| commit | 2e8fa88e24d83a061bd7a40b6c222956b85c640a | [log] [tgz] |
|---|---|---|
| author | Michal Orzel <michalx.orzel@intel.com> | Thu Jul 27 13:14:56 2023 +0200 |
| committer | Michal Orzel <michalx.orzel@intel.com> | Tue Aug 29 09:24:23 2023 +0200 |
| tree | f6eaa5086602f6957b16f890c83142fdb10932a2 | |
| parent | 2e8ef4ce43975acfec7720683b8c7d721926c398 [diff] |
config: Change authority D-Bus names
Initially CA certificate management service was intended to support only
LDAP usecases. However since some time this has become outdated, as
certificates stored there might serve more purposes, such as SSL
handshakes or mTLS connections. Therefore, I'm proposing to change
service endpoint name from 'ldap' to something more generic, in order to
avoid any confusion, that could come up when developing applications
would like to utilize this feature.
Tested:
Service present on DBus under new name, along with proper object paths.
root@bmc-maca4bf018cd442:~# busctl list | grep phosphor-cert
...
xyz.openbmc_project.Certs.Manager.Authority.Truststore 256 phosphor-certif root :1.15 phosphor-certificate-manager@authority.service - -
...
root@bmc-maca4bf018cd442:~# busctl tree xyz.openbmc_project.Certs.Manager.Authority.Truststore
`-/xyz
`-/xyz/openbmc_project
`-/xyz/openbmc_project/certs
`-/xyz/openbmc_project/certs/authority
`-/xyz/openbmc_project/certs/authority/truststore
Change-Id: I1d2c4ef9e7b4846951ce4dd52f869d7c64f3902d
Signed-off-by: Michal Orzel <michalx.orzel@intel.com>
Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.
This project can be built with meson. The typical meson workflow is: meson builddir && ninja -C builddir.
Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.
Usage: ./phosphor-certificate-manager [options] Options: --help Print this menu --type certificate type Valid types: client,server,authority --endpoint d-bus endpoint --path certificate file path --unit=<name> Optional systemd unit need to reload
Purpose: Server https certificate
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
Purpose: Client certificate validation
./phosphor-certificate-manager --type=authority --endpoint=truststore \ --path=/etc/ssl/certs/authority --unit=bmcweb.service
Purpose: LDAP client certificate validation
./phosphor-certificate-manager --type=client --endpoint=ldap \ --path=/etc/nslcd/certs/cert.pem
phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.
D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".
Take https certificate management as an example.
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".
OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.