summaryrefslogtreecommitdiffstats
path: root/base/ca
Commit message (Collapse)AuthorAgeFilesLines
* Add script to enable USN pluginAde Lee2016-04-152-4/+10
| | | | | | | | | | | | | | New authority monitor code requires the USN plugin to be enabled in the database to ensure that the entryUSN attribute is added to authority entries. In the case where this plugin was disabled, accessing this attribute resulted in a null pointer exception whch prevented server startup. The code has been changed so as not to throw a null pointer exception on startup if the entryusn is not present, and also to call an LDIF to enable the plugin when a subsystem is configured through pkispawn.
* Lightweight CAs: indicate when CA does not yet have keysFraser Tweedale2016-04-143-10/+31
| | | | | | | | | | When a lightweight CA is created, clones will initialise a local object when the LDAP replication takes place, however, the signing keys will not yet have been replicated. Therefore, indicate CA readiness in authority data and respond appropriately (HTTP 503) when signing operations are attempted. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: set DN based on data from LDAPFraser Tweedale2016-04-141-2/+9
| | | | | | | | | | | | When initialising a lightweight CA, if we do not have the signing cert and key in the NSSDB yet, we do not initialise the DN. This causes NPE in other code that expects getX500Name() to return a value, e.g. REST API to list or show CA. To work around this, when loading lightweight CAs set the DN based on the 'authorityDN' value stored in its LDAP entry. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: monitor database for changesFraser Tweedale2016-04-141-87/+342
| | | | | | | | | | | Implement a thread that performs an LDAP persistent search to keep a running CA's view of lightweight CAs in sync with the database. Signing key replication is not yet supported; this will be implemented in a later patch and will not use the database to propagate keys. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: extract LDAP commit/delete methodsFraser Tweedale2016-04-141-96/+116
| | | | | | | | | LDAP code to add, modify and delete authority entries exists in multiple places. Extract these methods to remove this duplication and provide a cleaner basis for upcoming implementation of replication handling. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: move host authority creation out of load methodFraser Tweedale2016-04-141-17/+25
| | | | | | | | To reduce the amount of code that would be run in the persistent search thread, extract the host authority entry creation out of the 'loadLightweightCAs' method, into 'CertificateAuthority.init'. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: avoid repeat definition of authorities DNFraser Tweedale2016-04-141-12/+11
| | | | Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: use static db connection factoryFraser Tweedale2016-04-141-15/+10
| | | | | | | Use a static database connection factory that is initialised by the host authority and used by all CertificateAuthority instances. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: add exceptions for missing signing key or certFraser Tweedale2016-04-142-7/+29
| | | | | | | | | | Add the CAMissingCertException and CAMissingKeyException classes and throw when signing unit initialisation fails due to a missing object. In CertificateAuthority, store the exception if it occurs for possible re-throwing later. Also add the private 'hasKeys' field for internal use. Part of: https://fedorahosted.org/pki/ticket/1625
* Fixed exception handling in CertificateAuthority.Endi S. Dewata2016-04-122-44/+48
| | | | | | | | The CertificateAuthority.getCACert() has been modified to re-throw the exception instead of ignoring it. All callers have been modified to bubble up the exception. https://fedorahosted.org/pki/ticket/1654
* Remove unused variables from profile classesFraser Tweedale2016-03-221-12/+1
| | | | | Also drive-by refactor 'createProfileData' to use 'getProfile', reducing code size.
* Do not leak status of certs issued by other CAsFraser Tweedale2016-03-031-1/+18
| | | | | | If an OCSP request includes CertIDs for certificates issued by multiple CAs, return 'unknown' CertStatus for all certificates not issued by the "signing" CA.
