Skip to content

Commit bd21f5e

Browse files
GiooDevGiooDev
committed
Story #15673: Updating PKI to use get_authorities function as reference for generating expected authorities.
1 parent e40bd57 commit bd21f5e

File tree

4 files changed

+61
-59
lines changed

4 files changed

+61
-59
lines changed

‎deployment/pki/scripts/generate_certs.sh‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,16 @@ set -e
1313

1414
function generateCerts {
1515

16-
# Copy CA
17-
pki_logger "Recopie des clés publiques des CA"
18-
copyCAFromPki client-external
19-
copyCAFromPki client-vitam
20-
copyCAFromPki vitamui-services
21-
22-
# Generate hosts certificates
23-
pki_logger "Génération des certificats serveurs"
24-
# Zone interne
16+
pki_logger "Copying CA certificates"
17+
for AUTHORITY_NAME in $(get_autorities); do
18+
copyCAFromPki "${AUTHORITY_NAME}"
19+
done
20+
21+
# VitamUI Services
22+
# Server Only for https
2523
generateServerCertAndStorePassphrase security vitamui-services
2624

27-
#Zone externe
25+
# Server and Client for https or mTLS
2826
generateServerAndClientCertAndStorePassphrase iam vitamui-services
2927
generateServerAndClientCertAndStorePassphrase referential vitamui-services
3028
generateServerAndClientCertAndStorePassphrase cas-server vitamui-services
@@ -34,7 +32,7 @@ function generateCerts {
3432
generateServerAndClientCertAndStorePassphrase pastis vitamui-services
3533
generateServerAndClientCertAndStorePassphrase api-gateway vitamui-services
3634

37-
#Zone UI
35+
# Zone UI - Client Only for mTLS
3836
generateClientCertAndStorePassphrase ui-portal vitamui-services
3937
generateClientCertAndStorePassphrase ui-identity vitamui-services
4038
generateClientCertAndStorePassphrase ui-identity-admin vitamui-services
@@ -44,7 +42,7 @@ function generateCerts {
4442
generateClientCertAndStorePassphrase ui-collect vitamui-services
4543
generateClientCertAndStorePassphrase ui-pastis vitamui-services
4644

47-
#Reverse
45+
# Reverse - Server Only for https
4846
generateServerCertAndStorePassphrase reverse vitamui-services
4947

5048
# Example of generated client cert for a customer allowing to perform request on external APIs

‎deployment/pki/scripts/generate_certs_dev.sh‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,16 @@ function getComponentCertificateSan {
2323

2424
function generateCerts {
2525

26-
# Copy CA
27-
pki_logger "Recopie des clés publiques des CA"
28-
copyCAFromPki client-external
29-
copyCAFromPki client-vitam
30-
copyCAFromPki vitamui-services
31-
32-
# Generate hosts certificates
33-
pki_logger "Génération des certificats serveurs"
34-
# Zone interne
26+
pki_logger "Copying CA certificates"
27+
for AUTHORITY_NAME in $(get_autorities); do
28+
copyCAFromPki "${AUTHORITY_NAME}"
29+
done
30+
31+
# VitamUI Services
32+
# Server Only for https
3533
generateServerCertAndStorePassphrase security vitamui-services
3634

37-
#Zone externe
35+
# Server and Client for https or mTLS
3836
generateServerAndClientCertAndStorePassphrase iam vitamui-services
3937
generateServerAndClientCertAndStorePassphrase cas-server vitamui-services
4038
generateServerAndClientCertAndStorePassphrase referential vitamui-services
@@ -44,7 +42,7 @@ function generateCerts {
4442
generateServerAndClientCertAndStorePassphrase pastis vitamui-services
4543
generateServerAndClientCertAndStorePassphrase api-gateway vitamui-services
4644

47-
#Zone UI
45+
# Zone UI - Client Only for mTLS
4846
generateClientCertAndStorePassphrase ui-portal vitamui-services
4947
generateClientCertAndStorePassphrase ui-identity vitamui-services
5048
generateClientCertAndStorePassphrase ui-identity-admin vitamui-services
@@ -54,7 +52,7 @@ function generateCerts {
5452
generateClientCertAndStorePassphrase ui-pastis vitamui-services
5553
generateClientCertAndStorePassphrase ui-collect vitamui-services
5654

