summaryrefslogtreecommitdiffstats
path: root/base/ca
Commit message (Collapse)AuthorAgeFilesLines
...
* Lightweight CAs: add method to renew certificateFraser Tweedale2016-06-052-4/+147
| | | | | | | | | | | | | | | Add the CertificateAuthority.renewAuthority() method that creates and processes a renewal request for the lightweight CA's signing cert. The new certificate replaces the old certificate in the NSSDB and the serial number is stored in the 'authoritySerial' attribute. Clones observe when the 'authoritySerial' attribute has changed and update the certificate in their NSSDB, too. The renewal behaviour is available in the REST API as a POST to /ca/rest/authorities/<id>/renew. Fixes: https://fedorahosted.org/pki/ticket/2327
* Lightweight CAs: generalise subprocess-based key retrievalFraser Tweedale2016-06-032-12/+45
| | | | | | | | | | | | | The IPACustodiaKeyRetriever doesn't really do anything specific to IPA or Custodia; it merely executes a certain executable with a particular behavioural contract. Add support for passing configuration to KeyRetriever instances, and rename IPACustodiaKeyRetriever to ExternalProcessKeyRetriever, updating it to use the "executable" config property instead of a hardcoded filename. Part of: https://fedorahosted.org/pki/ticket/1625
* Retry failed key retrieval with backoffFraser Tweedale2016-06-031-14/+44
| | | | | | | If lightweight CA key retrieval fails, retry the retieval after a delay of 10 seconds initially, increasing thereafter. Fixes: https://fedorahosted.org/pki/ticket/2293
* Don't update obsolete CertificateAuthority after key retrievalFraser Tweedale2016-06-031-7/+24
| | | | | | | | | | | | | If additional LDAP events are processed for a lightweight CA while key retrieval proceeds in another thread, when retrieval is complete, the KeyRetrieverRunner reinitialises the signing unit of a stale object. Instead of holding onto a CertificateAuthority, hold onto the AuthorityID and look it up afresh when ready to reinitialise its SigningUnit. Part of: https://fedorahosted.org/pki/ticket/2293
* Limit key retrieval to a single thread per CAFraser Tweedale2016-06-031-6/+22
| | | | | | | | | | Before implementing lightweight CA key retrieval retry with exponential backoff, ensure that only one key retriever thread can execute at a time, for each CA. Also make SigningUnit initialisation (initSigUnit) synchronised. Part of: https://fedorahosted.org/pki/ticket/2293
* Return 410 Gone if target CA of request has been deletedFraser Tweedale2016-06-031-0/+7
| | | | | | | | | | When processing a request whose target CA has been deleted in between request submission and request approval, the server does not handle the CANotFoundException, resulting in response status 500. Catch the CANotFoundException and respond with status 410 Gone. Fixes: https://fedorahosted.org/pki/ticket/2332
* Lightweight CAs: remove NSSDB material when processing deletionFraser Tweedale2016-06-031-1/+17
| | | | | | | When processing a CA deletion that occurred on another clone, remove the CA's certificate and key from the local NSSDB. Fixes: https://fedorahosted.org/pki/ticket/2328
* Lightweight CAs: remove redundant deletePrivateKey invocationFraser Tweedale2016-06-031-14/+5
| | | | | | | | | When deleting lightweight CAs, the call to CryptoStore.deletePrivateKey() throws an exception because the preceding call to CryptoStore.deleteCert() also deletes the key. Remove the redundant call and add some commentary. Fixes: https://fedorahosted.org/pki/ticket/1640
* Fixed problem submitting renewal request.Endi S. Dewata2016-06-021-1/+0
| | | | | | | | | | | The RenewalProcessor.processRenewal() has been modified to get the serial number of the certificate to renew from the profile input in addition to the <SerialNumber> attribute and client certificate. The serialNum field in CertEnrollmentRequest has been modified to use CertId which accepts both decimal and hexadecimal value. https://fedorahosted.org/pki/ticket/999
* Ticket 1665 - Cert Revocation Reasons not being updated when on-holdChristina Fu2016-05-251-2/+15
| | | | | | | | | | | | | | This patch fixes the following areas: * In the CA, when revokeCert is called, make it possible to move from on_hold to revoke. * In the servlet that handles TPS revoke (DoRevokeTPS), make sure it allows the on_hold cert to be put in the bucket to be revoked. * there are a few minor fixes such as typos and one have to do with the populate method in SubjectDNInput.java needs better handling of subject in case it's null. Note: This patch does not make attempt to allow agents to revoke certs that are on_hold from agent interface. The search filter needs to be modified to allow that.
