Skip to content

Commit a923663

Browse files
GiooDevGiooDev
committed
Story #15673: Updating PKI.
* Using get_authorities function as reference for generating expected authorities. * Simplification of scripts avoiding useless functions. * Keep translating to english.
1 parent e40bd57 commit a923663

File tree

9 files changed

+117
-145
lines changed

9 files changed

+117
-145
lines changed

‎deployment/pki/scripts/generate_ca.sh‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,6 @@ set -e
77

88
. $(dirname $0)/lib/ca.sh
99

10-
######################################################################
11-
######################### Overriding ###########################
12-
######################################################################
13-
14-
function get_autorities() {
15-
echo "vitamui-services client-external client-vitam"
16-
}
17-
1810
######################################################################
1911
############################# Main #############################
2012
######################################################################

‎deployment/pki/scripts/generate_ca_dev.sh‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,6 @@ set -e
1313

1414
REPERTOIRE_ROOT="$( cd "$( readlink -f $(dirname ${BASH_SOURCE[0]}) )/../../../dev-deployment" ; pwd )"
1515

16-
function get_autorities() {
17-
echo "vitamui-services client-external client-vitam"
18-
}
19-
2016
######################################################################
2117
############################# Main #############################
2218
######################################################################

‎deployment/pki/scripts/generate_certs.sh‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,16 @@ set -e
1313

1414
function generateCerts {
1515

16-
# Copy CA
17-
pki_logger "Recopie des clés publiques des CA"
18-
copyCAFromPki client-external
19-
copyCAFromPki client-vitam
20-
copyCAFromPki vitamui-services
21-
22-
# Generate hosts certificates
23-
pki_logger "Génération des certificats serveurs"
24-
# Zone interne
16+
pki_logger "Copying CA certificates"
17+
for AUTHORITY_NAME in $(get_autorities); do
18+
copyCAFromPki "${AUTHORITY_NAME}"
19+
done
20+
21+
# VitamUI Services
22+
# Server Only for https
2523
generateServerCertAndStorePassphrase security vitamui-services
2624

27-
#Zone externe
25+
# Server and Client for https or mTLS
2826
generateServerAndClientCertAndStorePassphrase iam vitamui-services
2927
generateServerAndClientCertAndStorePassphrase referential vitamui-services
3028
generateServerAndClientCertAndStorePassphrase cas-server vitamui-services
@@ -34,7 +32,7 @@ function generateCerts {
3432
generateServerAndClientCertAndStorePassphrase pastis vitamui-services
3533
generateServerAndClientCertAndStorePassphrase api-gateway vitamui-services
3634

37-
#Zone UI
35+
# Zone UI - Client Only for mTLS
3836
generateClientCertAndStorePassphrase ui-portal vitamui-services
3937
generateClientCertAndStorePassphrase ui-identity vitamui-services
4038
generateClientCertAndStorePassphrase ui-identity-admin vitamui-services
@@ -44,7 +42,7 @@ function generateCerts {
4442
generateClientCertAndStorePassphrase ui-collect vitamui-services
4543
generateClientCertAndStorePassphrase ui-pastis vitamui-services
4644

47-
#Reverse
45+
# Reverse - Server Only for https
4846
generateServerCertAndStorePassphrase reverse vitamui-services
4947

5048
# Example of generated client cert for a customer allowing to perform request on external APIs

‎deployment/pki/scripts/generate_certs_dev.sh‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,16 @@ function getComponentCertificateSan {
2323

2424
function generateCerts {
2525

26-
# Copy CA
27-
pki_logger "Recopie des clés publiques des CA"
28-
copyCAFromPki client-external
29-
copyCAFromPki client-vitam
30-
copyCAFromPki vitamui-services
31-
32-
# Generate hosts certificates
33-
pki_logger "Génération des certificats serveurs"
34-
# Zone interne
26+
pki_logger "Copying CA certificates"
27+
for AUTHORITY_NAME in $(get_autorities); do
28+
copyCAFromPki "${AUTHORITY_NAME}"
29+
done
30+
31+
# VitamUI Services
32+
# Server Only for https
3533
generateServerCertAndStorePassphrase security vitamui-services
3634

