Add ability to specify basicConstraint in x509 cert

[marcusdots]

Pull Request (PR) description

This Pull Request (PR) fixes the following issues

[marcusdots]

@kenyon do you think the Readme addition
https://github.com/voxpupuli/puppet-openssl/pull/266/changes#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5R50-R59
addition is useful and understandable?

[kenyon]

Small formatting changes to the readme example, but otherwise looks good.

[kenyon]

The tests here are a bit suspicious since they don't seem to do anything directly with basicconstraint, keyusage, extkeyusage, etc.

[marcusdots]

Those unit tests can assure type properties in the catalog,
so let us have a look at the catalog:

$ cat 03correkt.pp
contain 'openssl'
openssl::certificate::x509 { 'hostcert':
  base_dir => '/tmp',
  group => '1000',
  commonname => "any.domain.is.suitable",
  basicconstraint => ['critical','CA:true', 'pathlen:1'],
  keyusage => ['keyCertSign','cRLSign']
}

$ rm /opt/puppetlabs/puppet/cache/client_data/catalog/my.domain.json; /opt/puppetlabs/bin/puppet apply 03correkt.pp --modulepath puppet-modules/  --catalog_cache_terminus=json; jq . /opt/puppetlabs/puppet/cache/client_data/catalog/my.domain.json

    135     {
    136       "type": "Openssl::Certificate::X509",
    137       "title": "hostcert",
    138       "tags": [
    139         "openssl::certificate::x509",
    140         "openssl",
    141         "certificate",
    142         "x509",
    143         "hostcert",
    144         "class"
    145       ],
    146       "file": "/working/dir/03correkt.pp",
    147       "line": 2,
    148       "exported": false,
    149       "kind": "defined_type",
    150       "parameters": {
    151         "base_dir": "/tmp",
    152         "group": "1000",
    153         "commonname": "any.domain.is.suitable",
    154         "basicconstraint": [
    155           "critical",
    156           "CA:true",
    157           "pathlen:1"
    158         ],
    159         "keyusage": [
    160           "keyCertSign",
    161           "cRLSign"
    162         ],
    163         "ensure": "present",
    164         "altnames": [],
    165         "extkeyusage": [],
    166         "days": 365,
    167         "cnf_dir": "/tmp",
    168         "crt_dir": "/tmp",
    169         "csr_dir": "/tmp",
    170         "key_dir": "/tmp",
    171         "cnf": "/tmp/hostcert.cnf",
    172         "crt": "/tmp/hostcert.crt",
    173         "csr": "/tmp/hostcert.csr",
    174         "key": "/tmp/hostcert.key",
    175         "key_size": 3072,
    176         "owner": "root",
    177         "key_owner": "root",
    178         "key_group": "1000",
    179         "key_mode": "0600",
    180         "force": true,
    181         "encrypted": true
    182       }

    277     {
    278       "type": "X509_cert",
    279       "title": "/tmp/hostcert.crt",
    280       "tags": [
    281         "x509_cert",
    282         "openssl::certificate::x509",
    283         "openssl",
    284         "certificate",
    285         "x509",
    286         "hostcert",
    287         "class"
    288       ],
    289       "file": "/working/dir/puppet-modules/openssl/manifests/certificate/x509.pp",
    290       "line": 192,
    291       "exported": false,
    292       "kind": "compilable_type",
    293       "parameters": {
    294         "ensure": "present",
    295         "template": "/tmp/hostcert.cnf",
    296         "private_key": "/tmp/hostcert.key",
    297         "csr": "/tmp/hostcert.csr",
    298         "days": 365,
    299         "req_ext": true,
    300         "force": true
    301       }

the relevant parts are not in "type": "X509_cert",, but instead "type": "Openssl::Certificate::X509",

[marcusdots]

Found a solution, here is an example

  context 'when passing keyusage, extension is enabled' do
    let(:params) do
      {
        country: 'com',
        organization: 'bar',
        commonname: 'foo.example.com',
        keyusage: ['digitalSignature'],
      }
    end

    it do
      is_expected.to contain_x509_cert('/etc/ssl/certs/foo.crt').with(
        ensure: 'present',
        template: '/etc/ssl/certs/foo.cnf',
        csr: '/etc/ssl/certs/foo.csr',
        req_ext: true,
      )
    end
    it do
        is_expected.to contain_openssl__certificate__x509('foo').with(
          'keyusage' => %w[digitalSignature]
        )
    end
  end