Question

我正在尝试使用以下Go脚本将自签名证书添加到MacOS设备上的系统钥匙串：

package main

import (
    "crypto/rand"
    "crypto/rsa"
    "crypto/x509"
    "crypto/x509/pkix"
    "encoding/pem"
    "math/big"
    "os"
    "os/exec"
    "time"

    "github.com/sirupsen/logrus"
)

func main() {
    keyFileName := "key.pem"
    certFileName := "cert.pem"

    // Generate a self-signed certificate (adapted from https://golang.org/src/crypto/tls/generate_cert.go)
    key, err := rsa.GenerateKey(rand.Reader, 4096)
    if err != nil {
        logrus.WithError(err).Fatal("generate key")
    }

    keyFile, err := os.Create(keyFileName)
    if err != nil {
        logrus.WithError(err).Fatal("create key file")
    }
    if err = pem.Encode(keyFile, &pem.Block{
        Type:  "RSA PRIVATE KEY",
        Bytes: x509.MarshalPKCS1PrivateKey(key),
    }); err != nil {
        logrus.WithError(err).Fatal("marshal private key")
    }
    keyFile.Close()

    template := x509.Certificate{
        SerialNumber: big.NewInt(42),
        Subject: pkix.Name{
            Country:            []string{"US"},
            Organization:       []string{"Awesomeness, Inc."},
            OrganizationalUnit: []string{"Awesomeness Dept."},
            CommonName:         "Awesomeness, Inc.",
        },
        NotBefore:             time.Now(),
        NotAfter:              time.Now().AddDate(10, 0, 0),
        KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
        ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
        IsCA:                  true,
        BasicConstraintsValid: true,
    }

    derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
    if err != nil {
        logrus.WithError(err).Fatal("failed to create certificate")
    }

    certFile, err := os.Create(certFileName)
    if err != nil {
        logrus.WithError(err).Fatal("create cert file")
    }
    if err = pem.Encode(certFile, &pem.Block{
        Type:  "CERTIFICATE",
        Bytes: derBytes,
    }); err != nil {
        logrus.WithError(err).Fatal("encode certificate")
    }
    certFile.Close()

    /*
        add-trusted-cert [-d] [-r resultType] [-p policy] [-a appPath] [-s policyString] [-e allowedError] [-u
        keyUsage] [-k keychain] [-i settingsFileIn] [-o settingsFileOut] certFile
            Add certificate (in DER or PEM format) from certFile to per-user or local Admin Trust Settings. When
            modifying per-user Trust Settings, user authentication is required via an authentication dialog. When
            modifying admin Trust Settings, the process must be running as root, or admin authentication is
            required.

            Options:
            -d              Add to admin cert store; default is user.
            -r resultType   resultType = trustRoot|trustAsRoot|deny|unspecified; default is trustRoot.
            -p policy       Specify policy constraint (ssl, smime, codeSign, IPSec, basic, swUpdate, pkgSign,
                            eap, macappstore, appleID, timestamping).
            -a appPath      Specify application constraint.
            -s policyString
                            Specify policy-specific string.
            -e allowedError
                            Specify allowed error (an integer value, or one of: certExpired, hostnameMismatch)
            -u keyUsage     Specify key usage, an integer.
            -k keychain     Specify keychain to which cert is added.
            -i settingsFileIn
                            Input trust settings file; default is user domain.
            -o settingsFileOut
                            Output trust settings file; default is user domain.

