blob: eb59bee88a81cd180cb3a796c5054f39c059d155 [file] [log] [blame]
Ed Tanous0fdddb12017-02-28 11:06:34 -08001#pragma once
2
3#include <openssl/bio.h>
4#include <openssl/dh.h>
5#include <openssl/dsa.h>
Ed Tanous0fdddb12017-02-28 11:06:34 -08006#include <openssl/err.h>
7#include <openssl/evp.h>
8#include <openssl/pem.h>
9#include <openssl/rand.h>
10#include <openssl/rsa.h>
11#include <openssl/ssl.h>
Ed Tanous9b65f1f2017-03-07 15:17:13 -080012
Ed Tanous3112a142018-11-29 15:45:10 -080013#include <boost/asio/ssl/context.hpp>
Nan Zhou97128e92021-08-17 12:01:55 -070014#include <random.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050015
Ed Tanous1abe55e2018-09-05 08:30:59 -070016#include <random>
17
18namespace ensuressl
19{
Gunnar Mills1214b7e2020-06-04 10:11:30 -050020constexpr char const* trustStorePath = "/etc/ssl/certs/authority";
Alan Kuoa8220702020-11-26 11:15:29 +080021constexpr char const* x509Comment = "Generated from OpenBMC service";
Ed Tanous55c7b7a2018-05-22 15:27:24 -070022static void initOpenssl();
Gunnar Mills1214b7e2020-06-04 10:11:30 -050023static EVP_PKEY* createEcKey();
Ed Tanous0fdddb12017-02-28 11:06:34 -080024
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050025// Trust chain related errors.`
26inline bool isTrustChainError(int errnum)
27{
28 if ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ||
29 (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) ||
30 (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) ||
31 (errnum == X509_V_ERR_CERT_UNTRUSTED) ||
32 (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE))
33 {
34 return true;
35 }
Ed Tanous3174e4d2020-10-07 11:41:22 -070036 return false;
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050037}
38
Gunnar Mills1214b7e2020-06-04 10:11:30 -050039inline bool validateCertificate(X509* const cert)
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050040{
41 // Create an empty X509_STORE structure for certificate validation.
Gunnar Mills1214b7e2020-06-04 10:11:30 -050042 X509_STORE* x509Store = X509_STORE_new();
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050043 if (!x509Store)
44 {
Gunnar Millsc61704a2020-07-08 13:47:06 -050045 BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_new call";
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050046 return false;
47 }
48
49 // Load Certificate file into the X509 structure.
Gunnar Mills1214b7e2020-06-04 10:11:30 -050050 X509_STORE_CTX* storeCtx = X509_STORE_CTX_new();
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050051 if (!storeCtx)
52 {
Gunnar Millsc61704a2020-07-08 13:47:06 -050053 BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_new call";
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050054 X509_STORE_free(x509Store);
55 return false;
56 }
57
Ed Tanous99131cd2019-10-24 11:12:47 -070058 int errCode = X509_STORE_CTX_init(storeCtx, x509Store, cert, nullptr);
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050059 if (errCode != 1)
60 {
Gunnar Millsc61704a2020-07-08 13:47:06 -050061 BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_init call";
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050062 X509_STORE_CTX_free(storeCtx);
63 X509_STORE_free(x509Store);
64 return false;
65 }
66
67 errCode = X509_verify_cert(storeCtx);
68 if (errCode == 1)
69 {
70 BMCWEB_LOG_INFO << "Certificate verification is success";
71 X509_STORE_CTX_free(storeCtx);
72 X509_STORE_free(x509Store);
73 return true;
74 }
75 if (errCode == 0)
76 {
77 errCode = X509_STORE_CTX_get_error(storeCtx);
78 X509_STORE_CTX_free(storeCtx);
79 X509_STORE_free(x509Store);
80 if (isTrustChainError(errCode))
81 {
82 BMCWEB_LOG_DEBUG << "Ignoring Trust Chain error. Reason: "
