From ed6e62100249bf099ec8b90a8ad147532b40372b Mon Sep 17 00:00:00 2001 From: Remigiusz Janeczek Date: Tue, 8 Sep 2020 13:00:50 +0200 Subject: [PATCH] [CONTRIB] Adjust EJBCA to issue certificates usable by servers. Add configuration to EJBCA that allows to create keystores with extendedKeyUsage containing serverAuth. Issue-ID: AAF-1121 Signed-off-by: Remigiusz Janeczek Change-Id: I6fc1d228acb4edc089be11d66186cfb5006e9ad1 --- .../certprofile_CUSTOM_ENDUSER-1834889499.xml | 595 +++++++++++++ .../components/ejbca/resources/ejbca-config.sh | 6 + .../entityprofile_Custom_EndEntity-1356531849.xml | 936 +++++++++++++++++++++ .../components/ejbca/templates/configmap.yaml | 8 + .../components/ejbca/templates/deployment.yaml | 6 + 5 files changed, 1551 insertions(+) create mode 100644 kubernetes/contrib/components/ejbca/resources/certprofile_CUSTOM_ENDUSER-1834889499.xml create mode 100644 kubernetes/contrib/components/ejbca/resources/entityprofile_Custom_EndEntity-1356531849.xml diff --git a/kubernetes/contrib/components/ejbca/resources/certprofile_CUSTOM_ENDUSER-1834889499.xml b/kubernetes/contrib/components/ejbca/resources/certprofile_CUSTOM_ENDUSER-1834889499.xml new file mode 100644 index 0000000000..e163aed82a --- /dev/null +++ b/kubernetes/contrib/components/ejbca/resources/certprofile_CUSTOM_ENDUSER-1834889499.xml @@ -0,0 +1,595 @@ + + + + + version + 46.0 + + + type + 1 + + + certversion + X509v3 + + + encodedvalidity + 2y + + + usecertificatevalidityoffset + false + + + certificatevalidityoffset + -10m + + + useexpirationrestrictionforweekdays + false + + + expirationrestrictionforweekdaysbefore + true + + + expirationrestrictionweekdays + + + true + + + true + + + false + + + false + + + false + + + true + + + true + + + + + allowvalidityoverride + false + + + allowextensionoverride + false + + + allowdnoverride + false + + + allowdnoverridebyeei + false + + + allowbackdatedrevokation + false + + + usecertificatestorage + true + + + storecertificatedata + true + + + storesubjectaltname + true + + + usebasicconstrants + true + + + basicconstraintscritical + true + + + usesubjectkeyidentifier + true + + + subjectkeyidentifiercritical + false + + + useauthoritykeyidentifier + true + + + authoritykeyidentifiercritical + false + + + usesubjectalternativename + true + + + subjectalternativenamecritical + false + + + useissueralternativename + true + + + issueralternativenamecritical + false + + + usecrldistributionpoint + false + + + usedefaultcrldistributionpoint + false + + + crldistributionpointcritical + false + + + crldistributionpointuri + + + + usefreshestcrl + false + + + usecadefinedfreshestcrl + false + + + freshestcrluri + + + + crlissuer + + + + usecertificatepolicies + false + + + certificatepoliciescritical + false + + + certificatepolicies + + + + availablekeyalgorithms + + + DSA + + + ECDSA + + + RSA + + + + + availableeccurves + + + ANY_EC_CURVE + + + + + availablebitlengths + + + 0 + + + 192 + + + 224 + + + 239 + + + 256 + + + 384 + + + 512 + + + 521 + + + 1024 + + + 1536 + + + 2048 + + + 3072 + + + 4096 + + + 6144 + + + 8192 + + + + + minimumavailablebitlength + 0 + + + maximumavailablebitlength + 8192 + + + signaturealgorithm + + + + usekeyusage + true + + + keyusage + + + true + + + true + + + true + + + false + + + false + + + false + + + false + + + false + + + false + + + + + allowkeyusageoverride + false + + + keyusagecritical + true + + + useextendedkeyusage + true + + + extendedkeyusage + + + 1.3.6.1.5.5.7.3.2 + + + 1.3.6.1.5.5.7.3.4 + + + 1.3.6.1.5.5.7.3.1 + + + + + extendedkeyusagecritical + false + + + usedocumenttypelist + false + + + documenttypelistcritical + false + + + documenttypelist + + + + availablecas + + + -1 + + + + + usedpublishers + + + + useocspnocheck + false + + + useldapdnorder + true + + + usecustomdnorder + false + + + usemicrosofttemplate + false + + + microsofttemplate + + + + usecardnumber + false + + + usecnpostfix + false + + + cnpostfix + + + + usesubjectdnsubset + false + + + subjectdnsubset + + + + usesubjectaltnamesubset + false + + + subjectaltnamesubset + + + + usepathlengthconstraint + false + + + pathlengthconstraint + 0 + + + useqcstatement + false + + + usepkixqcsyntaxv2 + false + + + useqcstatementcritical + false + + + useqcstatementraname + + + + useqcsematicsid + + + + useqcetsiqccompliance + false + + + useqcetsisignaturedevice + false + + + useqcetsivaluelimit + false + + + qcetsivaluelimit + 0 + + + qcetsivaluelimitexp + 0 + + + qcetsivaluelimitcurrency + + + + useqcetsiretentionperiod + false + + + qcetsiretentionperiod + 0 + + + useqccustomstring + false + + + qccustomstringoid + + + + qccustomstringtext + + + + qcetsipds + + + + qcetsitype + + + + usecertificatetransparencyincerts + false + + + usecertificatetransparencyinocsp + false + + + usecertificatetransparencyinpublisher + false + + + usesubjectdirattributes + false + + + usenameconstraints + false + + + useauthorityinformationaccess + false + + + caissuers + + + + usedefaultcaissuer + false + + + usedefaultocspservicelocator + false + + + ocspservicelocatoruri + + + + cvcaccessrights + 3 + + + usedcertificateextensions + + + + approvals + + + + org.cesecore.certificates.ca.ApprovalRequestType + REVOCATION + + -1 + + + + org.cesecore.certificates.ca.ApprovalRequestType + KEYRECOVER + + -1 + + + + org.cesecore.certificates.ca.ApprovalRequestType + ADDEDITENDENTITY + + -1 + + + + + useprivkeyusageperiodnotbefore + false + + + useprivkeyusageperiod + false + + + useprivkeyusageperiodnotafter + false + + + privkeyusageperiodstartoffset + 0 + + + privkeyusageperiodlength + 63072000 + + + usesingleactivecertificateconstraint + false + + + overridableextensionoids + + + + nonoverridableextensionoids + + + + allowcertsnoverride + false + + + usecustomdnorderldap + false + + + diff --git a/kubernetes/contrib/components/ejbca/resources/ejbca-config.sh b/kubernetes/contrib/components/ejbca/resources/ejbca-config.sh index f1bd07e158..ad10240b94 100755 --- a/kubernetes/contrib/components/ejbca/resources/ejbca-config.sh +++ b/kubernetes/contrib/components/ejbca/resources/ejbca-config.sh @@ -12,6 +12,12 @@ configureEjbca() { ejbca.sh config cmp updatealias --alias cmpRA --key operationmode --value ra ejbca.sh ca editca --caname ManagementCA --field cmpRaAuthSecret --value ${RA_IAK} ejbca.sh config cmp updatealias --alias cmpRA --key responseprotection --value pbe + #Custom EJBCA cert profile and endentity are imported to allow issuing certificates with correct extended usage (containing serverAuth) + ejbca.sh ca importprofiles -d /opt/primekey/custom_profiles + #Profile name taken from certprofile filename (certprofile_-.xml) + ejbca.sh config cmp updatealias --alias cmpRA --key ra.certificateprofile --value CUSTOM_ENDUSER + #ID taken from entityprofile filename (entityprofile_-.xml) + ejbca.sh config cmp updatealias --alias cmpRA --key ra.endentityprofileid --value 1356531849 ejbca.sh config cmp dumpalias --alias cmpRA ejbca.sh config cmp addalias --alias cmp ejbca.sh config cmp updatealias --alias cmp --key allowautomatickeyupdate --value true diff --git a/kubernetes/contrib/components/ejbca/resources/entityprofile_Custom_EndEntity-1356531849.xml b/kubernetes/contrib/components/ejbca/resources/entityprofile_Custom_EndEntity-1356531849.xml new file mode 100644 index 0000000000..652acd5fa7 --- /dev/null +++ b/kubernetes/contrib/components/ejbca/resources/entityprofile_Custom_EndEntity-1356531849.xml @@ -0,0 +1,936 @@ + + + + + version + 14.0 + + + NUMBERARRAY + + + 1 + + + 1 + + + 0 + + + 0 + + + 0 + + + 1 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 1 + + + 1 + + + 1 + + + 1 + + + 0 + + + 1 + + + 0 + + + 3 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 1 + + + 0 + + + 0 + + + 1 + + + 1 + + + 1 + + + 1 + + + 1 + + + 1 + + + 0 + + + 0 + + + 1 + + + 1 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 0 + + + 1 + + + 1 + + + 0 + + + 1 + + + 0 + + + 1 + + + 1 + + + 1 + + + 1 + + + 1 + + + 1 + + + 1 + + + 0 + + + 0 + + + 0 + + + + + SUBJECTDNFIELDORDER + + + 500 + + + 1100 + + + 1200 + + + 1300 + + + 1400 + + + 1600 + + + + + SUBJECTALTNAMEFIELDORDER + + + 1800 + + + 1801 + + + 1802 + + + + + SUBJECTDIRATTRFIELDORDER + + + + 0 + + + + 20000 + true + + + 10000 + true + + + 30000 + true + + + 1 + + + + 20001 + true + + + 10001 + true + + + 30001 + true + + + 95 + + + + 20095 + false + + + 10095 + true + + + 