            Key usage codes:
                            -1 - Any
                            1 - Sign
                            2 - Encrypt/Decrypt Data
                            4 - Encrypt/Decrypt Key
                            8 - Sign certificate
                            16 - Sign revocation
                            32 - Key exchange
                            To specify more than one usage, add values together (except -1 - Any).
    */

    args := []string{"add-trusted-cert", "-k", "/Library/Keychains/System.keychain", "-r", "trustAsRoot", certFileName}

    output, err := exec.Command("/usr/bin/security", args...).CombinedOutput()
    if err != nil {
        logrus.Fatalf("add-trusted-cert: %v - %s", err, output)
    }
}

但是，当我使用sudo运行此脚本时，得到了一个非常不确定的“传递给函数的一个或多个参数无效”。错误：

> sudo go run add_to_keychain_trusted.go
Password:
FATA[0002] add-trusted-cert: exit status 1 - SecTrustSettingsSetTrustSettings: One or more parameters passed to a function were not valid. 
exit status 1

我注意到的一件事是，如果我使用-r trustRoot选项而不是-r trustAsRoot，则该命令有效。也许不再支持-r trustAsRoot选项（尽管它在man security页中有记录）？

Answer 1

在https://www.jamf.com/jamf-nation/discussions/13812/problems-importing-cert-via-terminal之后，我通过组成包含证书的配置配置文件并使用profiles命令行工具而不是直接使用security安装该配置文件来解决此问题。这是改编的脚本：

package main

import (
    "crypto/rand"
    "crypto/rsa"
    "crypto/x509"
    "crypto/x509/pkix"
    "encoding/pem"
    "io/ioutil"
    "math/big"
    "os"
    "os/exec"
    "strings"
    "time"

    uuid "github.com/satori/go.uuid"
    "github.com/sirupsen/logrus"
    "howett.net/plist"
)

// Payload represents a configuration profile's payload. (Adapted from https://github.com/micromdm/micromdm/blob/master/mdm/enroll/profile.go).
type Payload struct {
    PayloadType         string      `json:"type"`
    PayloadVersion      int         `json:"version"`
    PayloadIdentifier   string      `json:"identifier"`
    PayloadUUID         string      `json:"uuid"`
    PayloadDisplayName  string      `json:"displayname" plist:",omitempty"`
    PayloadDescription  string      `json:"description,omitempty" plist:",omitempty"`
    PayloadOrganization string      `json:"organization,omitempty" plist:",omitempty"`
    PayloadScope        string      `json:"scope" plist:",omitempty"`
    PayloadContent      interface{} `json:"content,omitempty" plist:"PayloadContent,omitempty"`
}

// Profile represents a configuration profile (cf. https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf)
type Profile struct {
    PayloadContent           []interface{}     `json:"content,omitempty"`
    PayloadDescription       string            `json:"description,omitempty" plist:",omitempty"`
    PayloadDisplayName       string            `json:"displayname,omitempty" plist:",omitempty"`
    PayloadExpirationDate    *time.Time        `json:"expiration_date,omitempty" plist:",omitempty"`
    PayloadIdentifier        string            `json:"identifier"`
    PayloadOrganization      string            `json:"organization,omitempty" plist:",omitempty"`
    PayloadUUID              string            `json:"uuid"`
    PayloadRemovalDisallowed bool              `json:"removal_disallowed" plist:",omitempty"`
    PayloadType              string            `json:"type"`
    PayloadVersion           int               `json:"version"`
    PayloadScope             string            `json:"scope" plist:",omitempty"`
    RemovalDate              *time.Time        `json:"removal_date" plist:"-" plist:",omitempty"`
    DurationUntilRemoval     float32           `json:"duration_until_removal" plist:",omitempty"`
    ConsentText              map[string]string `json:"consent_text" plist:",omitempty"`
}

type CertificatePayload struct {
    Payload
    PayloadContent             []byte
    PayloadCertificateFileName string `plist:",omitempty"`
    Password                   string `plist:",omitempty"`
    AllowAllAppsAccess         bool   `plist:",omitempty"`
}

// NewProfile creates a new configuration profile
func NewProfile() *Profile {
    payloadUUID := uuid.NewV4()

    return &Profile{
        PayloadVersion: 1,
        PayloadType:    "Configuration",
        PayloadUUID:    payloadUUID.String(),
    }
}

