Rewrote SSLCA as Cfg handler.

This adds encryption support to SSL key creation (much like SSH
private keys), and the ability to generate keys and certs that are
specific to groups, instead of just to hosts.  It also moves the SSLCA
data (the XML files describing keys and certs as well as the keys and
certs themselves) into the Cfg tree, rather than off in their own
separate place.

tools/upgrade/1.4/migrate_sslca.py can be used to migrate to the new
format.

This also adds XMLCfgCreator, a CfgCreator that makes it easier to
create data based on XML descriptions of it (which is exactly what the
SSH key and SSL CA creators do), including built-in support for host-
and group-specific data, encryption, and so on.

6 files changed, 431 insertions, 109 deletions

diff --git a/src/lib/Bcfg2/Server/Plugins/Cfg/CfgAuthorizedKeysGenerator.py b/src/lib/Bcfg2/Server/Plugins/Cfg/CfgAuthorizedKeysGenerator.py
index c08d3ec44..384d1bf12 100644
--- a/src/lib/Bcfg2/Server/Plugins/Cfg/CfgAuthorizedKeysGenerator.py
+++ b/src/lib/Bcfg2/Server/Plugins/Cfg/CfgAuthorizedKeysGenerator.py
@@ -5,7 +5,7 @@ access. """
 import lxml.etree
 import Bcfg2.Options
 from Bcfg2.Server.Plugin import StructFile, PluginExecutionError
-from Bcfg2.Server.Plugins.Cfg import CfgGenerator, CFG
+from Bcfg2.Server.Plugins.Cfg import CfgGenerator, get_cfg
 from Bcfg2.Server.Plugins.Metadata import ClientMetadata
 
 
@@ -25,7 +25,7 @@ class CfgAuthorizedKeysGenerator(CfgGenerator, StructFile):
         CfgGenerator.__init__(self, fname, None)
         StructFile.__init__(self, fname)
         self.cache = dict()
-        self.core = CFG.core
+        self.core = get_cfg().core
     __init__.__doc__ = CfgGenerator.__init__.__doc__
 
     def handle_event(self, event):
diff --git a/src/lib/Bcfg2/Server/Plugins/Cfg/CfgPrivateKeyCreator.py b/src/lib/Bcfg2/Server/Plugins/Cfg/CfgPrivateKeyCreator.py
index 7bb5d3cf5..e5611d50b 100644
--- a/src/lib/Bcfg2/Server/Plugins/Cfg/CfgPrivateKeyCreator.py
+++ b/src/lib/Bcfg2/Server/Plugins/Cfg/CfgPrivateKeyCreator.py
@@ -5,17 +5,11 @@ import shutil
 import tempfile
 import Bcfg2.Options
 from Bcfg2.Utils import Executor
-from Bcfg2.Server.Plugin import StructFile
-from Bcfg2.Server.Plugins.Cfg import CfgCreator, CfgCreationError
+from Bcfg2.Server.Plugins.Cfg import XMLCfgCreator, CfgCreationError
 from Bcfg2.Server.Plugins.Cfg.CfgPublicKeyCreator import CfgPublicKeyCreator
-try:
-    import Bcfg2.Server.Encryption
-    HAS_CRYPTO = True
-except ImportError:
-    HAS_CRYPTO = False
 
 
-class CfgPrivateKeyCreator(CfgCreator, StructFile):
+class CfgPrivateKeyCreator(XMLCfgCreator):
     """The CfgPrivateKeyCreator creates SSH keys on the fly. """
 
     #: Different configurations for different clients/groups can be
@@ -25,6 +19,7 @@ class CfgPrivateKeyCreator(CfgCreator, StructFile):
     #: Handle XML specifications of private keys
     __basenames__ = ['privkey.xml']
 
