Subject DN configuration (#296)

Add subject DN configuration options to certd and refactor create_cert
Azure · Oct 19, 2021 · 550dad8 · 550dad8 · ksaye · Nov 8, 2021
1 parent 9a12cd3
commit 550dad8
Show file tree

Hide file tree

Showing 30 changed files with 875 additions and 1,045 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/aziotctl/Cargo.toml b/aziotctl/Cargo.toml
@@ -44,7 +44,7 @@ aziot-keys-common = { path = "../key/aziot-keys-common" }
 aziot-tpmd-config = { path = "../tpm/aziot-tpmd-config" }
 aziotctl-common = { path = "./aziotctl-common" }
 config-common = { path = "../config-common" }
-http-common = { path = "../http-common", features = ["tokio1"] }
+http-common = { path = "../http-common" }
 mini-sntp = { path = "../mini-sntp" }
 openssl2 = { path = "../openssl2" }
 openssl-sys2 = { path = "../openssl-sys2" }

diff --git a/aziotctl/aziotctl-common/src/config/apply.rs b/aziotctl/aziotctl-common/src/config/apply.rs
@@ -335,11 +335,14 @@ pub fn run(
                     aziotcs_keys.keys.push(super::EST_ID_ID.to_owned());
 
                     Some(aziot_certd_config::EstAuthX509 {
-                        identity: (super::EST_ID_ID.to_owned(), super::EST_ID_ID.to_owned()),
-                        bootstrap_identity: Some((
-                            super::EST_BOOTSTRAP_ID.to_owned(),
-                            super::EST_BOOTSTRAP_ID.to_owned(),
-                        )),
+                        identity: aziot_certd_config::CertificateWithPrivateKey {
+                            cert: super::EST_ID_ID.to_owned(),
+                            pk: super::EST_ID_ID.to_owned(),
+                        },
+                        bootstrap_identity: Some(aziot_certd_config::CertificateWithPrivateKey {
+                            cert: super::EST_BOOTSTRAP_ID.to_owned(),
+                            pk: super::EST_BOOTSTRAP_ID.to_owned(),
+                        }),
                     })
                 }
 
@@ -356,7 +359,10 @@ pub fn run(
                     aziotcs_keys.keys.push(super::EST_ID_ID.to_owned());
 
                     Some(aziot_certd_config::EstAuthX509 {
-                        identity: (super::EST_ID_ID.to_owned(), super::EST_ID_ID.to_owned()),
+                        identity: aziot_certd_config::CertificateWithPrivateKey {
+                            cert: super::EST_ID_ID.to_owned(),
+                            pk: super::EST_ID_ID.to_owned(),
+                        },
                         bootstrap_identity: None,
                     })
                 }
@@ -376,8 +382,8 @@ pub fn run(
                 .collect();
 
             Some(aziot_certd_config::Est {
-                auth,
                 trusted_certs,
+                auth,
                 urls,
             })
         } else {
@@ -391,7 +397,7 @@ pub fn run(
                 cert_issuance_certs
                     .insert(super::LOCAL_CA.to_owned(), into_cert_options(cert, None));
 
-                Some(aziot_certd_config::LocalCa {
+                Some(aziot_certd_config::CertificateWithPrivateKey {
                     cert: super::LOCAL_CA.to_owned(),
                     pk: super::LOCAL_CA.to_owned(),
                 })
@@ -406,7 +412,7 @@ pub fn run(
                 preloaded_keys.insert(super::LOCAL_CA.to_owned(), pk);
                 aziotcs_keys.keys.push(super::LOCAL_CA.to_owned());
 
-                Some(aziot_certd_config::LocalCa {
+                Some(aziot_certd_config::CertificateWithPrivateKey {
                     cert: super::LOCAL_CA.to_owned(),
                     pk: super::LOCAL_CA.to_owned(),
                 })
@@ -494,7 +500,9 @@ fn into_cert_options(
     };
 
     aziot_certd_config::CertIssuanceOptions {
-        common_name: opts.common_name,
+        subject: opts
+            .common_name
+            .map(aziot_certd_config::CertSubject::CommonName),
         expiry_days: opts.expiry_days,
         method,
     }
@@ -528,7 +536,10 @@ pub fn set_est_auth(
                     preloaded_keys.insert(bootstrap_cert_id.clone(), bootstrap_identity_pk.clone());
                     aziotcs_keys.keys.push(bootstrap_cert_id.clone());
 
-                    Some((bootstrap_cert_id.clone(), bootstrap_cert_id))
+                    Some(aziot_certd_config::CertificateWithPrivateKey {
+                        cert: bootstrap_cert_id.clone(),
+                        pk: bootstrap_cert_id,
+                    })
                 }
 
                 super_config::EstAuthX509::Identity {
@@ -548,7 +559,10 @@ pub fn set_est_auth(
             aziotcs_keys.keys.push(identity_cert_id.clone());
 
             aziot_certd_config::EstAuthX509 {
-                identity: (identity_cert_id.clone(), identity_cert_id),
+                identity: aziot_certd_config::CertificateWithPrivateKey {
+                    cert: identity_cert_id.clone(),
+                    pk: identity_cert_id,
+                },
                 bootstrap_identity,
             }
         });

diff --git a/aziotctl/aziotctl-common/src/config/super_config.rs b/aziotctl/aziotctl-common/src/config/super_config.rs
@@ -200,8 +200,8 @@ pub enum DpsAttestationMethod {
 
