Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Configuration free certs #4584

Merged
merged 4 commits into from
Oct 9, 2023
Merged

Configuration free certs #4584

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f0f40f2
Create subsystem without certificate in CS.cfg
fmarco76 Oct 5, 2023
61340fd
Lightweight CA read issuer certificate from nssdb
fmarco76 Oct 6, 2023
6075e73
Get cert from nssdb for all subsystems
fmarco76 Oct 9, 2023
c89c3c2
Improve message error for subsystem certificate not found
fmarco76 Oct 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 18 additions & 10 deletions base/ca/src/main/java/com/netscape/ca/CertificateAuthority.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,6 @@

import javax.servlet.http.HttpServletRequest;

import org.apache.commons.lang3.StringUtils;
import org.dogtagpki.server.authentication.AuthToken;
import org.dogtagpki.server.ca.CAConfig;
import org.dogtagpki.server.ca.CAEngine;
Expand All @@ -63,13 +62,13 @@
import org.mozilla.jss.crypto.KeyPairAlgorithm;
import org.mozilla.jss.crypto.KeyPairGenerator;
import org.mozilla.jss.crypto.NoSuchItemOnTokenException;
import org.mozilla.jss.crypto.ObjectNotFoundException;
import org.mozilla.jss.crypto.SignatureAlgorithm;
import org.mozilla.jss.crypto.TokenException;
import org.mozilla.jss.crypto.X509Certificate;
import org.mozilla.jss.netscape.security.pkcs.PKCS10;
import org.mozilla.jss.netscape.security.util.DerOutputStream;
import org.mozilla.jss.netscape.security.util.DerValue;
import org.mozilla.jss.netscape.security.util.Utils;
import org.mozilla.jss.netscape.security.x509.AlgorithmId;
import org.mozilla.jss.netscape.security.x509.CertificateChain;
import org.mozilla.jss.netscape.security.x509.CertificateIssuerName;
Expand Down Expand Up @@ -1037,19 +1036,28 @@ public X509CertImpl getCACert() throws EBaseException {
return caCertImpl;
}

String cert = mConfig.getString("signing.cert");
logger.debug("CertificateAuthority: CA signing cert: " + cert);
String certName = mConfig.getString("signing.certnickname");
String tokenName = mConfig.getString("signing.tokenname");

if (StringUtils.isEmpty(cert)) {
logger.error("CertificateAuthority: Missing CA signing certificate");
throw new EBaseException("Missing CA signing certificate");
if(!CryptoUtil.isInternalToken(tokenName)) {
certName = tokenName + ":" + certName;
}

byte[] bytes = Utils.base64decode(cert);
logger.debug("CertificateAuthority: size: " + bytes.length + " bytes");
logger.debug("CertificateAuthority: Getting CA signing cert: " + certName);

CryptoManager manager;
X509Certificate caCert;
try {
return new X509CertImpl(bytes);
manager= CryptoManager.getInstance();
caCert = manager.findCertByNickname(certName);
} catch (ObjectNotFoundException | NotInitializedException | TokenException e) {
logger.error("CertificateAuthority: Unable to find CA signing certificate: " + e.getMessage(), e);
throw new EBaseException("Unable to find CA signing certificate: " + e.getMessage(), e);
}

try {

return new X509CertImpl(caCert.getEncoded());

} catch (CertificateException e) {
logger.error("Unable to parse CA signing cert: " + e.getMessage(), e);
Expand Down
34 changes: 13 additions & 21 deletions base/server/python/pki/server/deployment/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2169,7 +2169,7 @@ def import_system_certs(self, nssdb, subsystem):

self.import_cert_chain(nssdb)

def update_system_cert(self, nssdb, subsystem, tag):
def update_system_cert(self, subsystem, tag):

logger.info('Updating %s cert', tag)

Expand All @@ -2182,15 +2182,6 @@ def update_system_cert(self, nssdb, subsystem, tag):
tokenname = pki.nssdb.INTERNAL_TOKEN_NAME
subsystem.config['%s.%s.tokenname' % (subsystem.name, tag)] = tokenname

cert_data = nssdb.get_cert(
nickname=nickname,
token=self.mdict['pki_%s_token' % cert_id],
output_format='base64',
output_text=True,
)

subsystem.config['%s.%s.cert' % (subsystem.name, tag)] = cert_data

def update_admin_cert(self, subsystem):

logger.info('Updating admin certificate')
Expand All @@ -2212,40 +2203,40 @@ def update_admin_cert(self, subsystem):
finally:
client_nssdb.close()