+    cfg_section = "sshkeys"
     options = [
         Bcfg2.Options.Option(
             cf=("sshkeys", "category"), dest="sshkeys_category",
@@ -34,27 +29,12 @@ class CfgPrivateKeyCreator(CfgCreator, StructFile):
             help="Passphrase used to encrypt generated SSH private keys")]
 
     def __init__(self, fname):
-        CfgCreator.__init__(self, fname)
-        StructFile.__init__(self, fname)
-
+        XMLCfgCreator.__init__(self, fname)
         pubkey_path = os.path.dirname(self.name) + ".pub"
         pubkey_name = os.path.join(pubkey_path, os.path.basename(pubkey_path))
         self.pubkey_creator = CfgPublicKeyCreator(pubkey_name)
         self.cmd = Executor()
-    __init__.__doc__ = CfgCreator.__init__.__doc__
-
-    @property
-    def passphrase(self):
-        """ The passphrase used to encrypt private keys """
-        if HAS_CRYPTO and Bcfg2.Options.setup.sshkeys_passphrase:
-            return Bcfg2.Options.setup.passphrases[
-                Bcfg2.Options.setup.sshkeys_passphrase]
-        return None
-
-    def handle_event(self, event):
-        CfgCreator.handle_event(self, event)
-        StructFile.HandleEvent(self, event)
-    handle_event.__doc__ = CfgCreator.handle_event.__doc__
+    __init__.__doc__ = XMLCfgCreator.__init__.__doc__
 
     def _gen_keypair(self, metadata, spec=None):
         """ Generate a keypair according to the given client medata
@@ -117,45 +97,6 @@ class CfgPrivateKeyCreator(CfgCreator, StructFile):
             shutil.rmtree(tempdir)
             raise
 
-    def get_specificity(self, metadata, spec=None):
-        """ Get config settings for key generation specificity
-        (per-host or per-group).
-
-        :param metadata: The client metadata to create data for
-        :type metadata: Bcfg2.Server.Plugins.Metadata.ClientMetadata
-        :param spec: The key specification to follow when creating the
-                     keys. This should be an XML document that only
-                     contains key specification data that applies to
-                     the given client metadata, and may be obtained by
-                     doing ``self.XMLMatch(metadata)``
-        :type spec: lxml.etree._Element
-        :returns: dict - A dict of specificity arguments suitable for
-                  passing to
-                  :func:`Bcfg2.Server.Plugins.Cfg.CfgCreator.write_data`
-                  or
-                  :func:`Bcfg2.Server.Plugins.Cfg.CfgCreator.get_filename`
-        """
-        if spec is None:
-            spec = self.XMLMatch(metadata)
-        category = spec.get("category", Bcfg2.Options.setup.sshkeys_category)
-        if category is None:
-            per_host_default = "true"
-        else:
-            per_host_default = "false"
-        per_host = spec.get("perhost", per_host_default).lower() == "true"
-
-        specificity = dict(host=metadata.hostname)
-        if category and not per_host:
-            group = metadata.group_in_category(category)
-            if group:
-                specificity = dict(group=group,
-                                   prio=int(spec.get("priority", 50)))
-            else:
-                self.logger.info("Cfg: %s has no group in category %s, "
-                                 "creating host-specific key" %
-                                 (metadata.hostname, category))
-        return specificity
-
     # pylint: disable=W0221
     def create_data(self, entry, metadata, return_pair=False):
         """ Create data for the given entry on the given client
@@ -176,7 +117,7 @@ class CfgPrivateKeyCreator(CfgCreator, StructFile):
                   ``return_pair`` is set to True
         """
         spec = self.XMLMatch(metadata)
-        specificity = self.get_specificity(metadata, spec)
+        specificity = self.get_specificity(metadata)
         filename = self._gen_keypair(metadata, spec)
 
         try:
@@ -190,12 +131,6 @@ class CfgPrivateKeyCreator(CfgCreator, StructFile):
             # encrypt the private key, write to the proper place, and
             # return it
             privkey = open(filename).read()
-            if HAS_CRYPTO and self.passphrase:
-                self.debug_log("Cfg: Encrypting key data at %s" % filename)
-                privkey = Bcfg2.Server.Encryption.ssl_encrypt(privkey,
-                                                              self.passphrase)
-                specificity['ext'] = '.crypt'
-
             self.write_data(privkey, **specificity)
 
             if return_pair:
diff --git a/src/lib/Bcfg2/Server/Plugins/Cfg/CfgPublicKeyCreator.py b/src/lib/Bcfg2/Server/Plugins/Cfg/CfgPublicKeyCreator.py
index 4c61e338e..de1848159 100644
--- a/src/lib/Bcfg2/Server/Plugins/Cfg/CfgPublicKeyCreator.py
+++ b/src/lib/Bcfg2/Server/Plugins/Cfg/CfgPublicKeyCreator.py
@@ -4,7 +4,7 @@ to create SSH keys on the fly. """
 
