qnetd-certutil: Add key type and paramset options

This patch adds the -k and -q options, which specify the
key type and paramset (curve-name, ml-dsa-parameter-set)
to use when generating new public and private key pairs.
These options are passed directly to certutil.

The COROSYNC_QNETD_CERTUTIL_KEY_TYPE and
COROSYNC_QNETD_CERTUTIL_PARAMSET
variables are added to the sysconfig file
(/etc/sysconfig/corosync-qnetd), which are equivalent to the -k
and -q options.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>

init/corosync-qnetd.sysconfig.example

@@ -16,3 +16,12 @@ COROSYNC_QNETD_RUNAS=""
 # COROSYNC_QNETD_CERTUTIL_KEY_SIZE specifies the key size to use when generating
 # new public and private key pairs. This is equivalent to the -g option.
 #COROSYNC_QNETD_CERTUTIL_KEY_SIZE=""
+
+# COROSYNC_QNETD_CERTUTIL_KEY_TYPE specifies the key type to use when generating
+# new public and private key pairs. This is equivalent to the -k option.
+#COROSYNC_QNETD_CERTUTIL_KEY_TYPE=""
+
+# COROSYNC_QNETD_CERTUTIL_PARAMSET specifies the curve-name or ml-dsa-parameter-set
+# to use when generating new public and private key pairs.
+# This is equivalent to the -q option.
+#COROSYNC_QNETD_CERTUTIL_PARAMSET=""

man/corosync-qnetd-certutil.8

@@ -31,11 +31,11 @@
 .\" * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 .\" * THE POSSIBILITY OF SUCH DAMAGE.
 .\" */
-.TH COROSYNC-QNETD-CERTUTIL 8 2026-03-31
+.TH COROSYNC-QNETD-CERTUTIL 8 2026-07-01
 .SH NAME
 corosync-qnetd-certutil - tool to generate qnetd TLS certificates
 .SH SYNOPSIS
-.B "corosync-qnetd-certutil [-i|-s] [-c certificate] [-G] [-g keysize] [-n cluster_name]"
+.B "corosync-qnetd-certutil [-i|-s] [-c certificate] [-G] [-g keysize] [-k keytype] [-n cluster_name] [-q paramset]"
 .SH DESCRIPTION
 .B corosync-qnetd-certutil
 is a frontend for the NSS certutil, it is used for generating the QNetd CA (Certificate Authority), 
@@ -81,8 +81,28 @@ is not passed to
 .B certutil
 at all.
 .TP
+.B -k
+Specify the key type to use when generating new public and private key pairs.
+This option is passed directly to the
+.B certutil
+command. By default, this is left empty, meaning
+.B -k
+is not passed to
+.B certutil
+at all.
+.TP
 .B -n
 Name of the cluster.
+.TP
+.B -q
+Specify the curve-name or ml-dsa-parameter-set to use when generating new public
+and private key pairs. This option is passed directly to the
+.B certutil
+command. By default, this is left empty, meaning
+.B -q
+is not passed to
+.B certutil
+at all.
 .SH NOTES
 If qnetd is executed by a non root user, /etc/corosync/qnetd and its subdirectories must be owned by (or have group access for) the given user. If
 .B corosync-qnetd-certutil

qdevices/corosync-qnetd-certutil.sh

@@ -57,14 +57,16 @@ errx() {
 }
 
 usage() {
-    echo "$0: [-i|-s] [-c certificate] [-G] [-g keysize] [-n cluster_name]"
+    echo "$0: [-i|-s] [-c certificate] [-G] [-g keysize] [-k keytype] [-n cluster_name] [-q paramset]"
     echo
     echo " -i                  Initialize QNetd CA and generate server certificate"
     echo " -s                  Sign cluster certificate (needs cluster certificate)"
     echo " -c certificate      CRQ certificate file name"
     echo " -G                  Do not set group write bit for new files"
     echo " -g keysize          Key size in bits - passed directly to certutil as -g parameter"
+    echo " -k keytype          Type of key - passed directly to certutil as -k parameter"
     echo " -n cluster_name     Name of cluster (for -s operation)"
+    echo " -q paramset         Parameter set (curve name, ml-dsa set) - passed directly to certutil as -q parameter"
 
     exit 0
 }
@@ -135,6 +137,14 @@ get_certutil_key_params() {
         CERTUTIL_PARAMS="$CERTUTIL_PARAMS -g $COROSYNC_QNETD_CERTUTIL_KEY_SIZE"
     fi
 
+    if [ ! -z "$COROSYNC_QNETD_CERTUTIL_KEY_TYPE" ];then
+        CERTUTIL_PARAMS="$CERTUTIL_PARAMS -k $COROSYNC_QNETD_CERTUTIL_KEY_TYPE"
+    fi
+
+    if [ ! -z "$COROSYNC_QNETD_CERTUTIL_PARAMSET" ];then
+        CERTUTIL_PARAMS="$CERTUTIL_PARAMS -q $COROSYNC_QNETD_CERTUTIL_PARAMSET"
+    fi
+
     echo "$CERTUTIL_PARAMS"
 }
 
@@ -202,6 +212,8 @@ sign_cluster_cert() {
 
 # Initialize options that may be overwritten by the configuration file
 COROSYNC_QNETD_CERTUTIL_KEY_SIZE=""
+COROSYNC_QNETD_CERTUTIL_KEY_TYPE=""
+COROSYNC_QNETD_CERTUTIL_PARAMSET=""
 
 # Import configuration file if it exists
 if [ -f "@INITCONFIGDIR@/corosync-qnetd" ];then
@@ -217,7 +229,7 @@ CERTIFICATE_FILE=""
 CLUSTER_NAME=""
 SET_GROUP_WRITE_BIT=true
 
-while getopts ":Ghisc:g:n:" opt; do
+while getopts ":Ghisc:g:k:n:q:" opt; do
     case $opt in
         i)
             OPERATION=init_qnetd_ca
@@ -237,9 +249,15 @@ while getopts ":Ghisc:g:n:" opt; do
         g)
             COROSYNC_QNETD_CERTUTIL_KEY_SIZE="$OPTARG"
             ;;
+        k)
+            COROSYNC_QNETD_CERTUTIL_KEY_TYPE="$OPTARG"
+            ;;
         n)
             CLUSTER_NAME="$OPTARG"
             ;;
+        q)
+            COROSYNC_QNETD_CERTUTIL_PARAMSET="$OPTARG"
+            ;;
         \?)
             errx 1 "Invalid option: -$OPTARG"
             ;;