260 lines
8.1 KiB
Go
260 lines
8.1 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package pki
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/hashicorp/vault/sdk/framework"
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
)
|
|
|
|
func pathIssuerSignIntermediate(b *backend) *framework.Path {
|
|
pattern := "issuer/" + framework.GenericNameRegex(issuerRefParam) + "/sign-intermediate"
|
|
|
|
displayAttrs := &framework.DisplayAttributes{
|
|
OperationPrefix: operationPrefixPKIIssuer,
|
|
OperationVerb: "sign",
|
|
OperationSuffix: "intermediate",
|
|
}
|
|
|
|
return buildPathIssuerSignIntermediateRaw(b, pattern, displayAttrs)
|
|
}
|
|
|
|
func pathSignIntermediate(b *backend) *framework.Path {
|
|
pattern := "root/sign-intermediate"
|
|
|
|
displayAttrs := &framework.DisplayAttributes{
|
|
OperationPrefix: operationPrefixPKIRoot,
|
|
OperationVerb: "sign",
|
|
OperationSuffix: "intermediate",
|
|
}
|
|
|
|
return buildPathIssuerSignIntermediateRaw(b, pattern, displayAttrs)
|
|
}
|
|
|
|
func buildPathIssuerSignIntermediateRaw(b *backend, pattern string, displayAttrs *framework.DisplayAttributes) *framework.Path {
|
|
fields := addIssuerRefField(map[string]*framework.FieldSchema{})
|
|
path := &framework.Path{
|
|
Pattern: pattern,
|
|
DisplayAttrs: displayAttrs,
|
|
Fields: fields,
|
|
Operations: map[logical.Operation]framework.OperationHandler{
|
|
logical.UpdateOperation: &framework.PathOperation{
|
|
Callback: b.pathIssuerSignIntermediate,
|
|
Responses: map[int][]framework.Response{
|
|
http.StatusOK: {{
|
|
Description: "OK",
|
|
Fields: map[string]*framework.FieldSchema{
|
|
"expiration": {
|
|
Type: framework.TypeInt64,
|
|
Description: `Expiration Time`,
|
|
Required: true,
|
|
},
|
|
"serial_number": {
|
|
Type: framework.TypeString,
|
|
Description: `Serial Number`,
|
|
Required: false,
|
|
},
|
|
"certificate": {
|
|
Type: framework.TypeString,
|
|
Description: `Certificate`,
|
|
Required: true,
|
|
},
|
|
"issuing_ca": {
|
|
Type: framework.TypeString,
|
|
Description: `Issuing CA`,
|
|
Required: true,
|
|
},
|
|
"ca_chain": {
|
|
Type: framework.TypeStringSlice,
|
|
Description: `CA Chain`,
|
|
Required: true,
|
|
},
|
|
},
|
|
}},
|
|
},
|
|
},
|
|
},
|
|
|
|
HelpSynopsis: pathIssuerSignIntermediateHelpSyn,
|
|
HelpDescription: pathIssuerSignIntermediateHelpDesc,
|
|
}
|
|
|
|
path.Fields = addCACommonFields(path.Fields)
|
|
path.Fields = addCAIssueFields(path.Fields)
|
|
|
|
path.Fields["csr"] = &framework.FieldSchema{
|
|
Type: framework.TypeString,
|
|
Default: "",
|
|
Description: `PEM-format CSR to be signed.`,
|
|
}
|
|
|
|
path.Fields["use_csr_values"] = &framework.FieldSchema{
|
|
Type: framework.TypeBool,
|
|
Default: false,
|
|
Description: `If true, then:
|
|
1) Subject information, including names and alternate
|
|
names, will be preserved from the CSR rather than
|
|
using values provided in the other parameters to
|
|
this path;
|
|
2) Any key usages requested in the CSR will be
|
|
added to the basic set of key usages used for CA
|
|
certs signed by this path; for instance,
|
|
the non-repudiation flag;
|
|
3) Extensions requested in the CSR will be copied
|
|
into the issued certificate.`,
|
|
}
|
|
|
|
fields["signature_bits"] = &framework.FieldSchema{
|
|
Type: framework.TypeInt,
|
|
Default: 0,
|
|
Description: `The number of bits to use in the signature
|
|
algorithm; accepts 256 for SHA-2-256, 384 for SHA-2-384, and 512 for
|
|
SHA-2-512. Defaults to 0 to automatically detect based on key length
|
|
(SHA-2-256 for RSA keys, and matching the curve size for NIST P-Curves).`,
|
|
DisplayAttrs: &framework.DisplayAttributes{
|
|
Value: 0,
|
|
},
|
|
}
|
|
|
|
fields["skid"] = &framework.FieldSchema{
|
|
Type: framework.TypeString,
|
|
Default: "",
|
|
Description: `Value for the Subject Key Identifier field
|
|
(RFC 5280 Section 4.2.1.2). This value should ONLY be used when
|
|
cross-signing to mimic the existing certificate's SKID value; this
|
|
is necessary to allow certain TLS implementations (such as OpenSSL)
|
|
which use SKID/AKID matches in chain building to restrict possible
|
|
valid chains.