 import lxml.etree
 from Bcfg2.Server.Plugin import StructFile, PluginExecutionError
-from Bcfg2.Server.Plugins.Cfg import CfgCreator, CfgCreationError, CFG
+from Bcfg2.Server.Plugins.Cfg import CfgCreator, CfgCreationError, get_cfg
 
 
 class CfgPublicKeyCreator(CfgCreator, StructFile):
@@ -17,7 +17,7 @@ class CfgPublicKeyCreator(CfgCreator, StructFile):
     creation of a keypair when a public key is created. """
 
     #: Different configurations for different clients/groups can be
-    #: handled with Client and Group tags within privkey.xml
+    #: handled with Client and Group tags within pubkey.xml
     __specific__ = False
 
     #: Handle XML specifications of private keys
@@ -29,7 +29,7 @@ class CfgPublicKeyCreator(CfgCreator, StructFile):
     def __init__(self, fname):
         CfgCreator.__init__(self, fname)
         StructFile.__init__(self, fname)
-        self.cfg = CFG
+        self.cfg = get_cfg()
     __init__.__doc__ = CfgCreator.__init__.__doc__
 
     def create_data(self, entry, metadata):
diff --git a/src/lib/Bcfg2/Server/Plugins/Cfg/CfgSSLCACertCreator.py b/src/lib/Bcfg2/Server/Plugins/Cfg/CfgSSLCACertCreator.py
new file mode 100644
index 000000000..92fcc4cd8
--- /dev/null
+++ b/src/lib/Bcfg2/Server/Plugins/Cfg/CfgSSLCACertCreator.py
@@ -0,0 +1,255 @@
+""" Cfg creator that creates SSL certs """
+
+import os
+import sys
+import tempfile
+import lxml.etree
+import Bcfg2.Options
+from Bcfg2.Utils import Executor
+from Bcfg2.Compat import ConfigParser
+from Bcfg2.Server.FileMonitor import get_fam
+from Bcfg2.Server.Plugin import PluginExecutionError
+from Bcfg2.Server.Plugins.Cfg import CfgCreationError, XMLCfgCreator, \
+    CfgCreator, CfgVerifier, CfgVerificationError, get_cfg
+
+
+class CfgSSLCACertCreator(XMLCfgCreator, CfgVerifier):
+    """ This class acts as both a Cfg creator that creates SSL certs,
+    and as a Cfg verifier that verifies SSL certs. """
+
+    #: Different configurations for different clients/groups can be
+    #: handled with Client and Group tags within pubkey.xml
+    __specific__ = False
+
+    #: Handle XML specifications of private keys
+    __basenames__ = ['sslcert.xml']
+
+    cfg_section = "sslca"
+    options = [
+        Bcfg2.Options.Option(
+            cf=("sslca", "category"), dest="sslca_category",
+            help="Metadata category that generated SSL keys are specific to"),
+        Bcfg2.Options.Option(
+            cf=("sslca", "passphrase"), dest="sslca_passphrase",
+            help="Passphrase used to encrypt generated SSL keys"),
+        Bcfg2.Options.WildcardSectionGroup(
+            Bcfg2.Options.PathOption(
+                cf=("sslca_*", "config"),
+                help="Path to the openssl config for the CA"),
+            Bcfg2.Options.Option(
+                cf=("sslca_*", "passphrase"),
+                help="Passphrase for the CA private key"),
+            Bcfg2.Options.PathOption(
+                cf=("sslca_*", "chaincert"),
+                help="Path to the SSL chaining certificate for verification"),
+            Bcfg2.Options.BooleanOption(
+                cf=("sslca_*", "root_ca"),
+                help="Whether or not <chaincert> is a root CA (as opposed to "
+                "an intermediate cert"),
+            prefix="")]
+
+    def __init__(self, fname):
+        XMLCfgCreator.__init__(self, fname)
+        CfgVerifier.__init__(self, fname, None)
+        self.cmd = Executor()
+        self.cfg = get_cfg()
+
+    def build_req_config(self, metadata):
+        """ Generates a temporary openssl configuration file that is
+        used to generate the required certificate request. """
+        fd, fname = tempfile.mkstemp()
+        cfp = ConfigParser.ConfigParser({})
+        cfp.optionxform = str
+        defaults = dict(
+            req=dict(
+                default_md='sha1',
+                distinguished_name='req_distinguished_name',
+                req_extensions='v3_req',
+                x509_extensions='v3_req',
+                prompt='no'),
+            req_distinguished_name=dict(),
+            v3_req=dict(subjectAltName='@alt_names'),
+            alt_names=dict())
+        for section in list(defaults.keys()):
+            cfp.add_section(section)
+            for key in defaults[section]:
+                cfp.set(section, key, defaults[section][key])
+        spec = self.XMLMatch(metadata)
+        cert = spec.find("Cert")
+        altnamenum = 1
+        altnames = spec.findall('subjectAltName')
+        altnames.extend(list(metadata.aliases))
+        altnames.append(metadata.hostname)
+        for altname in altnames:
+            cfp.set('alt_names', 'DNS.' + str(altnamenum), altname)
+            altnamenum += 1
+        for item in ['C', 'L', 'ST', 'O', 'OU', 'emailAddress']:
+            if cert.get(item):