57-
#Reverse
55+
# Reverse proxy - Server Only for https
5856
generateServerCertAndStorePassphrase reverse vitamui-services
5957

6058
# Example of generated client cert for a customer allowing to perform request on external APIs

‎deployment/pki/scripts/lib/ca.sh‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,11 @@ function generate_ca_root {
2525

2626
local CA_DIR=${CA_DIR}/${OPENSSL_CA_DIR}
2727
if [ ! -d ${CA_DIR} ]; then
28-
pki_logger "Create directory ${CA_DIR}"
28+
pki_logger "Creating directory ${CA_DIR}"
2929
mkdir -p ${CA_DIR};
3030
fi
3131

32-
pki_logger "Create CA-root request..."
32+
pki_logger "Creating CA-root request..."
3333
openssl req \
3434
-config ${CONFIG_DIR}/ca-config \
3535
-new \
@@ -38,7 +38,7 @@ function generate_ca_root {
3838
-passout pass:${CA_ROOT_PASS} \
3939
-batch
4040

41-
pki_logger "Sign CA-root certificate..."
41+
pki_logger "Signing CA-root certificate..."
4242
openssl ca \
4343
-config ${CONFIG_DIR}/ca-config \
4444
-selfsign \
@@ -64,11 +64,11 @@ function generate_ca_intermediate {
6464

6565
local CA_DIR=${CA_DIR}/${OPENSSL_CA_DIR}
6666
if [ ! -d ${CA_DIR} ]; then
67-
pki_logger "Create directory ${OPENSSL_CA_DIR}"
67+
pki_logger "Creating directory ${OPENSSL_CA_DIR}"
6868
mkdir -p ${CA_DIR};
6969
fi
7070

71-
pki_logger "Create CA-intermediate request..."
71+
pki_logger "Creating CA-intermediate request..."
7272
openssl req \
7373
-config ${CONFIG_DIR}/ca-config \
7474
-new \
@@ -78,7 +78,7 @@ function generate_ca_intermediate {
7878
-passout pass:${CA_INTERMEDIATE_PASS} \
7979
-batch
8080

81-
pki_logger "Sign CA-intermediate certificate..."
81+
pki_logger "Signing CA-intermediate certificate..."
8282
openssl ca \
8383
-config ${CONFIG_DIR}/ca-config \
8484
-extensions extension_ca_intermediate \
@@ -153,7 +153,7 @@ function main() {
153153

154154
# Create CA per authorities
155155
AUTHORITIES="$(get_autorities)"
156-
for AUTHORITY in ${AUTHORITIES[@]}
156+
for AUTHORITY in $AUTHORITIES; do
157157
do
158158
mkdir -p ${CA_DIR}/${AUTHORITY}
159159
init_config_ca ${AUTHORITY}

‎deployment/pki/scripts/lib/stores.sh‎

Lines changed: 34 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ function generateKeystore {
5353
rm -vf ${KEYSTORE_PATH:?}
5454
fi
5555

56-
pki_logger "Generate keystore: ${KEYSTORE_PATH}"
56+
pki_logger "Generating keystore: ${KEYSTORE_PATH}"
5757

5858
mkdir -p "$(dirname "${KEYSTORE_PATH}")"
5959
openssl pkcs12 -export \
@@ -97,41 +97,47 @@ function main() {
9797
# Remove old keystores clients & server directories
9898
find ${KEYSTORES_DIRECTORY:?} -mindepth 1 -maxdepth 1 -type d -exec rm -vrf {} \; #TODO: pk on supprime tout si on a pas mis le erase à true ?
9999

100-
# For each authorities under environments/certs directory (client-external, client-vitam, vitamui-services)
101-
for AUTHORITY_PATH in $( ls -d ${CERTIFICATE_DIR}/{client-external,client-vitam,vitamui-services} ); do
102-
pki_logger "-------------------------------------------"
103-
local AUTHORITY_NAME=$(basename ${AUTHORITY_PATH})
104-
pki_logger "Creating keystores for AUTHORITY: ${AUTHORITY_NAME}"
100+
# Generate stores for each authorities
101+
for AUTHORITY_NAME in $(get_autorities); do
102+
AUTHORITY_PATH="${CERTIFICATE_DIR}/${AUTHORITY_NAME}"
105103

