| commit | 698a57435e5fb45b744e3a178f1dc3c7910e20da | [log] [tgz] |
|---|---|---|
| author | Willy Tu <wltu@google.com> | Fri Sep 23 21:33:01 2022 +0000 |
| committer | Willy Tu <wltu@google.com> | Tue Oct 18 19:05:06 2022 +0000 |
| tree | de27766ab7388b73d89bc4566e3491e956c1bf8a | |
| parent | 6f45ce04b88117364e7452fae92565993a70df02 [diff] |
Move Certificate install in resotre path to DEBUG
We are seeing 387+ `Certificate install` messages for a single boot in
the journal log.
Moved the `Certifacte install` log for the restore path to DEBUG instead
of INFO to remove it on the normal jorunal logs.
Tested:
```
systemctl status phosphor-certificate-manager@bmcweb.service
* phosphor-certificate-manager@bmcweb.service - Phosphor certificate manager for bmcweb
Loaded: loaded (/lib/systemd/system/phosphor-certificate-manager@.service; static)
Active: active (running) since Fri 2018-03-09 19:19:02 UTC; 24s ago
Main PID: 25773 (phosphor-certif)
CGroup: /system.slice/system-phosphor\x2dcertificate\x2dmanager.slice/phosphor-certificate-manager@bmcweb.service
`-25773 /usr/bin/phosphor-certificate-manager --endpoint https --path /path/server.pem --type server --unit server_creds.target
Mar 09 19:19:02 [hostname] systemd[1]: Started Phosphor certificate manager for bmcweb.
Mar 09 19:19:03 [hostname] phosphor-certificate-manager[25773]: Error occurred during X509_verify_cert call, checking for known error
Mar 09 19:19:03 [hostname] phosphor-certificate-manager[25773]: Certificate compareKeys
Mar 09 19:19:03 [hostname] phosphor-certificate-manager[25773]: Certificate install
...
```
Change-Id: I907afd6ce4522e5c54348d16c1ace0a770f3b8f1
Signed-off-by: Willy Tu <wltu@google.com>
Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.
This project can be built with meson. The typical meson workflow is: meson builddir && ninja -C builddir.
Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.
Usage: ./phosphor-certificate-manager [options]
Options:
--help Print this menu
--type certificate type
Valid types: client,server,authority
--endpoint d-bus endpoint
--path certificate file path
--unit=<name> Optional systemd unit need to reload
Purpose: Server https certificate
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
Purpose: Client certificate validation
./phosphor-certificate-manager --type=authority --endpoint=ldap \ --path=/etc/ssl/certs/authority --unit=bmcweb.service
Purpose: LDAP client certificate validation
./phosphor-certificate-manager --type=client --endpoint=ldap \ --path=/etc/nslcd/certs/cert.pem
phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.
D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".
Take https certificate management as an example.
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".
OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.