+                cfp.set('req_distinguished_name', item, cert.get(item))
+        cfp.set('req_distinguished_name', 'CN', metadata.hostname)
+        self.debug_log("Cfg: Writing temporary CSR config to %s" % fname)
+        try:
+            cfp.write(os.fdopen(fd, 'w'))
+        except IOError:
+            raise CfgCreationError("Cfg: Failed to write temporary CSR config "
+                                   "file: %s" % sys.exc_info()[1])
+        return fname
+
+    def build_request(self, keyfile, metadata):
+        """ Create the certificate request """
+        req_config = self.build_req_config(metadata)
+        try:
+            fd, req = tempfile.mkstemp()
+            os.close(fd)
+            cert = self.XMLMatch(metadata).find("Cert")
+            days = cert.get("days", "365")
+            cmd = ["openssl", "req", "-new", "-config", req_config,
+                   "-days", days, "-key", keyfile, "-text", "-out", req]
+            result = self.cmd.run(cmd)
+            if not result.success:
+                raise CfgCreationError("Failed to generate CSR: %s" %
+                                       result.error)
+            return req
+        finally:
+            try:
+                os.unlink(req_config)
+            except OSError:
+                self.logger.error("Cfg: Failed to unlink temporary CSR "
+                                  "config: %s" % sys.exc_info()[1])
+
+    def get_ca(self, name):
+        """ get a dict describing a CA from the config file """
+        rv = dict()
+        prefix = "sslca_%s_" % name
+        for attr in dir(Bcfg2.Options.setup):
+            if attr.startswith(prefix):
+                rv[attr[len(prefix):]] = getattr(Bcfg2.Options.setup, attr)
+        return rv
+
+    def create_data(self, entry, metadata):
+        """ generate a new cert """
+        self.logger.info("Cfg: Generating new SSL cert for %s" % self.name)
+        cert = self.XMLMatch(metadata).find("Cert")
+        ca = self.get_ca(cert.get('ca', 'default'))
+        req = self.build_request(self._get_keyfile(cert, metadata), metadata)
+        try:
+            days = cert.get('days', '365')
+            cmd = ["openssl", "ca", "-config", ca['config'], "-in", req,
+                   "-days", days, "-batch"]
+            passphrase = ca.get('passphrase')
+            if passphrase:
+                cmd.extend(["-passin", "pass:%s" % passphrase])
+            result = self.cmd.run(cmd)
+            if not result.success:
+                raise CfgCreationError("Failed to generate cert: %s" %
+                                       result.error)
+        except KeyError:
+            raise CfgCreationError("Cfg: [sslca_%s] section has no 'config' "
+                                   "option" % cert.get('ca', 'default'))
+        finally:
+            try:
+                os.unlink(req)
+            except OSError:
+                self.logger.error("Cfg: Failed to unlink temporary CSR: %s " %
+                                  sys.exc_info()[1])
+        data = result.stdout
+        if cert.get('append_chain') and 'chaincert' in ca:
+            data += open(ca['chaincert']).read()
+
+        self.write_data(data, **self.get_specificity(metadata))
+        return data
+
+    def verify_entry(self, entry, metadata, data):
+        fd, fname = tempfile.mkstemp()
+        self.debug_log("Cfg: Writing SSL cert %s to temporary file %s for "
+                       "verification" % (entry.get("name"), fname))
+        os.fdopen(fd, 'w').write(data)
+        cert = self.XMLMatch(metadata).find("Cert")
+        ca = self.get_ca(cert.get('ca', 'default'))
+        try:
+            if ca.get('chaincert'):
+                self.verify_cert_against_ca(fname, entry, metadata)
+            self.verify_cert_against_key(fname,
+                                         self._get_keyfile(cert, metadata))
+        finally:
+            os.unlink(fname)
+
+    def _get_keyfile(self, cert, metadata):
+        """ Given a <Cert/> element and client metadata, return the
+        full path to the file on the filesystem that the key lives in."""
+        keypath = cert.get("key")
+        eset = self.cfg.entries[keypath]
+        try:
+            return eset.best_matching(metadata).name
+        except PluginExecutionError:
+            # SSL key needs to be created
+            try:
+                creator = eset.best_matching(metadata,
+                                             eset.get_handlers(metadata,
+                                                               CfgCreator))
+            except PluginExecutionError:
+                raise CfgCreationError("Cfg: No SSL key or key creator "
+                                       "defined for %s" % keypath)
+
+            keyentry = lxml.etree.Element("Path", name=keypath)
+            creator.create_data(keyentry, metadata)