37-
#Zone externe
35+
# Server and Client for https or mTLS
3836
generateServerAndClientCertAndStorePassphrase iam vitamui-services
3937
generateServerAndClientCertAndStorePassphrase cas-server vitamui-services
4038
generateServerAndClientCertAndStorePassphrase referential vitamui-services
@@ -44,7 +42,7 @@ function generateCerts {
4442
generateServerAndClientCertAndStorePassphrase pastis vitamui-services
4543
generateServerAndClientCertAndStorePassphrase api-gateway vitamui-services
4644

47-
#Zone UI
45+
# Zone UI - Client Only for mTLS
4846
generateClientCertAndStorePassphrase ui-portal vitamui-services
4947
generateClientCertAndStorePassphrase ui-identity vitamui-services
5048
generateClientCertAndStorePassphrase ui-identity-admin vitamui-services
@@ -54,7 +52,7 @@ function generateCerts {
5452
generateClientCertAndStorePassphrase ui-pastis vitamui-services
5553
generateClientCertAndStorePassphrase ui-collect vitamui-services
5654

57-
#Reverse
55+
# Reverse proxy - Server Only for https
5856
generateServerCertAndStorePassphrase reverse vitamui-services
5957

6058
# Example of generated client cert for a customer allowing to perform request on external APIs

‎deployment/pki/scripts/lib/ca.sh‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,11 @@ function generate_ca_root {
2525

2626
local CA_DIR=${CA_DIR}/${OPENSSL_CA_DIR}
2727
if [ ! -d ${CA_DIR} ]; then
28-
pki_logger "Create directory ${CA_DIR}"
28+
pki_logger "Creating directory ${CA_DIR}"
2929
mkdir -p ${CA_DIR};
3030
fi
3131

32-
pki_logger "Create CA-root request..."
32+
pki_logger "Creating CA-root request..."
3333
openssl req \
3434
-config ${CONFIG_DIR}/ca-config \
3535
-new \
@@ -38,7 +38,7 @@ function generate_ca_root {
3838
-passout pass:${CA_ROOT_PASS} \
3939
-batch
4040

41-
pki_logger "Sign CA-root certificate..."
41+
pki_logger "Signing CA-root certificate..."
4242
openssl ca \
4343
-config ${CONFIG_DIR}/ca-config \
4444
-selfsign \
@@ -64,11 +64,11 @@ function generate_ca_intermediate {
6464

6565
local CA_DIR=${CA_DIR}/${OPENSSL_CA_DIR}
6666
if [ ! -d ${CA_DIR} ]; then
67-
pki_logger "Create directory ${OPENSSL_CA_DIR}"
67+
pki_logger "Creating directory ${OPENSSL_CA_DIR}"
6868
mkdir -p ${CA_DIR};
6969
fi
7070

71-
pki_logger "Create CA-intermediate request..."
71+
pki_logger "Creating CA-intermediate request..."
7272
openssl req \
7373
-config ${CONFIG_DIR}/ca-config \
7474
-new \
@@ -78,7 +78,7 @@ function generate_ca_intermediate {
7878
-passout pass:${CA_INTERMEDIATE_PASS} \
7979
-batch
8080

81-
pki_logger "Sign CA-intermediate certificate..."
81+
pki_logger "Signing CA-intermediate certificate..."
8282
openssl ca \
8383
-config ${CONFIG_DIR}/ca-config \
8484
-extensions extension_ca_intermediate \
@@ -153,7 +153,7 @@ function main() {
153153

154154
# Create CA per authorities
155155
AUTHORITIES="$(get_autorities)"
156-
for AUTHORITY in ${AUTHORITIES[@]}
156+
for AUTHORITY in $AUTHORITIES; do
157157
do
158158
mkdir -p ${CA_DIR}/${AUTHORITY}
159159
init_config_ca ${AUTHORITY}