30095 + true + + + 96 + + + + 20096 + false + + + 10096 + true + + + 30096 + true + + + 5 + + + + 20005 + true + + + 10005 + true + + + 30005 + true + + + 26 + + + + 20026 + false + + + 10026 + true + + + 30026 + true + + + 29 + 1834889499 + + + 20029 + true + + + 10029 + true + + + 30029 + true + + + 30 + 1834889499 + + + 20030 + true + + + 10030 + true + + + 30030 + true + + + 31 + 1 + + + 20031 + true + + + 10031 + true + + + 30031 + true + + + 32 + 1;2;3;4 + + + 20032 + true + + + 10032 + true + + + 30032 + true + + + 33 + + + + 20033 + true + + + 10033 + true + + + 30033 + true + + + 34 + + + + 20034 + true + + + 10034 + false + + + 30034 + true + + + 38 + 1 + + + 20038 + true + + + 10038 + true + + + 30038 + true + + + 37 + -477565695 + + + 20037 + true + + + 10037 + true + + + 30037 + true + + + 98 + + + + 20098 + false + + + 10098 + false + + + 30098 + true + + + 99 + + + + 20099 + false + + + 10099 + false + + + 30099 + true + + + 97 + + + + 20097 + false + + + 10097 + false + + + 30097 + true + + + 91 + false + + + 20091 + false + + + 10091 + false + + + 30091 + true + + + 94 + -1 + + + 20094 + true + + + 10094 + false + + + 30094 + false + + + 93 + -1 + + + 20093 + false + + + 10093 + false + + + 30093 + false + + + 89 + + + + 20089 + false + + + 10089 + false + + + 30089 + true + + + 88 + + + + 20088 + false + + + 10088 + false + + + 30088 + true + + + ALLOW_MERGEDN_WEBSERVICES + false + + + 2 + + + + 20002 + false + + + 10002 + false + + + 10090 + true + + + 90 + 0 + + + REVERSEFFIELDCHECKS + false + + + 28 + false + + + 20028 + false + + + 10028 + false + + + REUSECERTIFICATE + false + + + 35 + false + + + 20035 + false + + + 10035 + false + + + 10092 + false + + + USEEXTENSIONDATA + false + + + PRINTINGUSE + false + + + PRINTINGDEFAULT + false + + + PRINTINGREQUIRED + false + + + PRINTINGCOPIES + 1 + + + PRINTINGPRINTERNAME + + + + PRINTINGSVGDATA + + + + PRINTINGSVGFILENAME + + + + 11 + + + + 20011 + true + + + 10011 + true + + + 30011 + true + + + 12 + + + + 20012 + true + + + 10012 + true + + + 30012 + true + + + 13 + + + + 20013 + true + + + 10013 + true + + + 30013 + true + + + 14 + + + + 20014 + true + + + 10014 + true + + + 30014 + true + + + 16 + + + + 20016 + true + + + 10016 + true + + + 30016 + true + + + 18 + + + + 20018 + false + + + 10018 + true + + + 30018 + true + + + 118 + + + + 20118 + false + + + 10118 + true + + + 30118 + true + + + 218 + + + + 20218 + false + + + 10218 + true + + + 30218 + true + + + diff --git a/kubernetes/contrib/components/ejbca/templates/configmap.yaml b/kubernetes/contrib/components/ejbca/templates/configmap.yaml index d336bc9a94..d61af076a0 100644 --- a/kubernetes/contrib/components/ejbca/templates/configmap.yaml +++ b/kubernetes/contrib/components/ejbca/templates/configmap.yaml @@ -18,3 +18,11 @@ metadata: name: "{{ include "common.fullname" . }}-config-script" data: {{ tpl (.Files.Glob "resources/ejbca-config.sh").AsConfig . | indent 2 }} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: "{{ include "common.fullname" . }}-profiles" +data: +{{ tpl (.Files.Glob "resources/certprofile_CUSTOM_ENDUSER-1834889499.xml").AsConfig . | indent 2 }} +{{ tpl (.Files.Glob "resources/entityprofile_Custom_EndEntity-1356531849.xml").AsConfig . | indent 2 }} diff --git a/kubernetes/contrib/components/ejbca/templates/deployment.yaml b/kubernetes/contrib/components/ejbca/templates/deployment.yaml index 1b1843476d..495b816bc5 100644 --- a/kubernetes/contrib/components/ejbca/templates/deployment.yaml +++ b/kubernetes/contrib/components/ejbca/templates/deployment.yaml @@ -51,6 +51,8 @@ spec: volumeMounts: - name: "{{ include "common.fullname" . }}-volume" mountPath: /opt/primekey/scripts/ + - name: "{{ include "common.fullname" . }}-profiles-volume" + mountPath: /opt/primekey/custom_profiles/ ports: {{ include "common.containerPorts" . | nindent 10 }} env: - name: INITIAL_ADMIN @@ -90,3 +92,7 @@ spec: name: "{{ include "common.fullname" . }}-config-script" defaultMode: 0755 name: "{{ include "common.fullname" . }}-volume" + - configMap: + name: "{{ include "common.fullname" . }}-profiles" + defaultMode: 0755 + name: "{{ include "common.fullname" . }}-profiles-volume" -- 2.16.6