* Add revocation information to pki CLI output.Ade Lee2016-05-241-9/+15
| | | | | | | The date on which the certificate is revoked and the agent that revoked it is displayed now in cert-find and cert-show output. Ticket 1055
* Add parameters to disable cert or crl publishingAde Lee2016-05-242-22/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | Right now, if publishing is enabled, both CRLs and Cert publishing is enabled. This causes a bunch of spurious error messages on IPA servers as cert publishing is not configured. As it is impossible to determine if cert publishing is not desired or simply misconfigured, we provide options to explicitly disable either cert or crl publishing. Specifically: * to enable/disable both cert and crl publishing: ca.publish.enable = True/False This is the legacy behavior. * to enable CRL publishing only: ca.publish.enable = True ca.publish.cert.enable = False * to enable cert publishing only: ca.publish.enable = True ca.publish.crl.enable = False Ticket 2275
* Detect inability to submit ECC CSR on ChromeMatthew Harmsen2016-05-131-0/+11
| | | | - PKI TRAC Ticket #2306 - Chrome Can Not Submit EC Client Cert Requests
* Lightweight CAs: add issuer DN and serial to AuthorityDataFraser Tweedale2016-05-131-3/+15
| | | | | | | | Add issuer DN and serial number to the AuthorityData object, as read-only attributes. Values are displayed in the CLI, when present in the response data. Fixes: https://fedorahosted.org/pki/ticket/1618
* Added log messages for pre-op mode.Endi S. Dewata2016-05-131-7/+15
| | | | | | | To help troubleshooting the code has been modified to log more detailed information in pre-op mode. https://fedorahosted.org/pki/ticket/1654
* Added Chrome keygen warningMatthew Harmsen2016-05-121-4/+109
| | | | | - PKI TRAC Ticket #2323 - Firefox Warning appears in EE page launched from within Chrome
* Include issuer DN in CertDataInfoFraser Tweedale2016-05-101-0/+1
| | | | | | | | Now that Dogtag can host multiple CAs in a single instance, indicate the issuer DN in the CertDataInfo structure that is returned for certificate searches. Fixes: https://fedorahosted.org/pki/ticket/2322
* Add realm to requests coming in from CAAde Lee2016-05-092-33/+41
| | | | | | | | | | | | | | | | Requests to the KRA through the CA-KRA connector use the Enrollment Service. This has been modified to read and store any realm passed in. The realm can be added to the request by havibg the admin add a AuthzRealmDefault and AuthzRealmConstraint in a profile. At this point, all the constraint does is verify that the realm is one of a specified list of realms. More verification will be added in a subsequent patch. No attempt is made yet to allow users to specify the realm. This would need to be added as a ProfileInput. Part of Ticket 2041
* Added deployment parameters for number ranges.Endi S. Dewata2016-05-091-6/+6
| | | | | | | | | | | New deployment parameters have been added to customize the serial number range, request number range, and replica number range in CS.cfg during installation. The code that generates the CS.cfg has been moved closer to the code that generates the subsystem configuration folder. https://fedorahosted.org/pki/ticket/2278
* Renamed CS.cfg.in to CS.cfg.Endi S. Dewata2016-05-093-3/+1
| | | | | | | | The CS.cfg.in have been renamed to CS.cfg to clean up the CMake scripts and for consistency. This change does not affect the actual files shipped in the RPM packages. https://fedorahosted.org/pki/ticket/2278
* Lightweight CAs: accept "host-authority" as valid parentFraser Tweedale2016-05-091-4/+8
| | | | | | | | | Accept the string "host-authority" as a valid reference to the host authority when creating a sub-CA. This is a convenience for users, and for systems that do not know (and do not want to look up) the ID of the host authority. Part of: https://fedorahosted.org/pki/ticket/1625
* Fixed adminEnroll servlet browser import issueMatthew Harmsen2016-05-042-5/+5
| | | | | - PKI TRAC Ticket #1669 - adminEnroll servlet EnrollSuccess.template succeeds but fails on import into browser
* Removed default certificate validity delay.Endi S. Dewata2016-05-034-4/+4
| | | | | | | | Some certificate profiles have been modified to remove the default one minute validity delay, allowing the certificate issued with those profiles to be used immediately. https://fedorahosted.org/pki/ticket/2304
* Lightweight CAs: add IPACustodiaKeyRetrieverFraser Tweedale2016-05-032-1/+83
| | | | | | | | | | | | Add 'IPACustodiaKeyRetriever', a 'KeyRetriever' implementation for use when Dogtag is deployed as a FreeIPA CA. The Java class invokes 'pki-ipa-retrieve-key', a Python script that retrieves lightweight CA keys from the Custodia server on a replica that possesses the keys. 'pki-ipa-retrieve-key' depends on FreeIPA libraries, FreeIPA server configuration, and Kerberos and Custodia keys owned by 'pkiuser'. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: add key retrieval frameworkFraser Tweedale2016-05-032-6/+212
| | | | | | | | | | | | | Add the framework for key retrieval when a lightweight CA is missing its signing key. This includes all the bits for loading a KeyRetriever implementation, initiating retrieval in a thread and updating the record of which clones possess the key if retrieval was successful. It does not include a KeyRetriever implementation. A subsequent commit will provide this. Part of: https://fedorahosted.org/pki/ticket/1625
* Add script to enable USN pluginAde Lee2016-04-152-4/+10
| | | | | | | | | | | | | | New authority monitor code requires the USN plugin to be enabled in the database to ensure that the entryUSN attribute is added to authority entries. In the case where this plugin was disabled, accessing this attribute resulted in a null pointer exception whch prevented server startup. The code has been changed so as not to throw a null pointer exception on startup if the entryusn is not present, and also to call an LDIF to enable the plugin when a subsystem is configured through pkispawn.