83 << X509_verify_cert_error_string(errCode);
84 return true;
85 }
Ed Tanous3174e4d2020-10-07 11:41:22 -070086 BMCWEB_LOG_ERROR << "Certificate verification failed. Reason: "
87 << X509_verify_cert_error_string(errCode);
88 return false;
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050089 }
90
91 BMCWEB_LOG_ERROR
Gunnar Millsc61704a2020-07-08 13:47:06 -050092 << "Error occurred during X509_verify_cert call. ErrorCode: "
93 << errCode;
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050094 X509_STORE_CTX_free(storeCtx);
95 X509_STORE_free(x509Store);
96 return false;
97}
98
Gunnar Mills1214b7e2020-06-04 10:11:30 -050099inline bool verifyOpensslKeyCert(const std::string& filepath)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700100{
101 bool privateKeyValid = false;
102 bool certValid = false;
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800103
Ed Tanous1abe55e2018-09-05 08:30:59 -0700104 std::cout << "Checking certs in file " << filepath << "\n";
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800105
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500106 FILE* file = fopen(filepath.c_str(), "r");
Ed Tanous99131cd2019-10-24 11:12:47 -0700107 if (file != nullptr)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700108 {
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500109 EVP_PKEY* pkey = PEM_read_PrivateKey(file, nullptr, nullptr, nullptr);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700110 if (pkey != nullptr)
111 {
Patrick Williams145bb762021-12-07 21:05:04 -0600112#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500113 RSA* rsa = EVP_PKEY_get1_RSA(pkey);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700114 if (rsa != nullptr)
115 {
116 std::cout << "Found an RSA key\n";
117 if (RSA_check_key(rsa) == 1)
118 {
Jayanth Othayoth4d2849a2019-05-13 01:46:34 -0500119 privateKeyValid = true;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700120 }
121 else
122 {
123 std::cerr << "Key not valid error number "
124 << ERR_get_error() << "\n";
125 }
126 RSA_free(rsa);
127 }
128 else
129 {
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500130 EC_KEY* ec = EVP_PKEY_get1_EC_KEY(pkey);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700131 if (ec != nullptr)
132 {
133 std::cout << "Found an EC key\n";
134 if (EC_KEY_check_key(ec) == 1)
135 {
136 privateKeyValid = true;
137 }
138 else
139 {
140 std::cerr << "Key not valid error number "
141 << ERR_get_error() << "\n";
142 }
143 EC_KEY_free(ec);
144 }
145 }
Patrick Williams145bb762021-12-07 21:05:04 -0600146#else
Gunnar Mills91359f92022-01-04 14:50:18 -0600147 EVP_PKEY_CTX* pkeyCtx =
Patrick Williams145bb762021-12-07 21:05:04 -0600148 EVP_PKEY_CTX_new_from_pkey(nullptr, pkey, nullptr);
149
Gunnar Mills91359f92022-01-04 14:50:18 -0600150 if (!pkeyCtx)
Patrick Williams145bb762021-12-07 21:05:04 -0600151 {
Gunnar Mills91359f92022-01-04 14:50:18 -0600152 std::cerr << "Unable to allocate pkeyCtx " << ERR_get_error()
Patrick Williams145bb762021-12-07 21:05:04 -0600153 << "\n";
154 }
Gunnar Mills91359f92022-01-04 14:50:18 -0600155 else if (EVP_PKEY_check(pkeyCtx) == 1)
Patrick Williams145bb762021-12-07 21:05:04 -0600156 {
157 privateKeyValid = true;
158 }
159 else
160 {
161
162 std::cerr << "Key not valid error number " << ERR_get_error()
163 << "\n";
164 }
165#endif
Ed Tanous1abe55e2018-09-05 08:30:59 -0700166
167 if (privateKeyValid)
168 {
Ramesh Iyyarc0bf8932019-06-22 00:23:29 -0500169 // If the order is certificate followed by key in input file
170 // then, certificate read will fail. So, setting the file
171 // pointer to point beginning of file to avoid certificate and
172 // key order issue.