* Lightweight CAs: lookup correct issuer for OCSP responsesFraser Tweedale2016-03-031-1/+38
|
* Ticket #1963 CRL generation enters loop when CA loses connection to netHSM.Christina Fu2016-03-022-0/+80
| | | | | | | | | | | | | | | | | | | | | | | | | This patch makes a low risk attempt to slow down the loop that could be caused by an unexpected exception caused by the unavailability of a dependant component (e.g. HSM, LDAP) in the middle of CRL generation/update. New configuration parameters are: ca.crl.MasterCRL.unexpectedExceptionWaitTime - the wait time in minutes; default is 30 - normally you want it to be less than ca.crl.MasterCRL.autoUpdateInterval and ca.crl.MasterCRL.cacheUpdateInterval ca.crl.MasterCRL.unexpectedExceptionLoopMax - the max number of tries allowed before the slow down mechanism kicks in; default is 10 When such unexpected failure happens, a loop counter is kept and checked against the unexpectedExceptionLoopMax. If the loop counter exceeds the unexpectedExceptionLoopMax, then the current time is checked against the time of the failure, where the time lapse must exceed the unexpectedExceptionWaitTime to trigger a delay. This delay is the counter measure to mitigate the amount of log messages that could flood the log(s). The delay is calcuated like this: waitTime = mUnexpectedExceptionWaitTime - (now - timeOfUnexpectedFailure);
* Lightweight CAs: add audit eventsFraser Tweedale2016-03-012-23/+53
| | | | | | Add audit events for lightweight CA administration. Fixes: https://fedorahosted.org/pki/ticket/1590
* Lightweight CAs: enrol cert via profile subsystemFraser Tweedale2016-02-222-10/+61
| | | | | | | | | | | | Enrol new CA certs via the profile subsystem to ensure that the usual audit events are logged and to avoid the nasty ConfigStore hack used to generate the cert via CertUtil. This commit also fixes an issue where the new CA certificate does not have the correct Authority Key Identifier extension. Fixes: https://fedorahosted.org/pki/ticket/1624 Fixes: https://fedorahosted.org/pki/ticket/1632
* Lightweight CAs: ensure disabled CA cannot create sub-CAsFraser Tweedale2016-02-222-1/+5
| | | | Fixes: https://fedorahosted.org/pki/ticket/1628
* Remove vestiges of NISAuth pluginFraser Tweedale2016-02-162-517/+0
| | | | Fixes: https://fedorahosted.org/pki/ticket/1674
* Weaken PKIPrincipal to superclass in several placesFraser Tweedale2016-02-152-14/+22
| | | | | | | | | | In several places we are casting a `Principal' to `PKIPrincpal', when `GenericPrincpal' or even no cast will suffice. In upcoming external authentication support externally authenticated principals will not be instances of `PKIPrincipal', so weaken assumptions about type of the principal where possible. Part of: https://fedorahosted.org/pki/ticket/1359
* Use correct textual encoding for PKCS #7 objectsFraser Tweedale2016-02-155-10/+10
| | | | | | | | | | | PKCS #7 objects are being output with the "CERTIFICATE CHAIN" label which is invalid (RFC 7468) and unrecognised by many programs (including OpenSSL). Use the correct "PKCS7" label instead. Also do a drive-by refactor of the normalizeCertAndReq to remove some redundant code. Fixes: https://fedorahosted.org/pki/ticket/1699
* Profile service: respond 409 on conflicting operationsFraser Tweedale2016-02-151-7/+8
| | | | | | | | The REST profile service current responds 400 on conflicting operations, indicating that the client sent a bad request when this not the case. Respond with 409 Conflict instead. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1257518
* Remove obsolete catalina config filesFraser Tweedale2016-01-212-271/+0
|
* Avoid profile race conditions by tracking entryUSNFraser Tweedale2016-01-191-4/+8
| | | | | | | | | | | | | Avoid race conditions in the LDAPProfileSubsystem by tracking the most recently known entryUSN of profiles' LDAP entries. As part of this change, add the commitProfile method to the IProfileSubsystem interface, remove commit behaviour from the enableProfile and disableProfile methods and update ProfileService and ProfileApproveServlet to commit the profile (using the commitProfile method) where needed. Part of: https://fedorahosted.org/pki/ticket/1700
* Avoid superfluous ConfigStore commit during profile creationFraser Tweedale2015-11-261-2/+1
| | | | Part of: https://fedorahosted.org/pki/ticket/1700
* CRLIP: omit certs not issued by associated CAFraser Tweedale2015-10-211-4/+14
| | | | | | | | | | | | Lightweight CAs mean that a single database can include certificates from many issuers. Update CRLIssuingPoint to only include certificates issued by its associated CA. For backwards compatibility, if the associated CA is the host CA, certificate records with missing 'issuerName' attribute are also included. Fixes: https://fedorahosted.org/pki/ticket/1626
* Store issuer DN in certificate recordsFraser Tweedale2015-10-212-0/+10
| | | | | | | | Lightweight CAs mean that we may wish to filter certificates based on the issuer. Update X509CertImplMapper to store the issuer DN in each certificate record, using exiting schema. Also add indices for the 'issuerName' LDAP attribute.