106-
# Could be clients or servers
107-
for TYPE_PATH in $( ls -d ${AUTHORITY_PATH}/{ca,clients,servers} 2>/dev/null || true ); do
108-
local TYPE_NAME=$(basename ${TYPE_PATH})
104+
# Verify the directory exists before processing
105+
if [ -d "$AUTHORITY_PATH" ]; then
106+
pki_logger "-------------------------------------------"
107+
pki_logger "Creating keystores or truststore for AUTHORITY: ${AUTHORITY_NAME}"
109108

110-
if [ "${TYPE_NAME}" == "ca" ]; then
111-
# Generate truststore for CA certificates
112-
pki_logger "Generating truststore for CA certificates: ${AUTHORITY_NAME}"
113-
generateTruststore "${TYPE_PATH}" "${AUTHORITY_NAME}"
114-
continue
115-
fi
109+
# Could be ca, clients or servers
110+
for TYPE_PATH in $( ls -d ${AUTHORITY_PATH}/{ca,clients,servers} 2>/dev/null || true ); do
111+
local TYPE_NAME=$(basename ${TYPE_PATH})
116112

117-
pki_logger "Creating keystores for TYPE: ${AUTHORITY_NAME}/${TYPE_NAME}"
113+
if [ "${TYPE_NAME}" == "ca" ]; then
114+
# Generate truststore for CA certificates
115+
pki_logger "Creating truststore for CA certificates: ${AUTHORITY_NAME}"
116+
generateTruststore "${TYPE_PATH}" "${AUTHORITY_NAME}"
117+
continue
118+
fi
118119

119-
# Generate keystore for each components except for ui-
120-
for COMPONENT in $( ls ${TYPE_PATH} | grep -v -e "README" -e "^ui-" ); do
121-
pki_logger "Creating keystore for COMPONENT: ${AUTHORITY_NAME}/${TYPE_NAME}/${COMPONENT}"
120+
pki_logger "Creating keystores for TYPE: ${AUTHORITY_NAME}/${TYPE_NAME}"
122121

123-
local COMPONENT_CRT_DIR=${CERTIFICATE_DIR}/${AUTHORITY_NAME}/${TYPE_NAME}/${COMPONENT}
124-
local TARGET_KEYSTORE=${KEYSTORES_DIRECTORY}/${AUTHORITY_NAME}/${TYPE_NAME}/keystore_${COMPONENT}.p12
125-
local CRT_KEY_PASSWORD=$(getPassphrase certs "${AUTHORITY_NAME}_${TYPE_NAME}_${COMPONENT}")
126-
local KEYSTORE_PASSWORD=$(setPassphrase keystores "${AUTHORITY_NAME}_${TYPE_NAME}_${COMPONENT}")
122+
# Generate keystore for each components except for ui-
123+
for COMPONENT in $( ls ${TYPE_PATH} | grep -v -e "README" -e "^ui-" ); do
124+
pki_logger "Creating keystore for COMPONENT: ${AUTHORITY_NAME}/${TYPE_NAME}/${COMPONENT}"
127125

128-
generateKeystore "${COMPONENT_CRT_DIR}" \
129-
"${CRT_KEY_PASSWORD}" \
130-
"${TARGET_KEYSTORE}" \
131-
"${KEYSTORE_PASSWORD}"
126+
local COMPONENT_CRT_DIR=${CERTIFICATE_DIR}/${AUTHORITY_NAME}/${TYPE_NAME}/${COMPONENT}
127+
local TARGET_KEYSTORE=${KEYSTORES_DIRECTORY}/${AUTHORITY_NAME}/${TYPE_NAME}/keystore_${COMPONENT}.p12
128+
local CRT_KEY_PASSWORD=$(getPassphrase certs "${AUTHORITY_NAME}_${TYPE_NAME}_${COMPONENT}")
129+
local KEYSTORE_PASSWORD=$(setPassphrase keystores "${AUTHORITY_NAME}_${TYPE_NAME}_${COMPONENT}")
132130

131+
generateKeystore "${COMPONENT_CRT_DIR}" \
132+
"${CRT_KEY_PASSWORD}" \
133+
"${TARGET_KEYSTORE}" \
134+
"${KEYSTORE_PASSWORD}"
135+
136+
done
133137
done
134-
done
138+
else
139+
pki_logger "Skipping: $AUTHORITY_PATH not found"
140+
fi
135141
done
136142

137143
pki_logger "-------------------------------------------"

0 commit comments

Comments
 (0)