173 fseek(file, 0, SEEK_SET);
174
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500175 X509* x509 = PEM_read_X509(file, nullptr, nullptr, nullptr);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700176 if (x509 == nullptr)
177 {
178 std::cout << "error getting x509 cert " << ERR_get_error()
179 << "\n";
180 }
181 else
182 {
Ramesh Iyyar082f28f2019-06-22 03:31:55 -0500183 certValid = validateCertificate(x509);
184 X509_free(x509);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700185 }
186 }
187
Patrick Williams145bb762021-12-07 21:05:04 -0600188#if (OPENSSL_VERSION_NUMBER > 0x30000000L)
Gunnar Mills91359f92022-01-04 14:50:18 -0600189 EVP_PKEY_CTX_free(pkeyCtx);
Patrick Williams145bb762021-12-07 21:05:04 -0600190#endif
Ed Tanous1abe55e2018-09-05 08:30:59 -0700191 EVP_PKEY_free(pkey);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800192 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700193 fclose(file);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800194 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700195 return certValid;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800196}
197
Alan Kuoa8220702020-11-26 11:15:29 +0800198inline X509* loadCert(const std::string& filePath)
199{
200 BIO* certFileBio = BIO_new_file(filePath.c_str(), "rb");
201 if (!certFileBio)
202 {
203 BMCWEB_LOG_ERROR << "Error occured during BIO_new_file call, "
204 << "FILE= " << filePath;
205 return nullptr;
206 }
207
208 X509* cert = X509_new();
209 if (!cert)
210 {
211 BMCWEB_LOG_ERROR << "Error occured during X509_new call, "
212 << ERR_get_error();
213 BIO_free(certFileBio);
214 return nullptr;
215 }
216
217 if (!PEM_read_bio_X509(certFileBio, &cert, nullptr, nullptr))
218 {
219 BMCWEB_LOG_ERROR << "Error occured during PEM_read_bio_X509 call, "
220 << "FILE= " << filePath;
221
222 BIO_free(certFileBio);
223 X509_free(cert);
224 return nullptr;
225 }
Alan Kuob295bf92021-04-16 14:16:47 +0800226 BIO_free(certFileBio);
Alan Kuoa8220702020-11-26 11:15:29 +0800227 return cert;
228}
229
230inline int addExt(X509* cert, int nid, const char* value)
231{
232 X509_EXTENSION* ex = nullptr;
Ed Tanousb00dcc22021-02-23 12:52:50 -0800233 X509V3_CTX ctx{};
Alan Kuoa8220702020-11-26 11:15:29 +0800234 X509V3_set_ctx(&ctx, cert, cert, nullptr, nullptr, 0);
235 ex = X509V3_EXT_conf_nid(nullptr, &ctx, nid, const_cast<char*>(value));
236 if (!ex)
237 {
238 BMCWEB_LOG_ERROR << "Error: In X509V3_EXT_conf_nidn: " << value;
239 return -1;
240 }
241 X509_add_ext(cert, ex, -1);
242 X509_EXTENSION_free(ex);
243 return 0;
244}
245
246inline void generateSslCertificate(const std::string& filepath,
247 const std::string& cn)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700248{
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500249 FILE* pFile = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700250 std::cout << "Generating new keys\n";
251 initOpenssl();
Ed Tanous0fdddb12017-02-28 11:06:34 -0800252
Ed Tanous1abe55e2018-09-05 08:30:59 -0700253 std::cerr << "Generating EC key\n";
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500254 EVP_PKEY* pPrivKey = createEcKey();
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700255 if (pPrivKey != nullptr)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700256 {
257 std::cerr << "Generating x509 Certificate\n";
258 // Use this code to directly generate a certificate
Ed Tanous543f4402022-01-06 13:12:53 -0800259 X509* x509 = X509_new();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700260 if (x509 != nullptr)
261 {
262 // get a random number from the RNG for the certificate serial
