commit | a49895eead7e474af0c122b1724ae1ce615d550a | [log] [tgz] |
---|---|---|
author | Ravi Teja <raviteja28031990@gmail.com> | Tue Jun 16 03:57:58 2020 -0500 |
committer | Ravi Teja <raviteja28031990@gmail.com> | Sat Oct 03 11:38:11 2020 -0500 |
tree | 2776a996768d11957e684248782e17f3fb2d3923 | |
parent | 5c515c21fb8d3c2f983ccdadca859b0f2cb282cf [diff] |
Implementation of BMC VMI certificate manager This manager is to create and manage entries for each host CSR request which needs to shared with host. this commits implements dbus interfaces https://gerrit.openbmc-project.xyz/c/openbmc/phosphor-dbus-interfaces/+/31808 This feature can be enabled by using below feature flag "--enable-ca-cert-extension" Testby: Creating CSR entries Deleting entries Setting properties Signed-off-by: Ravi Teja <raviteja28031990@gmail.com> Change-Id: I24829b839feac6264f32053b9be63daef6599379
Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.
To build this package, do the following steps: 1. ./bootstrap.sh 2. ./configure ${CONFIGURE_FLAGS} 3. make To clean the repository run `./bootstrap.sh clean`.
Multiple instances of phosphor-certificate-manager
are usually run on the bmc to support management of different types of certificates.
Usage: ./phosphor-certificate-manager [options] Options: --help Print this menu --type certificate type Valid types: client,server,authority --endpoint d-bus endpoint --path certificate file path --unit=<name> Optional systemd unit need to reload
Purpose: Server https certificate
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
Purpose: Client certificate validation
./phosphor-certificate-manager --type=authority --endpoint=ldap \ --path=/etc/ssl/certs/authority --unit=bmcweb.service
Purpose: LDAP client certificate validation
./phosphor-certificate-manager --type=client --endpoint=ldap \ --path=/etc/nslcd/certs/cert.pem
phosphor-certificate-manager
is an implementation of the D-Bus interface defined in this document.
D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".
Take https certificate management as an example.
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".
OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager
via D-Bus.