+
+            tries = 0
+            while True:
+                if tries >= 10:
+                    raise CfgCreationError("Cfg: Timed out waiting for event "
+                                           "on SSL key at %s" % keypath)
+                get_fam().handle_events_in_interval(1)
+                try:
+                    return eset.best_matching(metadata).name
+                except PluginExecutionError:
+                    tries += 1
+                    continue
+
+    def verify_cert_against_ca(self, filename, entry, metadata):
+        """
+        check that a certificate validates against the ca cert,
+        and that it has not expired.
+        """
+        cert = self.XMLMatch(metadata).find("Cert")
+        ca = self.get_ca(cert.get("ca", "default"))
+        chaincert = ca.get('chaincert')
+        cmd = ["openssl", "verify"]
+        is_root = ca.get('root_ca', "false").lower() == 'true'
+        if is_root:
+            cmd.append("-CAfile")
+        else:
+            # verifying based on an intermediate cert
+            cmd.extend(["-purpose", "sslserver", "-untrusted"])
+        cmd.extend([chaincert, filename])
+        self.debug_log("Cfg: Verifying %s against CA" % entry.get("name"))
+        result = self.cmd.run(cmd)
+        if result.stdout == cert + ": OK\n":
+            self.debug_log("Cfg: %s verified successfully against CA" %
+                           entry.get("name"))
+        else:
+            raise CfgVerificationError("%s failed verification against CA: %s"
+                                       % (entry.get("name"), result.error))
+
+    def _get_modulus(self, fname, ftype="x509"):
+        """ get the modulus from the given file """
+        cmd = ["openssl", ftype, "-noout", "-modulus", "-in", fname]
+        self.debug_log("Cfg: Getting modulus of %s for verification: %s" %
+                       (fname, " ".join(cmd)))
+        result = self.cmd.run(cmd)
+        if not result.success:
+            raise CfgVerificationError("Failed to get modulus of %s: %s" %
+                                       (fname, result.error))
+        return result.stdout.strip()
+
+    def verify_cert_against_key(self, filename, keyfile):
+        """ check that a certificate validates against its private
+        key. """
+        cert = self._get_modulus(filename)
+        key = self._get_modulus(keyfile, ftype="rsa")
+        if cert == key:
+            self.debug_log("Cfg: %s verified successfully against key %s" %
+                           (filename, keyfile))
+        else:
+            raise CfgVerificationError("%s failed verification against key %s"
+                                       % (filename, keyfile))
diff --git a/src/lib/Bcfg2/Server/Plugins/Cfg/CfgSSLCAKeyCreator.py b/src/lib/Bcfg2/Server/Plugins/Cfg/CfgSSLCAKeyCreator.py
new file mode 100644
index 000000000..a158302be
--- /dev/null
+++ b/src/lib/Bcfg2/Server/Plugins/Cfg/CfgSSLCAKeyCreator.py
@@ -0,0 +1,36 @@
+""" Cfg creator that creates SSL keys """
+
+from Bcfg2.Utils import Executor
+from Bcfg2.Server.Plugins.Cfg import CfgCreationError, XMLCfgCreator
+
+
+class CfgSSLCAKeyCreator(XMLCfgCreator):
+    """ Cfg creator that creates SSL keys """
+
+    #: Different configurations for different clients/groups can be
+    #: handled with Client and Group tags within sslkey.xml
+    __specific__ = False
+
+    __basenames__ = ["sslkey.xml"]
+
+    cfg_section = "sslca"
+
+    def create_data(self, entry, metadata):
+        self.logger.info("Cfg: Generating new SSL key for %s" % self.name)
+        spec = self.XMLMatch(metadata)
+        key = spec.find("Key")
+        if not key:
+            key = dict()
+        ktype = key.get('type', 'rsa')
+        bits = key.get('bits', '2048')
+        if ktype == 'rsa':
+            cmd = ["openssl", "genrsa", bits]
+        elif ktype == 'dsa':
+            cmd = ["openssl", "dsaparam", "-noout", "-genkey", bits]
+        result = Executor().run(cmd)
+        if not result.success:
+            raise CfgCreationError("Failed to generate key %s for %s: %s" %
+                                   (self.name, metadata.hostname,
+                                    result.error))
+        self.write_data(result.stdout, **self.get_specificity(metadata))
+        return result.stdout
diff --git a/src/lib/Bcfg2/Server/Plugins/Cfg/__init__.py b/src/lib/Bcfg2/Server/Plugins/Cfg/__init__.py
index 99afac7eb..21dc35e5a 100644
--- a/src/lib/Bcfg2/Server/Plugins/Cfg/__init__.py
+++ b/src/lib/Bcfg2/Server/Plugins/Cfg/__init__.py
@@ -10,16 +10,26 @@ import Bcfg2.Options
 import Bcfg2.Server.Plugin
 from Bcfg2.Server.Plugin import PluginExecutionError
 # pylint: disable=W0622
-from Bcfg2.Compat import u_str, unicode, b64encode, any, oct_mode
+from Bcfg2.Compat import u_str, unicode, b64encode, any
 # pylint: enable=W0622
 
