remove year 2038 check

https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/49188 resolves
the year 2038 problem in BMCWeb. There's no need to check it in
cert-manager anymore. However, the current Cert interface can't take
certificate whose NotBefore is before the Unix Epoch given the
timestamp is uint64_t. So this change adds the check to return
errors in this case.

This change also fixed the existing issue of setting unix epoch.

TESTED: unit tests + QEMU
1. added a cert that's valid from 1970/01/01 to 9999/12/31 into
 unit tests
2. tested the dbus properties in QEMU after installing the above
 cert;

```
.ValidNotAfter                        property  t         253402300799                             emits-change writable
.ValidNotBefore                       property  t         0                                        emits-change writable
```
This is expected.

Signed-off-by: Nan Zhou <nanzhoumails@gmail.com>
Change-Id: Idc6b7721fc84b6b9022467e6b0c9e1984f682912
3 files changed
tree: e1643fc3290a36db3e66f20487eb59a62f9f6bbc
  1. bmc-vmi-ca/
  2. dist/
  3. subprojects/
  4. test/
  5. .clang-format
  6. .gitignore
  7. .lcovrc
  8. argument.cpp
  9. argument.hpp
  10. certificate.cpp
  11. certificate.hpp
  12. certs_manager.cpp
  13. certs_manager.hpp
  14. config.h.in
  15. csr.cpp
  16. csr.hpp
  17. LICENSE
  18. mainapp.cpp
  19. MAINTAINERS
  20. meson.build
  21. meson_options.txt
  22. OWNERS
  23. README.md
  24. watch.cpp
  25. watch.hpp
README.md

phosphor-certificate-manager

Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.

To Build

This project can be built with meson. The typical meson workflow is: meson builddir && ninja -C builddir.

To Run

Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.

Usage: ./phosphor-certificate-manager [options]
Options:
    --help            Print this menu
    --type            certificate type
                      Valid types: client,server,authority
    --endpoint        d-bus endpoint
    --path            certificate file path
    --unit=<name>     Optional systemd unit need to reload

Https certificate management

Purpose: Server https certificate

./phosphor-certificate-manager --type=server --endpoint=https \
    --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service

CA certificate management

Purpose: Client certificate validation

./phosphor-certificate-manager --type=authority --endpoint=ldap \
    --path=/etc/ssl/certs/authority --unit=bmcweb.service

LDAP client certificate management

Purpose: LDAP client certificate validation

./phosphor-certificate-manager --type=client --endpoint=ldap \
    --path=/etc/nslcd/certs/cert.pem

D-Bus Interface

phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.

D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".

Take https certificate management as an example.

./phosphor-certificate-manager --type=server --endpoint=https \
    --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service

D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".

Usage in openbmc/bmcweb

OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.