| commit | 8dbcc72d55f007c43c504ee98e40f352e996426f | [log] [tgz] |
|---|---|---|
| author | Andrew Geissler <geissonator@yahoo.com> | Fri Dec 08 10:15:42 2023 -0600 |
| committer | Andrew Geissler <geissonator@yahoo.com> | Fri Dec 08 10:25:14 2023 -0600 |
| tree | 69c28ccaa40c877f96a0357f6ff6c5a31e423881 | |
| parent | 50b5009a550ca61c946979bbafc5bfd61827a8f9 [diff] |
certs_manager: log all OpenSSL errors on failure I've been hitting intermittent fails in this code running simulation with my system1 machine. ``` Sep 20 11:23:29 system1 phosphor-certificate-manager[237]: Error occurred during generate EC key Sep 20 11:23:29 system1 phosphor-certificate-manager[237]: The operation failed internally. Sep 20 11:23:29 system1 phosphor-certificate-manager[237]: The operation failed internally. ``` This code path logs an InternalError, which causes a BMC dump to get generated. That dump causes the automated CI tests to fail. The fail only occurs 1 out of every 10 runs and there's not currently enough info to debug the cause of the fail. I think it may have to do with the network or time being reconfigured during the same time the certificate code is running but I have no evidence. Doing some internet searching, it seems this ERR_print_errors_fp() call is the recommended way to collect any debug info from OpenSSL libraries. https://www.openssl.org/docs/man1.1.1/man3/ERR_print_errors_fp.html Tested: - Unfortunately I can not recreate this issue manually so all I've been able to test is that this builds and does not affect the good path. Change-Id: I373b8f481f393b3e783c1a0270c8f6f729c426a5 Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.
This project can be built with meson. The typical meson workflow is: meson builddir && ninja -C builddir.
Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.
Usage: ./phosphor-certificate-manager [options] Options: --help Print this menu --type certificate type Valid types: client,server,authority --endpoint d-bus endpoint --path certificate file path --unit=<name> Optional systemd unit need to reload
Purpose: Server https certificate
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
Purpose: Client certificate validation
./phosphor-certificate-manager --type=authority --endpoint=truststore \ --path=/etc/ssl/certs/authority --unit=bmcweb.service
Purpose: LDAP client certificate validation
./phosphor-certificate-manager --type=client --endpoint=ldap \ --path=/etc/nslcd/certs/cert.pem
phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.
D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".
Take https certificate management as an example.
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".
OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.