 #[derive(Debug, Default, Deserialize, Serialize)]
 pub struct CertIssuance {
-    pub est: Option<Est>,
     pub local_ca: Option<LocalCa>,
+    pub est: Option<Est>,
 }
 
 #[derive(Debug, Deserialize, Serialize)]

diff --git a/aziotctl/aziotctl-common/test-files/apply/dps-x509-pkcs11-est-bootstrap/certd.toml b/aziotctl/aziotctl-common/test-files/apply/dps-x509-pkcs11-est-bootstrap/certd.toml
@@ -1,12 +1,12 @@
 homedir_path = "/var/lib/aziot/certd"
 [cert_issuance.est]
+trusted_certs = ["est-server-ca-1"]
 username = "estuser"
 password = "estpwd"
 identity_cert = "est-id"
 identity_pk = "est-id"
 bootstrap_identity_cert = "est-bootstrap-id"
 bootstrap_identity_pk = "est-bootstrap-id"
-trusted_certs = ["est-server-ca-1"]
 
 [cert_issuance.est.urls]
 default = "https://example.org/.well-known/est"

diff --git a/aziotctl/aziotctl-common/test-files/apply/dps-x509-pkcs11-est-custom-bootstrap/certd.toml b/aziotctl/aziotctl-common/test-files/apply/dps-x509-pkcs11-est-custom-bootstrap/certd.toml
@@ -1,12 +1,12 @@
 homedir_path = "/var/lib/aziot/certd"
 [cert_issuance.est]
+trusted_certs = ["est-server-ca-1"]
 username = "estuser"
 password = "estpwd"
 identity_cert = "est-id"
 identity_pk = "est-id"
 bootstrap_identity_cert = "est-bootstrap-id"
 bootstrap_identity_pk = "est-bootstrap-id"
-trusted_certs = ["est-server-ca-1"]
 
 [cert_issuance.est.urls]
 default = "https://example.org/.well-known/est"

diff --git a/aziotctl/aziotctl-common/test-files/apply/dps-x509-pkcs11-est/certd.toml b/aziotctl/aziotctl-common/test-files/apply/dps-x509-pkcs11-est/certd.toml
@@ -1,10 +1,10 @@
 homedir_path = "/var/lib/aziot/certd"
 [cert_issuance.est]
+trusted_certs = ["est-server-ca-1"]
 username = "estuser"
 password = "estpwd"
 identity_cert = "est-id"
 identity_pk = "est-id"
-trusted_certs = ["est-server-ca-1"]
 
 [cert_issuance.est.urls]
 default = "https://example.org/.well-known/est"

diff --git a/aziotctl/src/internal/check/checks/cert_expiry.rs b/aziotctl/src/internal/check/checks/cert_expiry.rs
@@ -122,10 +122,12 @@ impl EstIdentityBootstrapCerts {
             .and_then(|est| est.auth.x509.as_ref())
             .map(|x509| {
                 (
-                    (&x509.identity.0, "x509 identity"),
-                    x509.bootstrap_identity
-                        .as_ref()
-                        .map(|(cert, _)| (cert, "x509 bootstrap")),
+                    (&x509.identity.cert, "x509 identity"),
+                    x509.bootstrap_identity.as_ref().map(
+                        |aziot_certd_config::CertificateWithPrivateKey { cert, .. }| {
+                            (cert, "x509 bootstrap")
+                        },
+                    ),
                 )
             });
 

diff --git a/aziotd/Cargo.toml b/aziotd/Cargo.toml
@@ -17,5 +17,5 @@ aziot-identityd = { path = "../identity/aziot-identityd" }
 aziot-keyd = { path = "../key/aziot-keyd" }
 aziot-tpmd = { path = "../tpm/aziot-tpmd" }
 config-common = { path = "../config-common" }
-http-common = { path = "../http-common", features = ["tokio1"] }
+http-common = { path = "../http-common" }
 logger = { path = "../logger" }
diff --git a/cert/aziot-cert-client-async/Cargo.toml b/cert/aziot-cert-client-async/Cargo.toml
@@ -11,4 +11,4 @@ percent-encoding = "2"
 
 aziot-cert-common-http = { path = "../aziot-cert-common-http" }
 aziot-key-common = { path = "../../key/aziot-key-common" }
-http-common = { path = "../../http-common", features = ["tokio1"] }
+http-common = { path = "../../http-common" }
diff --git a/cert/aziot-certd-config/Cargo.toml b/cert/aziot-certd-config/Cargo.toml
@@ -10,6 +10,7 @@ hex = "0.4"
 libc = "0.2"
 openssl = "0.10"
 serde = { version = "1", features = ["derive"] }
+serde_with = "1"
 url = { version = "2", features = ["serde"] }
 
 http-common = { path = "../../http-common" }