* Ticket #1648 [RFE] provide separate cipher lists for CS instances acting as ↵Christina Fu2015-10-201-2/+4
| | | | client and server This patch provides subsystem->subsystem cipher configuration when acting as a client
* Lightweight CAs: implement deletion API and CLIFraser Tweedale2015-10-064-4/+109
| | | | | | | Implement lightweight authority deletion including CLI command. To be deleted an authority must be disabled and have no sub-CAs. Fixes: https://fedorahosted.org/pki/ticket/1324
* Fix compilation error in eclipse for caMapAde Lee2015-10-021-23/+23
|
* Ticket #1593 auto-shutdown - for HSM failover supportChristina Fu2015-10-012-0/+18
| | | | | | | | | | | | | | | This is an interim solution for supporting HSM failover by automatically shutting down the server when signing key becomes inaccessible. At auto-shutdown, a crumb fiile will be left in the instance directory for an external daemon to detect and restart, if necessary. Due to limitation of the watch dog (nuxwdog) at present time, the restart option currently only works if started with watch dog (nuxwdog), and it will prompt for passwords on the terminals. The restart counter is to prevent the server from going into an infinite restart loop. Administrator will have to reset autoShutdown.restart.count to 0 when max is reached. (cherry picked from commit 5a9ecad9172f76ca1b94b40aedcdd49d009aceb1)
* Refactored certificate processors.Endi S. Dewata2015-09-301-0/+2
| | | | | | | | | | | | | The CertProcessor.setCredentialsIntoContext() and CAProcessor. authenticate() methods have been modified such that they can accept credentials provided via the AuthCredentials (for REST services) or via the HttpServletRequest (for legacy servlets). The CertEnrollmentRequest has been modified to inherit from ResourceMessage such that REST clients can provide the credentials via request attributes. https://fedorahosted.org/pki/ticket/1463
* Lightweight CAs: fix caMap synchronizationFraser Tweedale2015-09-301-8/+9
| | | | | | | | | Some access to caMap was not correctly synchronized, with authorities (of which there could be many) acquiring their own intrinsic lock rather than the shared caMap. Use 'Collections.synchronizedSortedMap' to fix this. As a bonus, locking is now more fine-grained.
* Fixup for CS.cfg for authority featureAde Lee2015-09-281-1/+1
| | | | Set enable -> enabled
* Added Features REST API resourceAde Lee2015-09-272-0/+7
| | | | | | | | | This will help us track whether or not a server has a feature either offered or enabled. Ultimately, it could be used by an admin to enable or disable features. The Java client is not included in this commit. Will add in a subsequent commit.
* Lightweight CAs: REST cert request param to specify authorityFraser Tweedale2015-09-262-5/+40
| | | | | | | | Add the optional "ca" query parameter for REST cert request submission. Also update the ca-cert-request-submit CLI command with an option to provide an AuthorityID. Part of: https://fedorahosted.org/pki/ticket/1213
* Lightweight CAs: initial supportFraser Tweedale2015-09-2611-99/+968
| | | | | | | | | | | | | This commit adds initial support for "lightweight CAs" - CAs that inhabit an existing CA instance and share the request queue and certificate database of the "top-level CA". We initially support only sub-CAs under the top-level CA - either direct sub-CAs or nested. The general design will support hosting unrelated CAs but creation or import of unrelated CAs is not yet implemented. Part of: https://fedorahosted.org/pki/ticket/1213
* remove obsolete code from CertificateAuthority classFraser Tweedale2015-08-251-11/+0
|
* Internet Explorer 11 not working browser warning.Jack Magne2015-08-201-11/+38
| | | | | | | | | | | | Related to ticket #1575 Internet Explorer 11: caUserCert request submission fails using the EE page. This patch will only do the following: Detect IE when IE11 is being used. Before this IE11 was mistaken for Firefox. Detect IE11 specifically and warn the user that there is no support. This ticket will live to se we can fix this properly by porting the current VBS script to Javascript to support cert enrollment on IE 11.