‎deployment/pki/scripts/lib/certs.sh‎

Lines changed: 26 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,6 @@ set -e
1111
################################## Functions ###################################
1212
################################################################################
1313

14-
# Generate the path of a server certificate
15-
function getServerCertificatePath {
16-
local AUTHORITY="${1}"
17-
local COMPONENT="${2}"
18-
echo "${CERTIFICATE_DIR}/${AUTHORITY}/servers/${COMPONENT}"
19-
}
20-
2114
# Generate the Subject Alternate Name for a server certificate
2215
function getComponentCertificateSan {
2316
local SERVICE_HOSTNAME="${1}"
@@ -39,9 +32,9 @@ function getComponentCertificateCn {
3932

4033
# Generate a server certificate
4134
function generateServerCertificate {
42-
local COMPONENT="${1}"
35+
local AUTHORITY="${1}"
4336
local TYPE_CERTIFICAT="${2}"
44-
local AUTHORITY="${3}"
37+
local COMPONENT="${3}"
4538
local SERVICE_HOSTNAME="${4}"
4639
local SERVICE_DC_HOSTNAME="${5}"
4740
local REVERSE_SAN="${6}"
@@ -53,10 +46,8 @@ function generateServerCertificate {
5346
# Correctly set certificate DIRECTORY (env var is read inside the openssl configuration file)
5447
export OPENSSL_CRT_DIR=${AUTHORITY}
5548

56-
5749
pki_logger "Starting process to generate ${TYPE_CERTIFICAT} certificate signed with CA ${AUTHORITY} for ${COMPONENT}..."
58-
local SERVER_CERTIFICATE_PATH=$(getServerCertificatePath ${AUTHORITY} ${COMPONENT})
59-
mkdir -p "${SERVER_CERTIFICATE_PATH}"
50+
mkdir -p "${CERTIFICATE_DIR}/${AUTHORITY}/servers/${COMPONENT}"
6051

6152
# Retrieve the passphrase of the CA_INTERMEDIATE from the vault-ca
6253
local CA_INTERMEDIATE_PASS=$(getPassphrase ca "ca_intermediate_${AUTHORITY}")
@@ -83,32 +74,24 @@ function generateServerCertificate {
8374
purge_directory "${CONFIG_DIR}/${AUTHORITY}"
8475
}
8576

86-
# Generate the path of a client certificate
87-
function getClientCertificatePath {
88-
local AUTHORITY="${1}"
89-
local COMPONENT="${2}"
90-
echo "${CERTIFICATE_DIR}/${AUTHORITY}/clients/${COMPONENT}"
91-
}
92-
9377
# Generate a client certificate
9478
function generateClientCertificate {
95-
local COMPONENT="${1}"
79+
local AUTHORITY="${1}"
9680
local TYPE_CERTIFICAT="${2}"
97-
local AUTHORITY="${3}"
81+
local COMPONENT="${3}"
9882

9983
# Correctly set certificate CN (env var is read inside the openssl configuration file)
10084
export OPENSSL_CN="${COMPONENT}"
10185
# Correctly set certificate DIRECTORY (env var is read inside the openssl configuration file)
10286
export OPENSSL_CRT_DIR=${AUTHORITY}
10387

10488
pki_logger "Starting process to generate ${TYPE_CERTIFICAT} certificate for ${COMPONENT}..."
105-
local CLIENT_CERTIFICATE_PATH=$(getClientCertificatePath ${AUTHORITY} ${COMPONENT})
106-
mkdir -p "${CLIENT_CERTIFICATE_PATH}"
89+
mkdir -p "${CERTIFICATE_DIR}/${AUTHORITY}/clients/${COMPONENT}"
10790

10891
# Retrieve the passphrase of the CA_INTERMEDIATE from the vault-ca
10992
local CA_INTERMEDIATE_PASS=$(getPassphrase ca "ca_intermediate_${AUTHORITY}")
11093