-#: CFG is a reference to the :class:`Bcfg2.Server.Plugins.Cfg.Cfg`
-#: plugin object created by the Bcfg2 core.  This is provided so that
-#: the handler objects can access it as necessary, since the existing
-#: :class:`Bcfg2.Server.Plugin.helpers.GroupSpool` and
-#: :class:`Bcfg2.Server.Plugin.helpers.EntrySet` classes have no
-#: facility for passing it otherwise.
-CFG = None
+try:
+    import Bcfg2.Server.Encryption
+    HAS_CRYPTO = True
+except ImportError:
+    HAS_CRYPTO = False
+
+
+_CFG = None
+
+def get_cfg():
+    """ Get the :class:`Bcfg2.Server.Plugins.Cfg.Cfg` plugin object
+    created by the Bcfg2 core.  This is provided so that the handler
+    objects can access it as necessary, since the existing
+    :class:`Bcfg2.Server.Plugin.helpers.GroupSpool` and
+    :class:`Bcfg2.Server.Plugin.helpers.EntrySet` classes have no
+    facility for passing it otherwise."""
+    return _CFG
 
 
 class CfgBaseFileMatcher(Bcfg2.Server.Plugin.SpecificData):
@@ -288,7 +298,7 @@ class CfgCreator(CfgBaseFileMatcher):
         :type name: string
 
         .. -----
-        .. autoattribute:: Bcfg2.Server.Plugins.Cfg.CfgCreator.__specific__
+        .. autoattribute:: Bcfg2.Server.Plugins.Cfg.CfgInfo.__specific__
         """
         CfgBaseFileMatcher.__init__(self, fname, None)
 
@@ -310,7 +320,9 @@ class CfgCreator(CfgBaseFileMatcher):
         ``host`` is given, it will be host-specific.  It will be
         group-specific if ``group`` and ``prio`` are given.  If
         neither ``host`` nor ``group`` is given, the filename will be
-        non-specific.
+        non-specific. In general, this will be called as::
+
+            self.get_filename(**self.get_specificity(metadata))
 