|
|
|
|
Specified as a string in hex format. Default is empty, allowing
|
|
Vault to automatically calculate the SKID according to method one
|
|
in the above RFC section.`,
|
|
DisplayAttrs: &framework.DisplayAttributes{
|
|
Value: "",
|
|
},
|
|
}
|
|
|
|
fields["use_pss"] = &framework.FieldSchema{
|
|
Type: framework.TypeBool,
|
|
Default: false,
|
|
Description: `Whether or not to use PSS signatures when using a
|
|
RSA key-type issuer. Defaults to false.`,
|
|
}
|
|
|
|
return path
|
|
}
|
|
|
|
const (
|
|
pathIssuerSignIntermediateHelpSyn = `Issue an intermediate CA certificate based on the provided CSR.`
|
|
pathIssuerSignIntermediateHelpDesc = `
|
|
This API endpoint allows for signing the specified CSR, adding to it a basic
|
|
constraint for IsCA=True. This allows the issued certificate to issue its own
|
|
leaf certificates.
|
|
|
|
Note that the resulting certificate is not imported as an issuer in this PKI
|
|
mount. This means that you can use the resulting certificate in another Vault
|
|
PKI mount point or to issue an external intermediate (e.g., for use with
|
|
another X.509 CA).
|
|
|
|
See the API documentation for more information about required parameters.
|
|
`
|
|
)
|
|
|
|
func pathIssuerSignSelfIssued(b *backend) *framework.Path {
|
|
pattern := "issuer/" + framework.GenericNameRegex(issuerRefParam) + "/sign-self-issued"
|
|
|
|
displayAttrs := &framework.DisplayAttributes{
|
|
OperationPrefix: operationPrefixPKIIssuer,
|
|
OperationVerb: "sign",
|
|
OperationSuffix: "self-issued",
|
|
}
|
|
|
|
return buildPathIssuerSignSelfIssued(b, pattern, displayAttrs)
|
|
}
|
|
|
|
func pathSignSelfIssued(b *backend) *framework.Path {
|
|
pattern := "root/sign-self-issued"
|
|
|
|
displayAttrs := &framework.DisplayAttributes{
|
|
OperationPrefix: operationPrefixPKIRoot,
|
|
OperationVerb: "sign",
|
|
OperationSuffix: "self-issued",
|
|
}
|
|
|
|
return buildPathIssuerSignSelfIssued(b, pattern, displayAttrs)
|
|
}
|
|
|
|
func buildPathIssuerSignSelfIssued(b *backend, pattern string, displayAttrs *framework.DisplayAttributes) *framework.Path {
|
|
fields := map[string]*framework.FieldSchema{
|
|
"certificate": {
|
|
Type: framework.TypeString,
|
|
Description: `PEM-format self-issued certificate to be signed.`,
|
|
},
|
|
"require_matching_certificate_algorithms": {
|
|
Type: framework.TypeBool,
|
|
Default: false,
|
|
Description: `If true, require the public key algorithm of the signer to match that of the self issued certificate.`,
|
|
},
|
|
}
|
|
fields = addIssuerRefField(fields)
|
|
path := &framework.Path{
|
|
Pattern: pattern,
|
|
DisplayAttrs: displayAttrs,
|
|
Fields: fields,
|
|
Operations: map[logical.Operation]framework.OperationHandler{
|
|
logical.UpdateOperation: &framework.PathOperation{
|
|
Callback: b.pathIssuerSignSelfIssued,
|
|
Responses: map[int][]framework.Response{
|
|
http.StatusOK: {{
|
|
Description: "OK",
|
|
Fields: map[string]*framework.FieldSchema{
|
|
"certificate": {
|
|
Type: framework.TypeString,
|
|
Description: `Certificate`,
|
|
Required: true,
|
|
},
|
|
"issuing_ca": {
|
|
Type: framework.TypeString,
|
|
Description: `Issuing CA`,
|
|
Required: true,
|
|
},
|
|
},
|
|
}},
|
|
},
|
|
},
|
|
},
|
|
|
|
HelpSynopsis: pathIssuerSignSelfIssuedHelpSyn,
|
|
HelpDescription: pathIssuerSignSelfIssuedHelpDesc,
|
|
}
|
|
|
|
return path
|
|
}
|
|
|
|
const (
|
|
pathIssuerSignSelfIssuedHelpSyn = `Re-issue a self-signed certificate based on the provided certificate.`
|
|
pathIssuerSignSelfIssuedHelpDesc = `
|
|
This API endpoint allows for signing the specified self-signed certificate,
|
|
effectively allowing cross-signing of external root CAs. This allows for an
|
|
alternative validation path, chaining back through this PKI mount. This
|
|
endpoint is also useful in a rolling-root scenario, allowing devices to trust
|
|
and validate later (or earlier) root certificates and their issued leaves.
|
|
|
|
Usually the sign-intermediate operation is preferred to this operation.
|
|
|
|
Note that this is a very privileged operation and should be extremely
|
|
restricted in terms of who is allowed to use it. All values will be taken
|
|
directly from the incoming certificate and only verification that it is
|
|
self-issued will be performed.
|
|
|
|
Configured URLs for CRLs/OCSP/etc. will be copied over and the issuer will
|
|
be this mount's CA cert. Other than that, all other values will be used
|
|
verbatim from the given certificate.
|
|
|
|
See the API documentation for more information about required parameters.
|
|
`
|
|
)
|