Gitiles
Code Review Sign In
gerrit.openbmc.org / openbmc / phosphor-certificate-manager / 2e8ef4ce43975acfec7720683b8c7d721926c398
commit2e8ef4ce43975acfec7720683b8c7d721926c398[log] [tgz]
authorGeorge Liu <liuxiwei@inspur.com>Wed Aug 16 09:52:07 2023 +0800
committerGeorge Liu <liuxiwei@inspur.com>Wed Aug 16 09:52:07 2023 +0800
tree37b5d1d8be7e323d443e69deec5ed2e14c2a1ecb
parent23778dd40421d6cfe73c4774442e901f66d44b33 [diff]
meson_options.txt: Support for reading options from meson.options

Support has been added for reading options from meson.options instead
of meson_options.txt[1]. These are equivalent, but not using the .txt
extension for a build file has a few advantages, chief among them
many tools and text editors expect a file with the .txt extension to
be plain text files, not build scripts.

[1] https://mesonbuild.com/Release-notes-for-1-1-0.html#support-for-reading-options-from-mesonoptions

Signed-off-by: George Liu <liuxiwei@inspur.com>
Change-Id: I9c44f30404cd5437429845d22a8062a984ea9905
1 file changed
tree: 37b5d1d8be7e323d443e69deec5ed2e14c2a1ecb
  1. bmc-vmi-ca/
  2. dist/
  3. subprojects/
  4. test/
  5. .clang-format
  6. .clang-tidy
  7. .gitignore
  8. .openbmc-enforce-gitlint
  9. argument.cpp
  10. argument.hpp
  11. certificate.cpp
  12. certificate.hpp
  13. certs_manager.cpp
  14. certs_manager.hpp
  15. config.h.in
  16. csr.cpp
  17. csr.hpp
  18. LICENSE
  19. mainapp.cpp
  20. meson.build
  21. meson.options
  22. OWNERS
  23. README.md
  24. watch.cpp
  25. watch.hpp
  26. x509_utils.cpp
  27. x509_utils.hpp
README.md

phosphor-certificate-manager

Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.

To Build

This project can be built with meson. The typical meson workflow is: meson builddir && ninja -C builddir.

To Run

Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.

Usage: ./phosphor-certificate-manager [options]
Options:
    --help            Print this menu
    --type            certificate type
                      Valid types: client,server,authority
    --endpoint        d-bus endpoint
    --path            certificate file path
    --unit=<name>     Optional systemd unit need to reload

Https certificate management

Purpose: Server https certificate

./phosphor-certificate-manager --type=server --endpoint=https \
    --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service

CA certificate management

Purpose: Client certificate validation

./phosphor-certificate-manager --type=authority --endpoint=ldap \
    --path=/etc/ssl/certs/authority --unit=bmcweb.service

LDAP client certificate management

Purpose: LDAP client certificate validation

./phosphor-certificate-manager --type=client --endpoint=ldap \
    --path=/etc/nslcd/certs/cert.pem

D-Bus Interface

phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.

D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".

Take https certificate management as an example.

./phosphor-certificate-manager --type=server --endpoint=https \
    --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service

D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".

Usage in openbmc/bmcweb

OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.