def update_system_certs(self, nssdb, subsystem):
def update_system_certs(self, subsystem):

logger.info('Updating system certs')

if subsystem.name == 'ca':
self.update_system_cert(nssdb, subsystem, 'signing')
self.update_system_cert(subsystem, 'signing')

nickname = self.mdict['pki_ca_signing_nickname']
subsystem.config['ca.signing.cacertnickname'] = nickname

subsystem.config['ca.signing.defaultSigningAlgorithm'] = \
self.mdict['pki_ca_signing_signing_algorithm']

self.update_system_cert(nssdb, subsystem, 'ocsp_signing')
self.update_system_cert(subsystem, 'ocsp_signing')

subsystem.config['ca.ocsp_signing.defaultSigningAlgorithm'] = \
self.mdict['pki_ocsp_signing_signing_algorithm']

if subsystem.name == 'kra':
self.update_system_cert(nssdb, subsystem, 'storage')
self.update_system_cert(nssdb, subsystem, 'transport')
self.update_system_cert(subsystem, 'storage')
self.update_system_cert(subsystem, 'transport')
self.update_admin_cert(subsystem)

if subsystem.name == 'ocsp':
self.update_system_cert(nssdb, subsystem, 'signing')
self.update_system_cert(subsystem, 'signing')

subsystem.config['ocsp.signing.defaultSigningAlgorithm'] = \
self.mdict['pki_ocsp_signing_signing_algorithm']

self.update_admin_cert(subsystem)

self.update_system_cert(nssdb, subsystem, 'sslserver')
self.update_system_cert(nssdb, subsystem, 'subsystem')
self.update_system_cert(nssdb, subsystem, 'audit_signing')
self.update_system_cert(subsystem, 'sslserver')
self.update_system_cert(subsystem, 'subsystem')
self.update_system_cert(subsystem, 'audit_signing')

subsystem.config['%s.audit_signing.defaultSigningAlgorithm' % subsystem.name] = \
self.mdict['pki_audit_signing_signing_algorithm']
Expand Down Expand Up @@ -3973,8 +3964,9 @@ def add_kra_connector(self, subsystem, ca_url):
kra_url = 'https://%s:%s/kra/agent/kra/connector' % (hostname, securePort)

subsystem_cert = subsystem.get_subsystem_cert('subsystem').get('data')
transport_cert = subsystem.config.get('kra.transport.cert')
transport_nickname = subsystem.config.get('kra.cert.transport.nickname')
transport_cert_info = subsystem.get_subsystem_cert('transport')
transport_cert = transport_cert_info.get('data')
transport_nickname = transport_cert_info.get('nickname')

tmpdir = tempfile.mkdtemp()
try:
Expand Down
12 changes: 2 additions & 10 deletions base/server/python/pki/server/deployment/scriptlets/configuration.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ def spawn(self, deployer):
try:
deployer.import_system_cert_requests(subsystem)
deployer.import_system_certs(nssdb, subsystem)
deployer.update_system_certs(nssdb, subsystem)
deployer.update_system_certs(subsystem)
subsystem.save()

deployer.update_sslserver_cert_nickname(subsystem)
Expand All @@ -79,17 +79,9 @@ def spawn(self, deployer):
if s.name == subsystem.name:
continue

# import cert/request data from the existing subsystem
# import request data from the existing subsystem
# into the new subsystem being installed

logger.info('Importing sslserver cert data from %s', s.type)
subsystem.config['%s.sslserver.cert' % subsystem.name] = \
s.config['%s.sslserver.cert' % s.name]

logger.info('Importing subsystem cert data from %s', s.type)
subsystem.config['%s.subsystem.cert' % subsystem.name] = \
s.config['%s.subsystem.cert' % s.name]

logger.info('Importing sslserver request data from %s', s.type)
subsystem.config['%s.sslserver.certreq' % subsystem.name] = \
s.config['%s.sslserver.certreq' % s.name]
Expand Down
1 change: 0 additions & 1 deletion base/server/python/pki/server/subsystem.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -330,7 +330,6 @@ def update_system_cert(self, cert):
cert_id = cert['id']
self.config['%s.%s.nickname' % (self.name, cert_id)] = cert.get('nickname')
self.config['%s.%s.tokenname' % (self.name, cert_id)] = cert.get('token')
self.config['%s.%s.cert' % (self.name, cert_id)] = cert.get('data')
self.config['%s.%s.certreq' % (self.name, cert_id)] = cert.get('request')

def validate_system_cert(self, tag):
Expand Down
Loading