| commit | cf811c4309adbf164f6e040ea0216dbca7cf367f | [log] [tgz] |
|---|---|---|
| author | Nan Zhou <nanzhoumails@gmail.com> | Thu Dec 02 14:56:17 2021 -0800 |
| committer | Nan Zhou <nanzhoumails@gmail.com> | Thu Dec 16 14:51:47 2021 -0800 |
| tree | e1643fc3290a36db3e66f20487eb59a62f9f6bbc | |
| parent | e0e2cce95a5fad8431d4c40f81519447af8e701f [diff] |
remove year 2038 check https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/49188 resolves the year 2038 problem in BMCWeb. There's no need to check it in cert-manager anymore. However, the current Cert interface can't take certificate whose NotBefore is before the Unix Epoch given the timestamp is uint64_t. So this change adds the check to return errors in this case. This change also fixed the existing issue of setting unix epoch. TESTED: unit tests + QEMU 1. added a cert that's valid from 1970/01/01 to 9999/12/31 into unit tests 2. tested the dbus properties in QEMU after installing the above cert; ``` .ValidNotAfter property t 253402300799 emits-change writable .ValidNotBefore property t 0 emits-change writable ``` This is expected. Signed-off-by: Nan Zhou <nanzhoumails@gmail.com> Change-Id: Idc6b7721fc84b6b9022467e6b0c9e1984f682912
Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.
This project can be built with meson. The typical meson workflow is: meson builddir && ninja -C builddir.
Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.
Usage: ./phosphor-certificate-manager [options]
Options:
--help Print this menu
--type certificate type
Valid types: client,server,authority
--endpoint d-bus endpoint
--path certificate file path
--unit=<name> Optional systemd unit need to reload
Purpose: Server https certificate
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
Purpose: Client certificate validation
./phosphor-certificate-manager --type=authority --endpoint=ldap \ --path=/etc/ssl/certs/authority --unit=bmcweb.service
Purpose: LDAP client certificate validation
./phosphor-certificate-manager --type=client --endpoint=ldap \ --path=/etc/nslcd/certs/cert.pem
phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.
D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".
Take https certificate management as an example.
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".
OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.