* Lightweight CAs: indicate when CA does not yet have keysFraser Tweedale2016-04-143-10/+31
| | | | | | | | | | When a lightweight CA is created, clones will initialise a local object when the LDAP replication takes place, however, the signing keys will not yet have been replicated. Therefore, indicate CA readiness in authority data and respond appropriately (HTTP 503) when signing operations are attempted. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: set DN based on data from LDAPFraser Tweedale2016-04-141-2/+9
| | | | | | | | | | | | When initialising a lightweight CA, if we do not have the signing cert and key in the NSSDB yet, we do not initialise the DN. This causes NPE in other code that expects getX500Name() to return a value, e.g. REST API to list or show CA. To work around this, when loading lightweight CAs set the DN based on the 'authorityDN' value stored in its LDAP entry. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: monitor database for changesFraser Tweedale2016-04-141-87/+342
| | | | | | | | | | | Implement a thread that performs an LDAP persistent search to keep a running CA's view of lightweight CAs in sync with the database. Signing key replication is not yet supported; this will be implemented in a later patch and will not use the database to propagate keys. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: extract LDAP commit/delete methodsFraser Tweedale2016-04-141-96/+116
| | | | | | | | | LDAP code to add, modify and delete authority entries exists in multiple places. Extract these methods to remove this duplication and provide a cleaner basis for upcoming implementation of replication handling. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: move host authority creation out of load methodFraser Tweedale2016-04-141-17/+25
| | | | | | | | To reduce the amount of code that would be run in the persistent search thread, extract the host authority entry creation out of the 'loadLightweightCAs' method, into 'CertificateAuthority.init'. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: avoid repeat definition of authorities DNFraser Tweedale2016-04-141-12/+11
| | | | Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: use static db connection factoryFraser Tweedale2016-04-141-15/+10
| | | | | | | Use a static database connection factory that is initialised by the host authority and used by all CertificateAuthority instances. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: add exceptions for missing signing key or certFraser Tweedale2016-04-142-7/+29
| | | | | | | | | | Add the CAMissingCertException and CAMissingKeyException classes and throw when signing unit initialisation fails due to a missing object. In CertificateAuthority, store the exception if it occurs for possible re-throwing later. Also add the private 'hasKeys' field for internal use. Part of: https://fedorahosted.org/pki/ticket/1625
* Fixed exception handling in CertificateAuthority.Endi S. Dewata2016-04-122-44/+48
| | | | | | | | The CertificateAuthority.getCACert() has been modified to re-throw the exception instead of ignoring it. All callers have been modified to bubble up the exception. https://fedorahosted.org/pki/ticket/1654
* Remove unused variables from profile classesFraser Tweedale2016-03-221-12/+1
| | | | | Also drive-by refactor 'createProfileData' to use 'getProfile', reducing code size.
* Do not leak status of certs issued by other CAsFraser Tweedale2016-03-031-1/+18
| | | | | | If an OCSP request includes CertIDs for certificates issued by multiple CAs, return 'unknown' CertStatus for all certificates not issued by the "signing" CA.