263 // number If this is not random, regenerating certs throws broswer
264 // errors
Alan Kuoa8220702020-11-26 11:15:29 +0800265 bmcweb::OpenSSLGenerator gen;
266 std::uniform_int_distribution<int> dis(
267 1, std::numeric_limits<int>::max());
268 int serial = dis(gen);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800269
Ed Tanous1abe55e2018-09-05 08:30:59 -0700270 ASN1_INTEGER_set(X509_get_serialNumber(x509), serial);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800271
Ed Tanous1abe55e2018-09-05 08:30:59 -0700272 // not before this moment
273 X509_gmtime_adj(X509_get_notBefore(x509), 0);
274 // Cert is valid for 10 years
275 X509_gmtime_adj(X509_get_notAfter(x509),
276 60L * 60L * 24L * 365L * 10L);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800277
Ed Tanous1abe55e2018-09-05 08:30:59 -0700278 // set the public key to the key we just generated
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700279 X509_set_pubkey(x509, pPrivKey);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800280
Ed Tanous1abe55e2018-09-05 08:30:59 -0700281 // get the subject name
Ed Tanous543f4402022-01-06 13:12:53 -0800282 X509_NAME* name = X509_get_subject_name(x509);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800283
Ed Tanous1abe55e2018-09-05 08:30:59 -0700284 X509_NAME_add_entry_by_txt(
285 name, "C", MBSTRING_ASC,
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500286 reinterpret_cast<const unsigned char*>("US"), -1, -1, 0);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700287 X509_NAME_add_entry_by_txt(
288 name, "O", MBSTRING_ASC,
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500289 reinterpret_cast<const unsigned char*>("OpenBMC"), -1, -1, 0);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700290 X509_NAME_add_entry_by_txt(
291 name, "CN", MBSTRING_ASC,
Alan Kuoa8220702020-11-26 11:15:29 +0800292 reinterpret_cast<const unsigned char*>(cn.c_str()), -1, -1, 0);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700293 // set the CSR options
294 X509_set_issuer_name(x509, name);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800295
Alan Kuoa8220702020-11-26 11:15:29 +0800296 X509_set_version(x509, 2);
297 addExt(x509, NID_basic_constraints, ("critical,CA:TRUE"));
298 addExt(x509, NID_subject_alt_name, ("DNS:" + cn).c_str());
299 addExt(x509, NID_subject_key_identifier, ("hash"));
300 addExt(x509, NID_authority_key_identifier, ("keyid"));
301 addExt(x509, NID_key_usage, ("digitalSignature, keyEncipherment"));
302 addExt(x509, NID_ext_key_usage, ("serverAuth"));
303 addExt(x509, NID_netscape_comment, (x509Comment));
304
Ed Tanous1abe55e2018-09-05 08:30:59 -0700305 // Sign the certificate with our private key
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700306 X509_sign(x509, pPrivKey, EVP_sha256());
Ed Tanous0fdddb12017-02-28 11:06:34 -0800307
Ed Tanous1abe55e2018-09-05 08:30:59 -0700308 pFile = fopen(filepath.c_str(), "wt");
Ed Tanous0fdddb12017-02-28 11:06:34 -0800309
Ed Tanous1abe55e2018-09-05 08:30:59 -0700310 if (pFile != nullptr)
311 {
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700312 PEM_write_PrivateKey(pFile, pPrivKey, nullptr, nullptr, 0,
Ed Tanous99131cd2019-10-24 11:12:47 -0700313 nullptr, nullptr);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800314
Ed Tanous1abe55e2018-09-05 08:30:59 -0700315 PEM_write_X509(pFile, x509);
316 fclose(pFile);
Ed Tanous99131cd2019-10-24 11:12:47 -0700317 pFile = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700318 }
Ed Tanous0fdddb12017-02-28 11:06:34 -0800319
Ed Tanous1abe55e2018-09-05 08:30:59 -0700320 X509_free(x509);