* Ticket 1543 portalEnroll authentication does not load during creation from ↵Christina Fu2015-08-121-2/+0
| | | | | | | | | | | | | | Console It appears that the PortalEnroll plugin was never converted to work in the Profile Framework. This patch takes out the following line from CS.cfg: auths.impl.PortalEnroll.class=com.netscape.cms.authentication.PortalEnroll so that it cannot be instantiated from the console, nor manually in CS.cfg, unless explicitly put back in. While in CS.cfg.in, I found the NSSAuth auths.impl line having no real implementation, so I remove that too.
* Fixed missing query parameters in ListCerts page.Endi S. Dewata2015-08-122-0/+8
| | | | | | | | | The ListCerts servlet and the templates have been fixed to pass the skipRevoked and skipNonValid parameters to the subsequent page. Some debugging messages have been cleaned up as well. https://fedorahosted.org/pki/ticket/1538
* Ticket 1539 Unable to create ECC KRA Instance when kra admin key type is ECCChristina Fu2015-08-122-4/+4
| | | | | | This patch changes the relevant CA enrollment admin profiles so that they accept requests for EC certs. The issue actually not just affected KRA, it also affected other non-CA subsystems.
* Separate range and cert status threadsAde Lee2015-08-121-0/+5
| | | | | | | | | | | | | | We currently disable the cert status maintenance thread on clone CAs because CRL processing should only be done on the master CA. Currently, the maintenance thread also performs other checks on serial number ranges and settings. By disabling the maintenance thread, we disable these checks too. To fix this, we have separated the serial number checks into a different maintenance thread, so that these tasks will occur even if the cert status thread is disabled. Bugzilla # 1251606
* Fixed missing cert request hostname and address.Endi S. Dewata2015-08-051-10/+5
| | | | | | | | | | | | The CA services have been modified to inject request hostname and address into the certificate request object such that they will be stored in the database. This fixes the problem with requests submitted either via the UI or the CLI. An unused method in CertRequestResource has been removed. Some debug messages have been cleaned as well. https://fedorahosted.org/pki/ticket/1535
* remove extra space from Base 64 encoded cert displaysMatthew Harmsen2015-07-315-16/+16
| | | | | - PKI TRAC Ticket #1522 - CA UI adds extra space in Base 64 encoded certificate display
* Add code to reindex data during cloning without replicationAde Lee2015-07-312-0/+33
| | | | | | | | | | | | | When setting up a clone, indexes are added before the replication agreements are set up and the consumer is initialized. Thus, as data is replicated and added to the clone db, the data is indexed. When cloning is done with the replication agreements already set up and the data replicated, the existing data is not indexed and cannot be accessed in searches. The data needs to be reindexed. Related to ticket 1414
* Firefox warningJack Magne2015-07-312-6/+7
| | | | | | | | Ticket #1523 Move the dire warning about the crypto object to sections where it applies. Also slightly changed the message due to context.
* Removed audit CLI from non-TPS subsystems.Endi S. Dewata2015-07-171-4/+0
| | | | | | | | | | Due to database upgrade issue the pki <subsystem>-audit CLI has been removed from all subsystems except TPS. The AuditModifyCLI has been modified to clarify that the --action and the --input parameters are mutually exclusive. https://fedorahosted.org/pki/ticket/1437
* TPS add phone home URLs to pkidaemon status message.Jack Magne2015-07-161-277/+0
| | | | | | Ticket # 1466 . Also remove some needless copies of server.xml from the code.
* Fixed cert-find performance.Endi S. Dewata2015-07-151-20/+18
| | | | | | | | The CertService.searchCerts() has been modified to use the VLV properly to retrieve just the entries in the requested page, thus reducing the response time and memory requirement. Some classes have been modified to clean up the debugging logs.
* Fixed default cert-find filter.Endi S. Dewata2015-07-061-8/+8
| | | | | | | | To improve the performance the default LDAP filter generated by cert-find has been changed to (certStatus=*) to match an existing VLV index. https://fedorahosted.org/pki/ticket/1449
generated by cgit (git 2.34.1) at 2024-05-20 07:22:34 +0000