failed to create certificate")
}
certFile, err := os.Create(certFileName)
if err != nil {
logrus.WithError(err).Fatal("create cert file")
}
if err = pem.Encode(certFile, &pem.Block{
Type: "CERTIFICATE",
Bytes: derBytes,
}); err != nil {
logrus.WithError(err).Fatal("encode certificate")
}
certFile.Close()
}
func main() {
keyFileName := "key.pem"
certFileName := "cert.pem"
profileFileName := "certificate.mobileconfig"
generateSelfSignedCertificate(keyFileName, certFileName)
certPEM, err := ioutil.ReadFile(certFileName)
if err != nil {
logrus.WithError(err).Fatal("read certificate file")
}
certificateProfile := NewCertificateProfile(certPEM)
mobileconfig, err := plist.MarshalIndent(certificateProfile, plist.XMLFormat, "\t")
if err != nil {
logrus.WithError(err).Fatal("marshal plist")
}
if err := ioutil.WriteFile(profileFileName, mobileconfig, 0755); err != nil {
logrus.WithError(err).Fatal("write mobileconfig to file")
}
args := []string{"install", "-path", profileFileName}
output, err := exec.Command("/usr/bin/profiles", args...).CombinedOutput()
if err != nil {
logrus.Fatalf("%s: %v - %s", "/usr/bin/profiles"+strings.Join(args, " "), err, output)
}
}
在 运行 sudo -E go run add_certificate.go 之后，具有通用名称 Awesomeness 4, Inc. 的证书在我的钥匙串中显示为受信任的证书：