321 }
322
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700323 EVP_PKEY_free(pPrivKey);
324 pPrivKey = nullptr;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800325 }
326
Ed Tanous1abe55e2018-09-05 08:30:59 -0700327 // cleanup_openssl();
Ed Tanous99923322017-03-03 14:21:24 -0800328}
Ed Tanousb01bf292019-03-25 19:25:26 +0000329
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500330EVP_PKEY* createEcKey()
Ed Tanousb01bf292019-03-25 19:25:26 +0000331{
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500332 EVP_PKEY* pKey = nullptr;
Patrick Williamsaec70662021-12-13 16:55:46 -0600333
334#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
Ed Tanousb01bf292019-03-25 19:25:26 +0000335 int eccgrp = 0;
Vernon Maueryaaf32062020-03-09 10:41:31 -0700336 eccgrp = OBJ_txt2nid("secp384r1");
Ed Tanous6ea007a2019-02-13 22:48:25 -0800337
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500338 EC_KEY* myecc = EC_KEY_new_by_curve_name(eccgrp);
Ed Tanousb01bf292019-03-25 19:25:26 +0000339 if (myecc != nullptr)
Ed Tanous6ea007a2019-02-13 22:48:25 -0800340 {
Ed Tanousb01bf292019-03-25 19:25:26 +0000341 EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE);
342 EC_KEY_generate_key(myecc);
343 pKey = EVP_PKEY_new();
344 if (pKey != nullptr)
345 {
346 if (EVP_PKEY_assign_EC_KEY(pKey, myecc))
347 {
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700348 /* pKey owns myecc from now */
Ed Tanousb01bf292019-03-25 19:25:26 +0000349 if (EC_KEY_check_key(myecc) <= 0)
350 {
351 fprintf(stderr, "EC_check_key failed.\n");
352 }
353 }
354 }
Ed Tanous6ea007a2019-02-13 22:48:25 -0800355 }
Patrick Williamsaec70662021-12-13 16:55:46 -0600356#else
357 // Create context for curve parameter generation.
358 std::unique_ptr<EVP_PKEY_CTX, decltype(&::EVP_PKEY_CTX_free)> ctx{
359 EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr), &::EVP_PKEY_CTX_free};
360 if (!ctx)
361 {
362 return nullptr;
363 }
364
365 // Set up curve parameters.
366 EVP_PKEY* params = nullptr;
367 if ((EVP_PKEY_paramgen_init(ctx.get()) <= 0) ||
368 (EVP_PKEY_CTX_set_ec_param_enc(ctx.get(), OPENSSL_EC_NAMED_CURVE) <=
369 0) ||
370 (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx.get(), NID_secp384r1) <=
371 0) ||
372 (EVP_PKEY_paramgen(ctx.get(), &params) <= 0))
373 {
374 return nullptr;
375 }
376
377 // Set up RAII holder for params.
378 std::unique_ptr<EVP_PKEY, decltype(&::EVP_PKEY_free)> pparams{
379 params, &::EVP_PKEY_free};
380
381 // Set new context for key generation, using curve parameters.
382 ctx.reset(EVP_PKEY_CTX_new_from_pkey(nullptr, params, nullptr));
383 if (!ctx || (EVP_PKEY_keygen_init(ctx.get()) <= 0))
384 {
385 return nullptr;
386 }
387
388 // Generate key.
389 if (EVP_PKEY_keygen(ctx.get(), &pKey) <= 0)
390 {
391 return nullptr;
392 }
393#endif
394
Ed Tanous1abe55e2018-09-05 08:30:59 -0700395 return pKey;
396}
397
398void initOpenssl()
399{
Ed Tanous911ac312017-08-15 09:37:42 -0700400#if OPENSSL_VERSION_NUMBER < 0x10100000L
Ed Tanous1abe55e2018-09-05 08:30:59 -0700401 SSL_load_error_strings();
402 OpenSSL_add_all_algorithms();
403 RAND_load_file("/dev/urandom", 1024);
Ed Tanousa1e077c2017-04-25 12:42:19 -0700404#endif
Ed Tanous0fdddb12017-02-28 11:06:34 -0800405}
406
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500407inline void ensureOpensslKeyPresentAndValid(const std::string& filepath)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700408{
409 bool pemFileValid = false;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800410
Ed Tanous1abe55e2018-09-05 08:30:59 -0700411 pemFileValid = verifyOpensslKeyCert(filepath);