111-
local KEY_PASS=$(getOrSetPassphrase certs "${AUTHORITY}_${TYPE_CERTIFICAT}_${COMPONENT}")
94+
local KEY_PASS=$(setPassphrase certs "${AUTHORITY}_${TYPE_CERTIFICAT}_${COMPONENT}")
11295

11396
pki_logger "Generating ${TYPE_CERTIFICAT} key for ${COMPONENT}..."
11497
# TODO: Workaround with -nodes parameter to avoid passphrase.
@@ -154,7 +137,7 @@ function generateServerCertAndStorePassphrase {
154137
local COMPONENT="${1}"
155138
local AUTHORITY="${2}"
156139

157-
pki_logger "DEBUG" "${FUNCNAME[0]} called with $# args: COMPONENT=$1, AUTHORITY=$2"
140+
pki_logger "Creating server certificate for COMPONENT: ${AUTHORITY}/${COMPONENT}"
158141

159142
local TYPE_CERTIFICAT="servers"
160143
local REVERSE_SAN=""
@@ -168,17 +151,17 @@ function generateServerCertAndStorePassphrase {
168151

169152
pki_logger "DEBUG" "DC_NAME=${DC_NAME}, CONSUL_DOMAIN=${CONSUL_DOMAIN}"
170153

171-
local SERVER_CERTIFICATE_PATH=$(getServerCertificatePath ${AUTHORITY} ${COMPONENT})
172-
if [ ! -f "${SERVER_CERTIFICATE_PATH}/${COMPONENT}.crt" ]; then
173-
# Create the certificate
174-
generateServerCertificate ${COMPONENT} \
154+
local CERTIFICATE_FILE="${CERTIFICATE_DIR}/${AUTHORITY}/${TYPE_CERTIFICAT}/${COMPONENT}/${COMPONENT}.crt"
155+
if [ ! -f "${CERTIFICATE_FILE}" ]; then
156+
# Create the server certificate
157+
generateServerCertificate ${AUTHORITY} \
175158
${TYPE_CERTIFICAT} \
176-
${AUTHORITY} \
159+
${COMPONENT} \
177160
"vitamui-${COMPONENT}.service.${CONSUL_DOMAIN}" \
178161
"vitamui-${COMPONENT}.service.${DC_NAME}.${CONSUL_DOMAIN}" \
179162
"${REVERSE_SAN}"
180163
else
181-
pki_logger "Le certificat ${AUTHORITY} - ${TYPE_CERTIFICAT} - ${COMPONENT}.crt existe déjà, il ne sera pas recréé..."
164+
pki_logger "Certificate ${CERTIFICATE_FILE} already exists, it will not be recreated..."
182165
fi
183166
}
184167

@@ -187,18 +170,17 @@ function generateClientCertAndStorePassphrase {
187170
local COMPONENT="${1}"
188171
local AUTHORITY="${2}"
189172

190-
pki_logger "DEBUG" "${FUNCNAME[0]} called with $# args: COMPONENT=$1, AUTHORITY=$2"
173+
pki_logger "Creating client certificate for COMPONENT: ${AUTHORITY}/${COMPONENT}"
191174

192175
local TYPE_CERTIFICAT="clients"
193-
194-
local CLIENT_CERTIFICATE_PATH=$(getClientCertificatePath ${AUTHORITY} ${COMPONENT})
195-
if [ ! -f "${CLIENT_CERTIFICATE_PATH}/${COMPONENT}.crt" ]; then
196-
# Create the certificate
197-
generateClientCertificate ${COMPONENT} \
176+
local CERTIFICATE_FILE="${CERTIFICATE_DIR}/${AUTHORITY}/${TYPE_CERTIFICAT}/${COMPONENT}/${COMPONENT}.crt"
177+
if [ ! -f "${CERTIFICATE_FILE}" ]; then
178+
# Create the client certificate
179+
generateClientCertificate ${AUTHORITY} \
198180
${TYPE_CERTIFICAT} \
199-
${AUTHORITY}
181+
${COMPONENT}
200182
else
201-
pki_logger "Le certificat ${AUTHORITY} - ${TYPE_CERTIFICAT} - ${COMPONENT} existe déjà, il ne sera pas recréé..."
183+
pki_logger "Certificate ${CERTIFICATE_FILE} already exists, it will not be recreated..."
202184
fi
203185
}
204186

