puppetlabs/jvm-certificate-authority — pull request #30 by camlow325 (2014-08-08 20:15:07+00:00)
Title: (PE-5344) Cert extension changes to support generation of Master, CA, and CRL certs

This PR adds support for the creation of a CRL number extension. It
includes a `crl-number` Clojure function which produces an extension map
which can be included as another extension in the extensions argument in
a call to `CertificateAuthority.signCertificate()`.

This PR also includes the following extensions changes:

* Modified the mapToBasicConstraints method to support not specifying a
value for `path_len_constraint` for a CA. This allows the constraint to not
define a limit for the number of intermediate certificates that may
follow the CA in the certification path.

* Separated the `basic-constraints` Clojure function into
`basic-constraints-for-non-ca` and `basic-constraints-for-ca`
functions. This accounts for the differences in possible parameters
for these two cases. The critical parameter only needs to be
specified for a non-CA because for a CA, it needs to be `true` per
RFC-5280. The `max-path-len` is only supported for a CA and even then
is optional.

* Modified the mapToAuthorityKeyIdentifier method to allow the CA serial
number and distinguished name (issuer) to be added to the generated
extension.

* Split the `authority-key-identifier` function into different arities
which would support specification of an issuer-dn, serial number,
public key, and critical flag for the legal supported combinations.