// NewPayload creates a new payload
func NewPayload(payloadType string) *Payload {
    payloadUUID := uuid.NewV4()

    return &Payload{
        PayloadVersion: 1,
        PayloadType:    payloadType,
        PayloadUUID:    payloadUUID.String(),
    }
}

func NewCertificateProfile(certPEM []byte) *Profile {
    profile := NewProfile()
    profile.PayloadDescription = "Awesome Payload"
    profile.PayloadDisplayName = "Awesome Certificate"
    profile.PayloadIdentifier = "com.awesomeness.certificate"
    profile.PayloadScope = "System"
    profile.PayloadOrganization = "Awesomeness, Inc."

    payload := NewPayload("com.apple.security.pem")
    payload.PayloadDescription = "Awesome Certificate"
    payload.PayloadDisplayName = "Awesome Certificate"
    payload.PayloadOrganization = "Awesomeness, Inc."
    payload.PayloadIdentifier = profile.PayloadIdentifier + "." + payload.PayloadUUID

    certificatePayload := CertificatePayload{
        Payload:        *payload,
        PayloadContent: certPEM,
    }

    profile.PayloadContent = []interface{}{certificatePayload}

    return profile
}

func generateSelfSignedCertificate(keyFileName, certFileName string) {
    // Generate a self-signed certificate (adapted from https://golang.org/src/crypto/tls/generate_cert.go)
    key, err := rsa.GenerateKey(rand.Reader, 4096)
    if err != nil {
        logrus.WithError(err).Fatal("generate key")
    }

    keyFile, err := os.Create(keyFileName)
    if err != nil {
        logrus.WithError(err).Fatal("create key file")
    }
    if err = pem.Encode(keyFile, &pem.Block{
        Type:  "RSA PRIVATE KEY",
        Bytes: x509.MarshalPKCS1PrivateKey(key),
    }); err != nil {
        logrus.WithError(err).Fatal("marshal private key")
    }
    keyFile.Close()

    template := x509.Certificate{
        SerialNumber: big.NewInt(42),
        Subject: pkix.Name{
            Country:            []string{"US"},
            Organization:       []string{"Awesomeness, Inc."},
            OrganizationalUnit: []string{"Awesomeness Dept."},
            CommonName:         "Awesomeness 4, Inc.",
        },
        NotBefore:             time.Now(),
        NotAfter:              time.Now().AddDate(10, 0, 0),
        KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
        ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
        IsCA:                  true,
        BasicConstraintsValid: true,
    }

    derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
    if err != nil {
        logrus.WithError(err).Fatal("failed to create certificate")
    }

    certFile, err := os.Create(certFileName)
    if err != nil {
        logrus.WithError(err).Fatal("create cert file")
    }
    if err = pem.Encode(certFile, &pem.Block{
        Type:  "CERTIFICATE",
        Bytes: derBytes,
    }); err != nil {
        logrus.WithError(err).Fatal("encode certificate")
    }
    certFile.Close()
}

func main() {
    keyFileName := "key.pem"
    certFileName := "cert.pem"
    profileFileName := "certificate.mobileconfig"

    generateSelfSignedCertificate(keyFileName, certFileName)

    certPEM, err := ioutil.ReadFile(certFileName)
    if err != nil {
        logrus.WithError(err).Fatal("read certificate file")
    }

    certificateProfile := NewCertificateProfile(certPEM)

    mobileconfig, err := plist.MarshalIndent(certificateProfile, plist.XMLFormat, "\t")
    if err != nil {
        logrus.WithError(err).Fatal("marshal plist")
    }

    if err := ioutil.WriteFile(profileFileName, mobileconfig, 0755); err != nil {
        logrus.WithError(err).Fatal("write mobileconfig to file")
    }

    args := []string{"install", "-path", profileFileName}

    output, err := exec.Command("/usr/bin/profiles", args...).CombinedOutput()
    if err != nil {
        logrus.Fatalf("%s: %v - %s", "/usr/bin/profiles"+strings.Join(args, " "), err, output)
    }
}

使用sudo -E go run add_certificate.go运行此命令后，公用名Awesomeness 4, Inc.的证书在我的钥匙串中显示为受信任的证书：

将自签名证书作为受信任的根证书添加到Apple钥匙串

1 个答案: