mirror of
https://github.com/gregtwallace/apc-p15-tool.git
synced 2025-01-22 08:14:08 +00:00
105 lines
3.8 KiB
Markdown
105 lines
3.8 KiB
Markdown
# APC P15 Tool
|
|
A tool to create APC p15 formatted certificates from pem files, without
|
|
having to use APC's closed-source tool, APC generated keys, or other
|
|
proprietary tools (such as cryptlib).
|
|
|
|
## Compatibility Notice
|
|
|
|
This tool's create functionality is modeled from the APC NMCSecurityWizardCLI
|
|
aka `NMC Security Wizard CLI Utility`. The files it generates should be
|
|
comaptible with any UPS that accepts p15 files from that tool. Only RSA 1,024
|
|
and 2,048 bit keys are accepted. 1,024 bit RSA is no longer considered
|
|
completely secure; avoid keys of this size if possible. Most (all?) public
|
|
ACME services won't accept keys of this size anyway.
|
|
|
|
The install functionality is a custom creation of mine so it may or may not
|
|
work depending on your exact setup. My setup (and therefore the testing
|
|
setup) is:
|
|
- APC Smart-UPS 1500VA RM 2U SUA1500RM2U (Firmware Revision 667.18.D)
|
|
- AP9631 NMC2 Hardware Revision 05 running AOS v7.0.4 and Boot Monitor
|
|
v1.0.9.
|
|
|
|
If you have problems you can post the log in an issue and I can try to fix it
|
|
but it may be difficult without your particular hardware to test with.
|
|
|
|
In particular, if you are experiencing `ssh: handshake failed:` please run
|
|
`ssh -vv myups.example.com` and include the `peer server KEXINIT proposal`
|
|
in your issue. For example:
|
|
|
|
```
|
|
debug2: peer server KEXINIT proposal
|
|
debug2: KEX algorithms: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,ecdh-sha2-nistp256
|
|
debug2: host key algorithms: ssh-rsa
|
|
debug2: ciphers ctos: aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc
|
|
debug2: ciphers stoc: aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc
|
|
debug2: MACs ctos: hmac-sha2-256,hmac-sha1
|
|
debug2: MACs stoc: hmac-sha2-256,hmac-sha1
|
|
debug2: compression ctos: none
|
|
debug2: compression stoc: none
|
|
debug2: languages ctos:
|
|
debug2: languages stoc:
|
|
```
|
|
|
|
## Usage
|
|
|
|
Currently the tool contains two commands: create and install. The tool
|
|
can be run with the --help flag to see options.
|
|
|
|
i.e. `./apc-p15-tool --help`
|
|
|
|
Help can also be run on a subcommand to see the options for that
|
|
subcommand.
|
|
|
|
e.g. `./apc-p15-tool install --help`
|
|
|
|
### Create
|
|
|
|
Create creates an apc p15 file from given key and cert pem files or
|
|
content.
|
|
|
|
e.g. `./apc-p15-tool create --keyfile ./apckey.pem --certfile ./apccert.pem`
|
|
|
|
The command outputs ./apctool.p15 by default. This file can be
|
|
directly loaded on to an APC NMC2 (Network Management Card 2).
|
|
|
|
### Install
|
|
|
|
Install works similarly to create except it doesn't save the p15 file
|
|
to disk. It instead uploads the p15 file directly to the specified
|
|
remote host, via scp.
|
|
|
|
e.g. `./apc-p15-tool install --keyfile ./apckey.pem --certfile ./apccert.pem --apchost myapc.example.com:22 --username apc --password someSecret --fingerprint 123abc`
|
|
|
|
## Note About Install Automation
|
|
|
|
The application supports passing all args instead as environment
|
|
variables by prefixing the flag name with `APC_P15_TOOL`.
|
|
|
|
e.g. `APC_P15_TOOL_KEYPEM`
|
|
|
|
Additionally, there is a second binary built with just the install
|
|
command so the subcommand is not needed.
|
|
|
|
There are mutually exclusive flags that allow specifying the pem
|
|
as either filenames or directly as strings. The strings are useful
|
|
for passing the pem content from another application without having
|
|
to save the pem files to disk.
|
|
|
|
Putting all of this together, you can combine the install binary with
|
|
a tool like LeGo CertHub (https://www.legocerthub.com/) to call the
|
|
install binary, with environment variables, to directly upload new
|
|
certificates as they're issued by LeGo, without having to write a
|
|
separate script.
|
|
|
|
|
|
|
|
## Thanks
|
|
|
|
Special thanks to the following people and resources which helped me
|
|
deduce how all of this works:
|
|
|
|
https://github.com/dnlmengs/pemtrans
|
|
|
|
https://github.com/freddy36/apc_tools
|
|
|
|
http://lapo.it/asn1js/
|