Ed Tanous1ccd57c2017-03-21 13:15:58 -0700412
Ed Tanous1abe55e2018-09-05 08:30:59 -0700413 if (!pemFileValid)
414 {
415 std::cerr << "Error in verifying signature, regenerating\n";
Alan Kuoa8220702020-11-26 11:15:29 +0800416 generateSslCertificate(filepath, "testhost");
Ed Tanous1abe55e2018-09-05 08:30:59 -0700417 }
Ed Tanous0fdddb12017-02-28 11:06:34 -0800418}
Ed Tanousc4771fb2017-03-13 13:39:49 -0700419
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600420inline std::shared_ptr<boost::asio::ssl::context>
Ed Tanous81ce6092020-12-17 16:54:55 +0000421 getSslContext(const std::string& sslPemFile)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700422{
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600423 std::shared_ptr<boost::asio::ssl::context> mSslContext =
424 std::make_shared<boost::asio::ssl::context>(
425 boost::asio::ssl::context::tls_server);
426 mSslContext->set_options(boost::asio::ssl::context::default_workarounds |
427 boost::asio::ssl::context::no_sslv2 |
428 boost::asio::ssl::context::no_sslv3 |
429 boost::asio::ssl::context::single_dh_use |
430 boost::asio::ssl::context::no_tlsv1 |
431 boost::asio::ssl::context::no_tlsv1_1);
Ed Tanousc4771fb2017-03-13 13:39:49 -0700432
James Feist91243c32019-11-12 14:55:40 -0800433 // BIG WARNING: This needs to stay disabled, as there will always be
434 // unauthenticated endpoints
435 // mSslContext->set_verify_mode(boost::asio::ssl::verify_peer);
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200436
James Feist6a3e1822019-11-06 13:46:35 -0800437 SSL_CTX_set_options(mSslContext->native_handle(), SSL_OP_NO_RENEGOTIATION);
438
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200439 BMCWEB_LOG_DEBUG << "Using default TrustStore location: " << trustStorePath;
440 mSslContext->add_verify_path(trustStorePath);
441
Ed Tanous81ce6092020-12-17 16:54:55 +0000442 mSslContext->use_certificate_file(sslPemFile,
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600443 boost::asio::ssl::context::pem);
Ed Tanous81ce6092020-12-17 16:54:55 +0000444 mSslContext->use_private_key_file(sslPemFile,
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600445 boost::asio::ssl::context::pem);
Ed Tanousc4771fb2017-03-13 13:39:49 -0700446
Ed Tanous1abe55e2018-09-05 08:30:59 -0700447 // Set up EC curves to auto (boost asio doesn't have a method for this)
448 // There is a pull request to add this. Once this is included in an asio
449 // drop, use the right way
450 // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600451 if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700452 {
453 BMCWEB_LOG_ERROR << "Error setting tmp ecdh list\n";
454 }
Ed Tanousc4771fb2017-03-13 13:39:49 -0700455
Ed Tanous457207f2019-02-07 15:27:14 -0800456 std::string mozillaModern = "ECDHE-ECDSA-AES256-GCM-SHA384:"
457 "ECDHE-RSA-AES256-GCM-SHA384:"
458 "ECDHE-ECDSA-CHACHA20-POLY1305:"
459 "ECDHE-RSA-CHACHA20-POLY1305:"
460 "ECDHE-ECDSA-AES128-GCM-SHA256:"
461 "ECDHE-RSA-AES128-GCM-SHA256:"
462 "ECDHE-ECDSA-AES256-SHA384:"
463 "ECDHE-RSA-AES256-SHA384:"
464 "ECDHE-ECDSA-AES128-SHA256:"
465 "ECDHE-RSA-AES128-SHA256";
Ed Tanousc4771fb2017-03-13 13:39:49 -0700466
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600467 if (SSL_CTX_set_cipher_list(mSslContext->native_handle(),
Ed Tanous457207f2019-02-07 15:27:14 -0800468 mozillaModern.c_str()) != 1)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700469 {
470 BMCWEB_LOG_ERROR << "Error setting cipher list\n";
471 }
472 return mSslContext;
Ed Tanousc4771fb2017-03-13 13:39:49 -0700473}
Ed Tanous1abe55e2018-09-05 08:30:59 -0700474} // namespace ensuressl