qnetd-certutil: Allow custom cert nicknames

Add the `-C` and `-S` options to support changing the default
NSS database nicknames for the QNetd CA and the QNetd server
certificates.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
Reviewed-by: Fabio M. Di Nitto <fdinitto@redhat.com>

man/corosync-qnetd-certutil.8

@@ -31,11 +31,11 @@
 .\" * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 .\" * THE POSSIBILITY OF SUCH DAMAGE.
 .\" */
-.TH COROSYNC-QNETD-CERTUTIL 8 2026-07-01
+.TH COROSYNC-QNETD-CERTUTIL 8 2026-11-10
 .SH NAME
 corosync-qnetd-certutil - tool to generate qnetd TLS certificates
 .SH SYNOPSIS
-.B "corosync-qnetd-certutil [-i|-s] [-c certificate] [-G] [-g keysize] [-k keytype] [-n cluster_name] [-q paramset]"
+.B "corosync-qnetd-certutil [-i|-s] [-C ca_nickname] [-c certificate] [-G] [-g keysize] [-k keytype] [-n cluster_name] [-q paramset] [-S serv_nickname]"
 .SH DESCRIPTION
 .B corosync-qnetd-certutil
 is a frontend for the NSS certutil, it is used for generating the QNetd CA (Certificate Authority), 
@@ -48,13 +48,22 @@ when using the model 'net'.
 Initialize the QNetd NSS certificate database and generate the QNetd CA and server certificates.
 The default directory for the database is /etc/corosync/qnetd. This directory must be
 writeable by the current user. The QNetd CA certificate is also exported into the file
-/etc/corosync/qnetd/nssdb/qnetd-cacert.crt.
+/etc/corosync/qnetd/nssdb/qnetd-cacert.crt (or
+/etc/corosync/qnetd/nssdb/qnetd-cacert-\fIca_nickname\fR.crt if
+.B -C
+is used).
 .TP
 .B -s
 Sign the cluster certificate. It is necessary to pass the cluster name (as
 configured in corosync.conf) and the certificate request file - see options below.
 The signed certificate will be written to the 
-file /etc/corosync/qnetd/nssdb/cluster-$ClusterName.crt
+file /etc/corosync/qnetd/nssdb/cluster-\fIClusterName\fR.crt
+.TP
+.B -C
+NSS certificate database nickname of the new CA or the CA used to sign the
+certificate request. It also changes the name of the exported QNetd CA file
+and the Common Name (CN) of the certificate.
+If not specified, the default "QNet CA" is used.
 .TP
 .B -c
 Certificate request file to sign.
@@ -103,6 +112,9 @@ command. By default, this is left empty, meaning
 is not passed to
 .B certutil
 at all.
+.TP
+.B -S
+NSS certificate database nickname of the new QNetd Server certificate. If not specified, the default "QNetd Cert" is used.
 .SH NOTES
 If qnetd is executed by a non root user, /etc/corosync/qnetd and its subdirectories must be owned by (or have group access for) the given user. If
 .B corosync-qnetd-certutil

qdevices/corosync-qnetd-certutil.sh

@@ -40,7 +40,6 @@ DB_DIR="$CONFIG_DIR/nssdb"
 CRT_VALIDITY=1200
 CA_NICKNAME="QNet CA"
 SERVER_NICKNAME="QNetd Cert"
-CA_SUBJECT="CN=QNet CA"
 SERVER_SUBJECT="CN=Qnetd Server"
 PWD_FILE="$DB_DIR/pwdfile.txt"
 NOISE_FILE="$DB_DIR/noise.txt"
@@ -57,16 +56,18 @@ errx() {
 }
 
 usage() {
-    echo "$0: [-i|-s] [-c certificate] [-G] [-g keysize] [-k keytype] [-n cluster_name] [-q paramset]"
+    echo "$0: [-i|-s] [-C ca_nickname] [-c certificate] [-G] [-g keysize] [-k keytype] [-n cluster_name] [-q paramset] [-S serv_nickname]"
     echo
     echo " -i                  Initialize QNetd CA and generate server certificate"
     echo " -s                  Sign cluster certificate (needs cluster certificate)"
+    echo " -C ca_nickname      NSS database QNetd CA certificate nickname"
     echo " -c certificate      CRQ certificate file name"
     echo " -G                  Do not set group write bit for new files"
     echo " -g keysize          Key size in bits - passed directly to certutil as -g parameter"
     echo " -k keytype          Type of key - passed directly to certutil as -k parameter"
     echo " -n cluster_name     Name of cluster (for -s operation)"
     echo " -q paramset         Parameter set (curve name, ml-dsa set) - passed directly to certutil as -q parameter"
+    echo " -S serv_nickname    NSS database QNetd server certificate nickname"
 
     exit 0
 }
@@ -229,7 +230,7 @@ CERTIFICATE_FILE=""
 CLUSTER_NAME=""
 SET_GROUP_WRITE_BIT=true
 
-while getopts ":Ghisc:g:k:n:q:" opt; do
+while getopts ":GhisC:c:g:k:n:q:S:" opt; do
     case $opt in
         i)
             OPERATION=init_qnetd_ca
@@ -240,6 +241,10 @@ while getopts ":Ghisc:g:k:n:q:" opt; do
         h)
             usage
             ;;
+        C)
+            CA_NICKNAME="$OPTARG"
+            CA_EXPORT_FILE="$DB_DIR/qnetd-cacert-$CA_NICKNAME.crt"
+            ;;
         c)
             CERTIFICATE_FILE="$OPTARG"
             ;;
@@ -258,6 +263,9 @@ while getopts ":Ghisc:g:k:n:q:" opt; do
         q)
             COROSYNC_QNETD_CERTUTIL_PARAMSET="$OPTARG"
             ;;
+        S)
+            SERVER_NICKNAME="$OPTARG"
+            ;;
         \?)
             errx 1 "Invalid option: -$OPTARG"
             ;;
@@ -270,6 +278,7 @@ done
 [ "$OPERATION" == "" ] && usage
 
 CRT_FILE="$DB_DIR/cluster-$CLUSTER_NAME.crt"
+CA_SUBJECT="CN=$CA_NICKNAME"
 
 case "$OPERATION" in
     "init_qnetd_ca")