Gitiles
Code Review Sign In
gerrit.openbmc.org / openbmc / phosphor-certificate-manager / a7846b39b055212c08334de7a9834b06112f5cc4
commita7846b39b055212c08334de7a9834b06112f5cc4[log] [tgz]
authorPatrick Williams <patrick@stwcx.xyz>Thu Sep 02 06:05:15 2021 -0500
committerPatrick Williams <patrick@stwcx.xyz>Thu Sep 02 06:05:30 2021 -0500
tree2e539ca498d6d62be036460a5b25e2b85ca0e76e
parent6dd1c2ad86507202dd55c533559e253f846e99c8 [diff]
cleanup sdbus CAMELCASE define

The transition from e129be3b566a187f42e4ab45bccfb10d35dc3d71 is
complete, so clean up the old defines.

Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
Change-Id: Ia1570296370970999171cfa7c2c3aa7b16a8f32e
4 files changed
tree: 2e539ca498d6d62be036460a5b25e2b85ca0e76e
  1. bmc-vmi-ca/
  2. dist/
  3. test/
  4. .clang-format
  5. .gitignore
  6. .lcovrc
  7. argument.cpp
  8. argument.hpp
  9. bootstrap.sh
  10. certificate.cpp
  11. certificate.hpp
  12. certs_manager.cpp
  13. certs_manager.hpp
  14. configure.ac
  15. csr.cpp
  16. csr.hpp
  17. LICENSE
  18. mainapp.cpp
  19. MAINTAINERS
  20. Makefile.am
  21. Makefile.am.include
  22. README.md
  23. watch.cpp
  24. watch.hpp
README.md

phosphor-certificate-manager

Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.

To Build

To build this package, do the following steps:

    1. ./bootstrap.sh
    2. ./configure ${CONFIGURE_FLAGS}
    3. make

To clean the repository run `./bootstrap.sh clean`.

To Run

Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.

Usage: ./phosphor-certificate-manager [options]
Options:
    --help            Print this menu
    --type            certificate type
                      Valid types: client,server,authority
    --endpoint        d-bus endpoint
    --path            certificate file path
    --unit=<name>     Optional systemd unit need to reload

Https certificate management

Purpose: Server https certificate

./phosphor-certificate-manager --type=server --endpoint=https \
    --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service

CA certificate management

Purpose: Client certificate validation

./phosphor-certificate-manager --type=authority --endpoint=ldap \
    --path=/etc/ssl/certs/authority --unit=bmcweb.service

LDAP client certificate management

Purpose: LDAP client certificate validation

./phosphor-certificate-manager --type=client --endpoint=ldap \
    --path=/etc/nslcd/certs/cert.pem

D-Bus Interface

phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.

D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".

Take https certificate management as an example.

./phosphor-certificate-manager --type=server --endpoint=https \
    --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service

D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".

Usage in openbmc/bmcweb

OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.