commit | 798dca541c5d582d43fc953b0768a5aa2b009be5 | [log] [tgz] |
---|---|---|
author | Ravi Teja <raviteja28031990@gmail.com> | Sun Mar 24 14:00:07 2024 -0500 |
committer | Ravi Teja <raviteja28031990@gmail.com> | Sun Mar 24 19:30:03 2024 +0000 |
tree | 9136183a6a1bece65b199bd7cb5b1fe0e48b20f2 | |
parent | 8dbcc72d55f007c43c504ee98e40f352e996426f [diff] |
GenerateCSR: Avoid setting CSR version Latest openssl displays as unknown version while parsing BMC generated CSRs over openssl command line As per openssl discussion in this issue, by default CSR version set to 1 https://github.com/openssl/openssl/issues/20663 The only defined CSR version is X509_REQ_VERSION_1, so there is no need to call X509_REQ_set_version() to set version explicitly This commit avoids calling X509_REQ_set_version() to set CSR version Tested By: 1.Generate CSR using redfish interface 2.Parse csr using openssl and check version openssl req -in csr.txt -noout -text Certificate Request: Data: Version: 1 (0x0) Change-Id: I29dfc50e661d39fe7930d65079abfee924745d21 Signed-off-by: Ravi Teja <raviteja28031990@gmail.com>
Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.
This project can be built with meson
. The typical meson
workflow is: meson builddir && ninja -C builddir
.
Multiple instances of phosphor-certificate-manager
are usually run on the bmc to support management of different types of certificates.
Usage: ./phosphor-certificate-manager [options] Options: --help Print this menu --type certificate type Valid types: client,server,authority --endpoint d-bus endpoint --path certificate file path --unit=<name> Optional systemd unit need to reload
Purpose: Server https certificate
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
Purpose: Client certificate validation
./phosphor-certificate-manager --type=authority --endpoint=truststore \ --path=/etc/ssl/certs/authority --unit=bmcweb.service
Purpose: LDAP client certificate validation
./phosphor-certificate-manager --type=client --endpoint=ldap \ --path=/etc/nslcd/certs/cert.pem
phosphor-certificate-manager
is an implementation of the D-Bus interface defined in this document.
D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".
Take https certificate management as an example.
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".
OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager
via D-Bus.