Gitiles
Code Review Sign In
gerrit.openbmc.org / openbmc / phosphor-certificate-manager / b4ac23d003f99ee98e4e1d8892ef8c12b90cdf33
commitb4ac23d003f99ee98e4e1d8892ef8c12b90cdf33[log] [tgz]
authorPatrick Williams <patrick@stwcx.xyz>Wed Jul 09 11:27:37 2025 -0400
committerPatrick Williams <patrick@stwcx.xyz>Wed Jul 09 11:27:37 2025 -0400
tree83763b9533eb33466778c58f03095c3d91369df2
parent48aab98b3e2011f0bfe08295ea8bf75ad2ca66f7 [diff]
meson: use non-deprecated systemd packageconfig

Systemd's packageconfig file has both `systemdsystemunitdir` and
`systemd_system_unit_dir` defined.  The non-underscore one appears
to be a deprecated alias[1].  Move to the non-deprecated /
underscore-separated variant.

[1]: https://github.com/systemd/systemd/commit/4908de44b0a0409f84a7cdc5641b114d6ce8ba03

Change-Id: I32655dc4957456c121da4a5362abe4958d1e95ee
Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
1 file changed
tree: 83763b9533eb33466778c58f03095c3d91369df2
  1. bmc-vmi-ca/
  2. dist/
  3. subprojects/
  4. test/
  5. .clang-format
  6. .gitignore
  7. .openbmc-enforce-gitlint
  8. argument.cpp
  9. argument.hpp
  10. certificate.cpp
  11. certificate.hpp
  12. certs_manager.cpp
  13. certs_manager.hpp
  14. config.h.in
  15. csr.cpp
  16. csr.hpp
  17. LICENSE
  18. mainapp.cpp
  19. meson.build
  20. meson.options
  21. OWNERS
  22. README.md
  23. watch.cpp
  24. watch.hpp
  25. x509_utils.cpp
  26. x509_utils.hpp
README.md

phosphor-certificate-manager

Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.

To Build

This project can be built with meson. The typical meson workflow is: meson builddir && ninja -C builddir.

To Run

Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.

Usage: ./phosphor-certificate-manager [options]
Options:
    --help            Print this menu
    --type            certificate type
                      Valid types: client,server,authority
    --endpoint        d-bus endpoint
    --path            certificate file path
    --unit=<name>     Optional systemd unit need to reload

Https certificate management

Purpose: Server https certificate

./phosphor-certificate-manager --type=server --endpoint=https \
    --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service

CA certificate management

Purpose: Client certificate validation

./phosphor-certificate-manager --type=authority --endpoint=truststore \
    --path=/etc/ssl/certs/authority --unit=bmcweb.service

LDAP client certificate management

Purpose: LDAP client certificate validation

./phosphor-certificate-manager --type=client --endpoint=ldap \
    --path=/etc/nslcd/certs/cert.pem

D-Bus Interface

phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.

D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".

Take https certificate management as an example.

./phosphor-certificate-manager --type=server --endpoint=https \
    --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service

D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".

Usage in openbmc/bmcweb

OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.