Gitiles
Code Review Sign In
gerrit.openbmc.org / openbmc / phosphor-certificate-manager / 11d09066d751d3deeb08cf63880b9a4c09b4f958
commit11d09066d751d3deeb08cf63880b9a4c09b4f958[log] [tgz]
authorRavi Teja <raviteja28031990@gmail.com>Tue Apr 20 11:52:42 2021 -0500
committerRavi Teja <raviteja28031990@gmail.com>Mon Apr 26 10:39:33 2021 -0500
tree110e8cc2e408ed57965d18212b5b958268834421
parentebd1d8a8294659c788e2822ddee1ca923791c531 [diff]
CA Certs: Modify object entry path to fix object sub-tree hierarchy

Currently there is no interface added signal generated as object
path is not following hierarchy.

to fix this behaviour, this commit modifies object entry path
to /xyz/openbmc_project/certs/ca/entry/<id>
InterfacesAdded signal:

signal time=1619111735.917791 sender=:1.660 -> destination=(null destination)
 serial=68 path=/xyz/openbmc_project/certs/ca; interface=org.freedesktop.DBus.ObjectManager;
  member=InterfacesAdded
   object path "/xyz/openbmc_project/certs/ca/entry/6"

Tested by:
D-bus monitor while Creating dbus objects

Signed-off-by: Ravi Teja <raviteja28031990@gmail.com>
Change-Id: I3ce8aa2b2ec5da321557ea40f484ea2947d57442
1 file changed
tree: 110e8cc2e408ed57965d18212b5b958268834421
  1. bmc-vmi-ca/
  2. test/
  3. .clang-format
  4. .gitignore
  5. .lcovrc
  6. argument.cpp
  7. argument.hpp
  8. bootstrap.sh
  9. certificate.cpp
  10. certificate.hpp
  11. certs_manager.cpp
  12. certs_manager.hpp
  13. configure.ac
  14. csr.cpp
  15. csr.hpp
  16. LICENSE
  17. mainapp.cpp
  18. MAINTAINERS
  19. Makefile.am
  20. Makefile.am.include
  21. README.md
  22. watch.cpp
  23. watch.hpp
README.md

phosphor-certificate-manager

Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.

To Build

To build this package, do the following steps:

    1. ./bootstrap.sh
    2. ./configure ${CONFIGURE_FLAGS}
    3. make

To clean the repository run `./bootstrap.sh clean`.

To Run

Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.

Usage: ./phosphor-certificate-manager [options]
Options:
    --help            Print this menu
    --type            certificate type
                      Valid types: client,server,authority
    --endpoint        d-bus endpoint
    --path            certificate file path
    --unit=<name>     Optional systemd unit need to reload

Https certificate management

Purpose: Server https certificate

./phosphor-certificate-manager --type=server --endpoint=https \
    --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service

CA certificate management

Purpose: Client certificate validation

./phosphor-certificate-manager --type=authority --endpoint=ldap \
    --path=/etc/ssl/certs/authority --unit=bmcweb.service

LDAP client certificate management

Purpose: LDAP client certificate validation

./phosphor-certificate-manager --type=client --endpoint=ldap \
    --path=/etc/nslcd/certs/cert.pem

D-Bus Interface

phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.

D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".

Take https certificate management as an example.

./phosphor-certificate-manager --type=server --endpoint=https \
    --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service

D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".

Usage in openbmc/bmcweb

OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.