         :param host: The file applies to the given host
         :type host: bool
@@ -341,6 +353,9 @@ class CfgCreator(CfgBaseFileMatcher):
         written as a host-specific file, or as a group-specific file
         if ``group`` and ``prio`` are given.  If neither ``host`` nor
         ``group`` is given, it will be written as a non-specific file.
+        In general, this will be called as::
+
+            self.write_data(data, **self.get_specificity(metadata))
 
         :param data: The data to write
         :type data: string
@@ -360,7 +375,7 @@ class CfgCreator(CfgBaseFileMatcher):
         :raises: :exc:`Bcfg2.Server.Plugins.Cfg.CfgCreationError`
         """
         fileloc = self.get_filename(host=host, group=group, prio=prio, ext=ext)
-        self.debug_log("%s: Writing new file %s" % (self.name, fileloc))
+        self.debug_log("Cfg: Writing new file %s" % fileloc)
         try:
             os.makedirs(os.path.dirname(fileloc))
         except OSError:
@@ -376,6 +391,95 @@ class CfgCreator(CfgBaseFileMatcher):
             raise CfgCreationError("Could not write %s: %s" % (fileloc, err))
 
 
+class XMLCfgCreator(CfgCreator,  # pylint: disable=W0223
+                    Bcfg2.Server.Plugin.StructFile):
+    """ A CfgCreator that uses XML to describe how data should be
+    generated. """
+
+    #: Whether or not the created data from this class can be
+    #: encrypted
+    encryptable = True
+
+    #: Encryption and creation settings can be stored in bcfg2.conf,
+    #: either under the [cfg] section, or under the named section.
+    cfg_section = None
+
+    def __init__(self, name):
+        CfgCreator.__init__(self, name)
+        Bcfg2.Server.Plugin.StructFile.__init__(self, name)
+
+    def handle_event(self, event):
+        CfgCreator.handle_event(self, event)
+        Bcfg2.Server.Plugin.StructFile.HandleEvent(self, event)
+
+    @property
+    def passphrase(self):
+        """ The passphrase used to encrypt created data """
+        if self.cfg_section:
+            localopt = "%s_passphrase" % self.cfg_section
+            passphrase = getattr(Bcfg2.Options.setup, localopt,
+                                 Bcfg2.Options.setup.cfg_passphrase)
+        else:
+            passphrase = Bcfg2.Options.setup.cfg_passphrase
+        if passphrase is None:
+            return None
+        try:
+            return Bcfg2.Options.setup.passphrases[passphrase]
+        except KeyError:
+            raise CfgCreationError("%s: No such passphrase: %s" %
+                                   (self.__class__.__name__, passphrase))
+
+    @property
+    def category(self):
+        """ The category to which created data is specific """
+        if self.cfg_section:
+            localopt = "%s_category" % self.cfg_section
+            return getattr(Bcfg2.Options.setup, localopt,
+                           Bcfg2.Options.setup.cfg_category)
+        else:
+            return Bcfg2.Options.setup.cfg_category
+
+    def write_data(self, data, host=None, group=None, prio=0, ext=''):
+        if HAS_CRYPTO and self.encryptable and self.passphrase:
+            self.debug_log("Cfg: Encrypting created data")
+            data = Bcfg2.Server.Encryption.ssl_encrypt(data, self.passphrase)
+            ext = '.crypt'
+        CfgCreator.write_data(self, data, host=host, group=group, prio=prio,
+                              ext=ext)
+
+    def get_specificity(self, metadata):
+        """ Get config settings for key generation specificity
+        (per-host or per-group).
+
+        :param metadata: The client metadata to create data for
+        :type metadata: Bcfg2.Server.Plugins.Metadata.ClientMetadata
+        :returns: dict - A dict of specificity arguments suitable for
+                  passing to
+                  :func:`Bcfg2.Server.Plugins.Cfg.CfgCreator.write_data`
+                  or
+                  :func:`Bcfg2.Server.Plugins.Cfg.CfgCreator.get_filename`
+        """
+        category = self.xdata.get("category", self.category)
+        if category is None:
+            per_host_default = "true"
+        else:
+            per_host_default = "false"
+        per_host = self.xdata.get("perhost",
+                                  per_host_default).lower() == "true"
+
+        specificity = dict(host=metadata.hostname)
+        if category and not per_host:
+            group = metadata.group_in_category(category)
+            if group:
+                specificity = dict(group=group,
+                                   prio=int(self.xdata.get("priority", 50)))
+            else:
+                self.logger.info("Cfg: %s has no group in category %s, "
+                                 "creating host-specific data" %
+                                 (metadata.hostname, category))
+        return specificity
+
+
 class CfgVerificationError(Exception):
     """ Raised by
     :func:`Bcfg2.Server.Plugins.Cfg.CfgVerifier.verify_entry` when an
@@ -411,7 +515,6 @@ class CfgEntrySet(Bcfg2.Server.Plugin.EntrySet):
     def __init__(self, basename, path, entry_type):
         Bcfg2.Server.Plugin.EntrySet.__init__(self, basename, path, entry_type)
         self.specific = None
-        self._handlers = None
     __init__.__doc__ = Bcfg2.Server.Plugin.EntrySet.__doc__
 
