qdevice-net: Add key type and paramset options

This patch adds the -k and -q options, which specify the
key type and paramset (curve-name, ml-dsa-parameter-set)
to use when generating new public and private key pairs.
These options are passed directly to certutil.

The COROSYNC_QDEVICE_NET_CERTUTIL_KEY_TYPE and
COROSYNC_QDEVICE_NET_CERTUTIL_PARAMSET
variables are added to the sysconfig file
(/etc/sysconfig/corosync-qdevice), which are equivalent to the -k
and -q options.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>

init/corosync-qdevice.sysconfig.example

@@ -9,3 +9,12 @@ COROSYNC_QDEVICE_OPTIONS=""
 # COROSYNC_QDEVICE_NET_CERTUTIL_KEY_SIZE specifies the key size to use when generating
 # new public and private key pairs. This is equivalent to the -g option.
 #COROSYNC_QDEVICE_NET_CERTUTIL_KEY_SIZE=""
+
+# COROSYNC_QDEVICE_NET_CERTUTIL_KEY_TYPE specifies the key type to use when generating
+# new public and private key pairs. This is equivalent to the -k option.
+#COROSYNC_QDEVICE_NET_CERTUTIL_KEY_TYPE=""
+
+# COROSYNC_QDEVICE_NET_CERTUTIL_PARAMSET specifies the curve-name or ml-dsa-parameter-set
+# to use when generating new public and private key pairs.
+# This is equivalent to the -q option.
+#COROSYNC_QDEVICE_NET_CERTUTIL_PARAMSET=""

man/corosync-qdevice-net-certutil.8

@@ -31,11 +31,11 @@
 .\" * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 .\" * THE POSSIBILITY OF SUCH DAMAGE.
 .\" */
-.TH COROSYNC-QDEVICE-NET-CERTUTIL 8 2026-06-11
+.TH COROSYNC-QDEVICE-NET-CERTUTIL 8 2026-08-13
 .SH NAME
 corosync-qdevice-net-certutil - tool to generate qdevice model net TLS certificates
 .SH SYNOPSIS
-.B "corosync-qdevice-net-certutil [-i|-M|-m|-Q|-r] [-C scp_command] [-c certificate] [-g keysize] [-n cluster_name] [-S ssh_command]"
+.B "corosync-qdevice-net-certutil [-i|-M|-m|-Q|-r] [-C scp_command] [-c certificate] [-g keysize] [-k keytype] [-n cluster_name] [-S ssh_command] [-q paramset]"
 .SH DESCRIPTION
 .B corosync-qdevice-net-certutil
 is a frontend for NSS certutil used for generating client certificate for the net model of
@@ -88,11 +88,31 @@ is not passed to
 .B certutil
 at all.
 .TP
+.B -k
+Specify the key type to use when generating new public and private key pairs.
+This option is passed directly to the
+.B certutil
+command. By default, this is left empty, meaning
+.B -k
+is not passed to
+.B certutil
+at all.
+.TP
 .B -n
 Name of the cluster.
 .TP
 .B -S
 Alternative remote shell command to be use in place of ssh. If not specified, ssh is used.
+.TP
+.B -q
+Specify the curve-name or ml-dsa-parameter-set to use when generating new public
+and private key pairs. This option is passed directly to the
+.B certutil
+command. By default, this is left empty, meaning
+.B -q
+is not passed to
+.B certutil
+at all.
 .SH SEE ALSO
 .BR corosync-qnetd (8)
 .BR corosync-qdevice (8)

qdevices/corosync-qdevice-net-certutil.sh

@@ -61,7 +61,7 @@ errx() {
 }
 
 usage() {
-    echo "$0: [-i|-M|-m|-Q|-r] [-C scp_command] [-c certificate] [-g keysize] [-n cluster_name] [-S ssh_command]"
+    echo "$0: [-i|-M|-m|-Q|-r] [-C scp_command] [-c certificate] [-g keysize] [-k keytype] [-n cluster_name] [-S ssh_command] [-q paramset]"
     echo
     echo " -i      Initialize node CA. Needs CA certificate from server"
     echo " -M      Import signed cluster certificate and export certificate with key to pk12 file"
@@ -72,8 +72,10 @@ usage() {
     echo " -C scp_command      Alternative remote copy command to be use in place of scp. If not specified, scp is used."
     echo " -c certificate      Ether CA, CRQ, CRT or pk12 certificate (operation dependant)"
     echo " -g keysize          Key size in bits - passed directly to certutil as -g parameter"
+    echo " -k keytype          Type of key - passed directly to certutil as -k parameter"
     echo " -n cluster_name     Name of cluster (for -r and -s operations)"
     echo " -S ssh_command      Alternative remote shell command to be use in place of ssh. If not specified, ssh is used."
+    echo " -q paramset         Parameter set (curve name, ml-dsa set) - passed directly to certutil as -q parameter"
     echo ""
     echo "Typical usage:"
     echo "- Initialize database on QNetd server by running $QNETD_CERTUTIL_CMD -i"
@@ -102,6 +104,14 @@ get_certutil_key_params() {
         CERTUTIL_PARAMS="$CERTUTIL_PARAMS -g $COROSYNC_QDEVICE_NET_CERTUTIL_KEY_SIZE"
     fi
 
+    if [ ! -z "$COROSYNC_QDEVICE_NET_CERTUTIL_KEY_TYPE" ];then
+        CERTUTIL_PARAMS="$CERTUTIL_PARAMS -k $COROSYNC_QDEVICE_NET_CERTUTIL_KEY_TYPE"
+    fi
+
+    if [ ! -z "$COROSYNC_QDEVICE_NET_CERTUTIL_PARAMSET" ];then
+        CERTUTIL_PARAMS="$CERTUTIL_PARAMS -q $COROSYNC_QDEVICE_NET_CERTUTIL_PARAMSET"
+    fi
+
     echo "$CERTUTIL_PARAMS"
 }
 
@@ -272,6 +282,8 @@ quick_start() {
 
 # Initialize options that may be overwritten by the configuration file
 COROSYNC_QDEVICE_NET_CERTUTIL_KEY_SIZE=""
+COROSYNC_QDEVICE_NET_CERTUTIL_KEY_TYPE=""
+COROSYNC_QDEVICE_NET_CERTUTIL_PARAMSET=""
 
 # Import configuration file if it exists
 if [ -f "@INITCONFIGDIR@/corosync-qdevice" ];then
@@ -286,7 +298,7 @@ OPERATION=""
 CERTIFICATE_FILE=""
 CLUSTER_NAME=""
 
-while getopts ":hiMmQrC:c:g:n:S:" opt; do
+while getopts ":hiMmQrC:c:g:k:n:S:q:" opt; do
     case $opt in
         i)
             OPERATION=init_node_ca
@@ -315,12 +327,18 @@ while getopts ":hiMmQrC:c:g:n:S:" opt; do
         g)
             COROSYNC_QDEVICE_NET_CERTUTIL_KEY_SIZE="$OPTARG"
             ;;
+        k)
+            COROSYNC_QDEVICE_NET_CERTUTIL_KEY_TYPE="$OPTARG"
+            ;;
         n)
             CLUSTER_NAME="$OPTARG"
             ;;
         S)
             REMOTE_SHELL_EXECUTABLE="$OPTARG"
             ;;
+        q)
+            COROSYNC_QDEVICE_NET_CERTUTIL_PARAMSET="$OPTARG"
+            ;;
         \?)
             errx 1 "Invalid option: -$OPTARG"
             ;;