Gitiles
Code Review Sign In
gerrit.openbmc.org / openbmc / phosphor-certificate-manager / 55ceaa2b975c455383ba3266b7cdaf644abba462
commit55ceaa2b975c455383ba3266b7cdaf644abba462[log] [tgz]
authorPatrick Williams <patrick@stwcx.xyz>Tue Dec 14 06:52:26 2021 -0600
committerPatrick Williams <patrick@stwcx.xyz>Tue Dec 14 15:26:15 2021 -0600
treed745c102e812f4e955310fb4542e206e44c1edf8
parentbb939ea45d53b2dbb7ab6b03856f023f82beecd5 [diff]
certificate: openssl3: switch to EVP_PKEY_eq

In OpenSSL3, the EVP_PKEY_cmp has become EVP_PKEY_eq and the
EVP_PKEY_cmp is deprecated.

Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
Change-Id: If23318c862b760cff6ae9810ff929ec1a9d1a1a4
1 file changed
tree: d745c102e812f4e955310fb4542e206e44c1edf8
  1. bmc-vmi-ca/
  2. dist/
  3. subprojects/
  4. test/
  5. .clang-format
  6. .gitignore
  7. .lcovrc
  8. argument.cpp
  9. argument.hpp
  10. bootstrap.sh
  11. certificate.cpp
  12. certificate.hpp
  13. certs_manager.cpp
  14. certs_manager.hpp
  15. config.h.meson
  16. configure.ac
  17. csr.cpp
  18. csr.hpp
  19. LICENSE
  20. mainapp.cpp
  21. MAINTAINERS
  22. Makefile.am
  23. Makefile.am.include
  24. meson.build
  25. meson_options.txt
  26. OWNERS
  27. README.md
  28. watch.cpp
  29. watch.hpp
README.md

phosphor-certificate-manager

Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.

To Build

To build this package, do the following steps:

    1. ./bootstrap.sh
    2. ./configure ${CONFIGURE_FLAGS}
    3. make

To clean the repository run `./bootstrap.sh clean`.

To Run

Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.

Usage: ./phosphor-certificate-manager [options]
Options:
    --help            Print this menu
    --type            certificate type
                      Valid types: client,server,authority
    --endpoint        d-bus endpoint
    --path            certificate file path
    --unit=<name>     Optional systemd unit need to reload

Https certificate management

Purpose: Server https certificate

./phosphor-certificate-manager --type=server --endpoint=https \
    --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service

CA certificate management

Purpose: Client certificate validation

./phosphor-certificate-manager --type=authority --endpoint=ldap \
    --path=/etc/ssl/certs/authority --unit=bmcweb.service

LDAP client certificate management

Purpose: LDAP client certificate validation

./phosphor-certificate-manager --type=client --endpoint=ldap \
    --path=/etc/nslcd/certs/cert.pem

D-Bus Interface

phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.

D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".

Take https certificate management as an example.

./phosphor-certificate-manager --type=server --endpoint=https \
    --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service

D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".

Usage in openbmc/bmcweb

OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.