| commit | cf06ccdcbab548e8e75f5c1737569132d1bcb3c1 | [log] [tgz] |
|---|---|---|
| author | Nan Zhou <nanzhoumails@gmail.com> | Tue Dec 28 16:25:45 2021 -0800 |
| committer | Nan Zhou <nanzhoumails@gmail.com> | Wed Jan 19 15:12:12 2022 -0800 |
| tree | a09b5e5fba35da5ba6ed521524fdd4546926a310 | |
| parent | 762da74eeaceba1d77fed0348dad256a4e675f26 [diff] |
clean up using directives and type alias Most C++ style guides try to avoid using directives in headers and also suggest using type alias carefully, according to which, this change does the following clean up: 1. used Enum class to represent Certificate type 2. removed all using directives: e.g. the phosphor logging namespace; instead, this change uses using declarations 3. removed unnecessary type alias; in existing codes, we only support strings as types of UnitToRestart, InstallPath, UploadPath, etc; this change uses std::string directly 4. moved all alias outside any class scope into source files or an internal namespace 5. renamed types, constants, classes as per OpenBMC style guide 6. fixed all compilation errors and some warnings after the refactoring; built with both Clang & GCC Reference: https://docs.microsoft.com/en-us/cpp/cpp/header-files-cpp?view=msvc-170#what-to-put-in-a-header-file https://google.github.io/styleguide/cppguide.html#Namespaces Tested: Unit tests Signed-off-by: Nan Zhou <nanzhoumails@gmail.com> Change-Id: I58e026934a4e969f4d8877801c8f3c671990468a
Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.
This project can be built with meson. The typical meson workflow is: meson builddir && ninja -C builddir.
Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.
Usage: ./phosphor-certificate-manager [options]
Options:
--help Print this menu
--type certificate type
Valid types: client,server,authority
--endpoint d-bus endpoint
--path certificate file path
--unit=<name> Optional systemd unit need to reload
Purpose: Server https certificate
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
Purpose: Client certificate validation
./phosphor-certificate-manager --type=authority --endpoint=ldap \ --path=/etc/ssl/certs/authority --unit=bmcweb.service
Purpose: LDAP client certificate validation
./phosphor-certificate-manager --type=client --endpoint=ldap \ --path=/etc/nslcd/certs/cert.pem
phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.
D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".
Take https certificate management as an example.
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".
OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.