ACME PKI issuer: add support for Authority ID or DN

Allow issuing ACME certificates using a specific authority. This would allow FreeIPA to specify a particular subCA to handle ACME certificates. Fixes: #4902 Signed-off-by: Alexander Bokovoy <[email protected]>
dogtagpki · Nov 18, 2024 · 58267d3 · 58267d3
1 parent 475b58c
commit 58267d3
Show file tree

Hide file tree

Showing 2 changed files with 44 additions and 1 deletion.
diff --git a/base/acme/src/main/java/org/dogtagpki/acme/issuer/PKIIssuer.java b/base/acme/src/main/java/org/dogtagpki/acme/issuer/PKIIssuer.java
@@ -22,9 +22,11 @@
 import org.mozilla.jss.netscape.security.util.Utils;
 import org.mozilla.jss.netscape.security.x509.RevocationReason;
 import org.mozilla.jss.netscape.security.x509.X509CertImpl;
+import org.mozilla.jss.netscape.security.x509.X500Name;
 
 import com.netscape.certsrv.ca.CACertClient;
 import com.netscape.certsrv.ca.CAClient;
+import com.netscape.certsrv.ca.AuthorityID;
 import com.netscape.certsrv.cert.CertData;
 import com.netscape.certsrv.cert.CertEnrollmentRequest;
 import com.netscape.certsrv.cert.CertRequestInfo;
@@ -48,6 +50,8 @@ public class PKIIssuer extends ACMEIssuer {
 
     private ClientConfig clientConfig = new ClientConfig();
     private String profile;
+    private AuthorityID authorityID;
+    private X500Name authorityDN;
 
     public String getProfile() {
         return profile;
@@ -108,6 +112,18 @@ public void init() throws Exception {
 
         profile = config.getParameter("profile");
         logger.info("- profile: " + profile);
+
+        String aid = config.getParameter("authority-id");
+        if (aid != null) {
+            authorityID = new AuthorityID(aid);
+            logger.info("- authority-id: " + aid);
+        }
+
+        String adn = config.getParameter("authority-dn");
+        if (adn != null) {
+            authorityDN = new X500Name(adn);
+            logger.info("- authority-dn: " + adn);
+        }
     }
 
     @Override
@@ -164,7 +180,8 @@ public String issueCertificate(PKCS10 pkcs10) throws Exception {
 
             logger.info("Request:\n" + certEnrollmentRequest);
 
-            CertRequestInfos infos = certClient.enrollRequest(certEnrollmentRequest, null, null);
+            CertRequestInfos infos = certClient.enrollRequest(
+			    certEnrollmentRequest, authorityID, authorityDN);
 
             logger.info("Responses:");
             CertRequestInfo info = infos.getEntries().iterator().next();

diff --git a/base/server/python/pki/server/cli/acme.py b/base/server/python/pki/server/cli/acme.py
@@ -984,6 +984,15 @@ def execute(self, argv):
             if profile:
                 print('  Certificate Profile: %s' % profile)
 
+            authority_id = config.get('authority-id')
+            if authority_id:
+                print('  Authority ID: %s' % authority_id)
+
+            authority_dn = config.get('authority-dn')
+            if authority_dn:
+                print('  Authority DN: %s' % authority_dn)
+
+
 
 class ACMEIssuerModifyCLI(pki.cli.CLI):
 
@@ -1163,6 +1172,23 @@ def execute(self, argv):
             profile = pki.util.read_text('  Certificate Profile', default=profile, required=True)
             pki.util.set_property(config, 'profile', profile)
 
+            print()
+            print('Enter ID of the authority for issuing ACME certificates '
+                  '(empty for main CA, subCA ID otherwise).')
+            authority_id = config.get('authority-id')
+            authority_id = pki.util.read_text('  Authority ID', default=authority_id, required=True)
+            if authority_id:
+                pki.util.set_property(config, 'authority-id', authority_id)
+
+            if not authority_id:
+                print()
+                print('Enter DN of the authority for issuing ACME certificates '
+                      '(empty for main CA, subCA DN otherwise).')
+                authority_dn = config.get('authority-dn')
+                authority_dn = pki.util.read_text('  Authority ID', default=authority_id, required=True)
+                if authority_dn:
+                    pki.util.set_property(config, 'authority-dn', authority_dn)
+
         subsystem.update_issuer_config(config)