     def set_debug(self, debug):
@@ -420,14 +523,6 @@ class CfgEntrySet(Bcfg2.Server.Plugin.EntrySet):
             entry.set_debug(debug)
         return rv
 
-    @property
-    def handlers(self):
-        """ A list of Cfg handler classes. """
-        if self._handlers is None:
-            self._handlers = Bcfg2.Options.setup.cfg_handlers
-            self._handlers.sort(key=operator.attrgetter("__priority__"))
-        return self._handlers
-
     def handle_event(self, event):
         """ Dispatch a FAM event to :func:`entry_init` or the
         appropriate child handler object.
@@ -444,7 +539,7 @@ class CfgEntrySet(Bcfg2.Server.Plugin.EntrySet):
                 # process a bogus changed event like a created
                 return
 
-            for hdlr in self.handlers:
+            for hdlr in Bcfg2.Options.setup.cfg_handlers:
                 if hdlr.handles(event, basename=self.path):
                     if action == 'changed':
                         # warn about a bogus 'changed' event, but
@@ -783,6 +878,13 @@ class Cfg(Bcfg2.Server.Plugin.GroupSpool,
             '--cfg-validation', cf=('cfg', 'validation'), default=True,
             help='Run validation on Cfg files'),
         Bcfg2.Options.Option(
+            cf=('cfg', 'category'), dest="cfg_category",
+            help='The default name of the metadata category that created data '
+            'is specific to'),
+        Bcfg2.Options.Option(
+            cf=('cfg', 'passphrase'), dest="cfg_passphrase",
+            help='The default passphrase name used to encrypt created data'),
+        Bcfg2.Options.Option(
             cf=("cfg", "handlers"), dest="cfg_handlers",
             help="Cfg handlers to load",
             type=Bcfg2.Options.Types.comma_list, action=CfgHandlerAction,
@@ -791,24 +893,18 @@ class Cfg(Bcfg2.Server.Plugin.GroupSpool,
                      'CfgGenshiGenerator', 'CfgEncryptedGenshiGenerator',
                      'CfgExternalCommandVerifier', 'CfgInfoXML',
                      'CfgPlaintextGenerator',
-                     'CfgPrivateKeyCreator', 'CfgPublicKeyCreator'])]
+                     'CfgPrivateKeyCreator', 'CfgPublicKeyCreator',
+                     'CfgSSLCACertCreator', 'CfgSSLCAKeyCreator'])]
 
     def __init__(self, core, datastore):
-        global CFG  # pylint: disable=W0603
+        global _CFG  # pylint: disable=W0603
         Bcfg2.Server.Plugin.GroupSpool.__init__(self, core, datastore)
         Bcfg2.Server.Plugin.PullTarget.__init__(self)
-        self._handlers = None
-        CFG = self
+        Bcfg2.Options.setup.cfg_handlers.sort(
+            key=operator.attrgetter("__priority__"))
+        _CFG = self
     __init__.__doc__ = Bcfg2.Server.Plugin.GroupSpool.__init__.__doc__
 
-    @property
-    def handlers(self):
-        """ A list of Cfg handler classes. """
-        if self._handlers is None:
-            self._handlers = Bcfg2.Options.setup.cfg_handlers
-            self._handlers.sort(key=operator.attrgetter("__priority__"))
-        return self._handlers
-
     def has_generator(self, entry, metadata):
         """ Return True if the given entry can be generated for the
         given metadata; False otherwise