| commit | 8dd31c809a18b888d84e5563c7ba99e4ada2c7c9 | [log] [tgz] |
|---|---|---|
| author | Adriana Kobylak <anoo@us.ibm.com> | Tue Nov 29 14:44:07 2022 -0600 |
| committer | Adriana Kobylak <anoo@linux.ibm.com> | Fri Dec 02 21:04:27 2022 +0000 |
| tree | cad36e54c45d8deecd2ee636d6755d47f3b6a867 | |
| parent | 698a57435e5fb45b744e3a178f1dc3c7910e20da [diff] |
bmc-vmi-ca: Fix executable name
The executable name expected by the bmc-vmi-ca-manager.service file is
bmc-vmi-ca, but when the repo was updated to use meson, the file name
was mistakenly set to bmc_vmi_ca.
Tested: Verified the service started successfully in p10bmc:
```
root@p10bmc:~# systemctl status bmc-vmi-ca-manager
* bmc-vmi-ca-manager.service - BMC VMI CA authority manager
Loaded: loaded
(8;;file://p10bmc/lib/systemd/system/bmc-vmi-ca-manager.service/lib/systemd/system/bmc-vmi-ca-manager.service8;;;
enabled; preset: enabled)
Active: active (running) since Thu 2022-12-01 20:45:46 UTC; 1min
44s ago
Main PID: 236 (bmc-vmi-ca)
CPU: 6ms
CGroup: /system.slice/bmc-vmi-ca-manager.service
`-236 /usr/bin/bmc-vmi-ca
Dec 01 20:45:45 p10bmc systemd[1]: Starting BMC VMI CA authority
manager...
Dec 01 20:45:46 p10bmc systemd[1]: Started BMC VMI CA authority manager.
```
Change-Id: Id32c79a470255e6818d46e27cab82e17fc10c4f4
Signed-off-by: Adriana Kobylak <anoo@us.ibm.com>
Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.
This project can be built with meson. The typical meson workflow is: meson builddir && ninja -C builddir.
Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.
Usage: ./phosphor-certificate-manager [options]
Options:
--help Print this menu
--type certificate type
Valid types: client,server,authority
--endpoint d-bus endpoint
--path certificate file path
--unit=<name> Optional systemd unit need to reload
Purpose: Server https certificate
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
Purpose: Client certificate validation
./phosphor-certificate-manager --type=authority --endpoint=ldap \ --path=/etc/ssl/certs/authority --unit=bmcweb.service
Purpose: LDAP client certificate validation
./phosphor-certificate-manager --type=client --endpoint=ldap \ --path=/etc/nslcd/certs/cert.pem
phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.
D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".
Take https certificate management as an example.
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".
OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.