@@ -245,7 +227,7 @@ function main {
245227

246228
ERASE="false"
247229

248-
# Vérification des paramètres
230+
# Parameters check
249231
if [ "${1}" == "" ]; then
250232
pki_logger "ERROR" "This script needs to know on which environment you want to apply to !"
251233
exit 1
@@ -255,16 +237,15 @@ function main {
255237
ERASE="true"
256238
fi
257239
fi
258-
ENVIRONNEMENT="${1}"
259-
ENVIRONNEMENT_FILE="${1}"
240+
ENVIRONMENT_FILE="${1}"
260241

261-
if [ ! -f "${ENVIRONNEMENT_FILE}" ]; then
262-
pki_logger "ERROR" "Cannot find environment file: ${ENVIRONNEMENT_FILE}"
242+
if [ ! -f "${ENVIRONMENT_FILE}" ]; then
243+
pki_logger "ERROR" "Cannot find environment file: ${ENVIRONMENT_FILE}"
263244
exit 1
264245
fi
265246

266247
pki_logger "Input parameters:"
267-
pki_logger " -> Environnement: ${ENVIRONNEMENT}"
248+
pki_logger " -> Environment: ${ENVIRONMENT_FILE}"
268249
pki_logger " -> Erase existing certificates: ${ERASE}"
269250

270251
# Get consul_domain

‎deployment/pki/scripts/lib/commons.sh‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,17 @@ function init () {
2727
hash gawk
2828
}
2929

30+
# Method allowing to determine the list of authorities.
31+
function get_autorities() {
32+
echo "vitamui-services client-external client-vitam"
33+
}
34+
3035
function read_ansible_var {
3136
local ANSIBLE_VAR="${1}"
3237
local ANSIBLE_HOST="${2}"
3338

3439
ANSIBLE_CONFIG="${REPERTOIRE_ROOT}/pki/scripts/lib/ansible.cfg" \
35-
ansible ${ANSIBLE_HOST} -i ${ENVIRONNEMENT_FILE} ${ANSIBLE_VAULT_PASSWD} -m debug -a "var=${ANSIBLE_VAR}" \
40+
ansible ${ANSIBLE_HOST} -i ${ENVIRONMENT_FILE} ${ANSIBLE_VAULT_PASSWD} -m debug -a "var=${ANSIBLE_VAR}" \
3641
| grep "${ANSIBLE_VAR}" | gawk -F ":" '{gsub("\\s","",$2); print $2}'
3742
}
3843

@@ -75,13 +80,13 @@ function initVault {
7580
local VAULT_PASS=$(getVaultPass "$TYPE")
7681

7782
if [ ! -f "${VAULT_FILE}" ]; then
78-
pki_logger "Création du fichier ${VAULT_FILE}"
83+
pki_logger "Creating vault file ${VAULT_FILE}"
7984
mkdir -p "${VAULT_FILE%/*}"
8085
echo '---' > ${VAULT_FILE}
8186
ansible-vault encrypt ${VAULT_FILE} ${VAULT_PASS}
8287
echo '---' > "${VAULT_FILE}.example"
8388
elif [ "$ERASE_VAULT" == "true" ]; then
84-
pki_logger "Réinitialisation du fichier ${VAULT_FILE}"
89+
pki_logger "Resetting vault file ${VAULT_FILE}"
8590
ansible-vault decrypt ${VAULT_FILE} ${VAULT_PASS}
8691
echo '---' > ${VAULT_FILE}
8792
ansible-vault encrypt ${VAULT_FILE} ${VAULT_PASS}

0 commit comments

Comments
 (0)