* Lightweight CAs: lookup correct issuer for OCSP responsesFraser Tweedale2016-03-031-1/+38
|
* Ticket #1963 CRL generation enters loop when CA loses connection to netHSM.Christina Fu2016-03-022-0/+80
| | | | | | | | | | | | | | | | | | | | | | | | | This patch makes a low risk attempt to slow down the loop that could be caused by an unexpected exception caused by the unavailability of a dependant component (e.g. HSM, LDAP) in the middle of CRL generation/update. New configuration parameters are: ca.crl.MasterCRL.unexpectedExceptionWaitTime - the wait time in minutes; default is 30 - normally you want it to be less than ca.crl.MasterCRL.autoUpdateInterval and ca.crl.MasterCRL.cacheUpdateInterval ca.crl.MasterCRL.unexpectedExceptionLoopMax - the max number of tries allowed before the slow down mechanism kicks in; default is 10 When such unexpected failure happens, a loop counter is kept and checked against the unexpectedExceptionLoopMax. If the loop counter exceeds the unexpectedExceptionLoopMax, then the current time is checked against the time of the failure, where the time lapse must exceed the unexpectedExceptionWaitTime to trigger a delay. This delay is the counter measure to mitigate the amount of log messages that could flood the log(s). The delay is calcuated like this: waitTime = mUnexpectedExceptionWaitTime - (now - timeOfUnexpectedFailure);
* Lightweight CAs: add audit eventsFraser Tweedale2016-03-012-23/+53
| | | | | | Add audit events for lightweight CA administration. Fixes: https://fedorahosted.org/pki/ticket/1590
* Lightweight CAs: enrol cert via profile subsystemFraser Tweedale2016-02-222-10/+61
| | | | | | | | | | | | Enrol new CA certs via the profile subsystem to ensure that the usual audit events are logged and to avoid the nasty ConfigStore hack used to generate the cert via CertUtil. This commit also fixes an issue where the new CA certificate does not have the correct Authority Key Identifier extension. Fixes: https://fedorahosted.org/pki/ticket/1624 Fixes: https://fedorahosted.org/pki/ticket/1632
* Lightweight CAs: ensure disabled CA cannot create sub-CAsFraser Tweedale2016-02-222-1/+5
| | | | Fixes: https://fedorahosted.org/pki/ticket/1628
* Remove vestiges of NISAuth pluginFraser Tweedale2016-02-162-517/+0
| | | | Fixes: https://fedorahosted.org/pki/ticket/1674
* Weaken PKIPrincipal to superclass in several placesFraser Tweedale2016-02-152-14/+22
| | | | | | | | | | In several places we are casting a `Principal' to `PKIPrincpal', when `GenericPrincpal' or even no cast will suffice. In upcoming external authentication support externally authenticated principals will not be instances of `PKIPrincipal', so weaken assumptions about type of the principal where possible. Part of: https://fedorahosted.org/pki/ticket/1359
* Use correct textual encoding for PKCS #7 objectsFraser Tweedale2016-02-155-10/+10
| | | | | | | | | | | PKCS #7 objects are being output with the "CERTIFICATE CHAIN" label which is invalid (RFC 7468) and unrecognised by many programs (including OpenSSL). Use the correct "PKCS7" label instead. Also do a drive-by refactor of the normalizeCertAndReq to remove some redundant code. Fixes: https://fedorahosted.org/pki/ticket/1699
* Profile service: respond 409 on conflicting operationsFraser Tweedale2016-02-151-7/+8
| | | | | | | | The REST profile service current responds 400 on conflicting operations, indicating that the client sent a bad request when this not the case. Respond with 409 Conflict instead. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1257518
* Remove obsolete catalina config filesFraser Tweedale2016-01-212-271/+0
|
* Avoid profile race conditions by tracking entryUSNFraser Tweedale2016-01-191-4/+8
| | | | | | | | | | | | | Avoid race conditions in the LDAPProfileSubsystem by tracking the most recently known entryUSN of profiles' LDAP entries. As part of this change, add the commitProfile method to the IProfileSubsystem interface, remove commit behaviour from the enableProfile and disableProfile methods and update ProfileService and ProfileApproveServlet to commit the profile (using the commitProfile method) where needed. Part of: https://fedorahosted.org/pki/ticket/1700
* Avoid superfluous ConfigStore commit during profile creationFraser Tweedale2015-11-261-2/+1
| | | | Part of: https://fedorahosted.org/pki/ticket/1700
* CRLIP: omit certs not issued by associated CAFraser Tweedale2015-10-211-4/+14
| | | | | | | | | | | | Lightweight CAs mean that a single database can include certificates from many issuers. Update CRLIssuingPoint to only include certificates issued by its associated CA. For backwards compatibility, if the associated CA is the host CA, certificate records with missing 'issuerName' attribute are also included. Fixes: https://fedorahosted.org/pki/ticket/1626
generated by cgit (git 2.34.1) at 2025-09-26 15:37:37 +0000