Story #15211: separate client and server certificate #3445
+9,216
−5,370
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Collaborator
|
Fixed Issues (57)Great job! The following issues were fixed in this Pull Request
Use @Checkmarx to interact with Checkmarx PR Assistant. |
lotfivitam
requested changes
Jan 6, 2026
Contributor
lotfivitam
left a comment
lotfivitam
left a comment
There was a problem hiding this comment.
Il manque la doc de migration
|
|
||
| generateHostCertAndStorePassphrase "${COMPONENT}" "${HOSTS_GROUP}" | ||
|
|
||
| generateClientCertAndStorePassphrase "${COMPONENT}" "client-vitam" |
Contributor
There was a problem hiding this comment.
Ce ne sont pas plutôt des clients "vitam-ui"?
Comment on lines
+28
to
39
| {{ process(pki_dir + '/client-vitam/clients/cas-server/cas-server.pem', 'cas_context') }} | ||
|
|
||
| {{ process(pki_dir + '/server/hosts/%host%/ui-portal.pem', 'ui_portal_context', 'hosts_ui_portal') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-identity.pem', 'ui_identity_context', 'hosts_ui_identity') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-identity-admin.pem', 'ui_admin_identity_context', 'hosts_ui_identity_admin') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-referential.pem', 'ui_referential_context', 'hosts_ui_referential') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-archive-search.pem', 'ui_archive_search_context', 'hosts_ui_archive_search') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-ingest.pem', 'ui_ingest_context', 'hosts_ui_ingest') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-pastis.pem', 'ui_pastis_context', 'hosts_ui_pastis') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-collect.pem', 'ui_collect_context', 'hosts_ui_collect') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-portal/ui-portal.pem', 'ui_portal_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-identity/ui-identity.pem', 'ui_identity_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-identity-admin/ui-identity-admin.pem', 'ui_admin_identity_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-referential/ui-referential.pem', 'ui_referential_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-archive-search/ui-archive-search.pem', 'ui_archive_search_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-ingest/ui-ingest.pem', 'ui_ingest_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-pastis/ui-pastis.pem', 'ui_pastis_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-collect/ui-collect.pem', 'ui_collect_context') }} | ||
|
|
||
| print("END v8.1.0-00_security.populate_certificates.js"); |
Contributor
There was a problem hiding this comment.
Les scripts mongo sont immutables. Il faut rajouter un nouveau script versionné pour gérer les migrations.
Contributor
There was a problem hiding this comment.
Si ça doit être backporté jusqu'en V8.1, alors le renommer en 3-00, sinon le déplacer dans le répertoire v9.1 si pas besoin de backport.
Comment on lines
+71
to
+74
| keystore: | ||
| key-path: {{ vitamui_folder_conf }}/keystore_client_{{ vitamui_struct.service_name | default(service_name) }}.jks | ||
| key-password: {{ password_client_keystore }} | ||
| type: JKS |
Contributor
There was a problem hiding this comment.
Comment ça pouvait fonctionner avant sans certificat?
| key-password: changeme | ||
| keystore: | ||
| key-path: ../../../dev-deployment/environments/keystores/server/localhost/keystore_archive-search.jks | ||
| key-path: ../../../dev-deployment/environments/keystores/client-vitam/keystore_archive-search.jks |
Contributor
There was a problem hiding this comment.
Les certificats sont générés actuellement par instance. Pour chaque hostname, un certificat client était créé.
En d'autres termes, si on a 3 instances archive-search sur les vm-1, vm-2 et vm-3, la PKI existante générait un certificat par hostname.
Y'a t-il une raison à ce changement de doctrine?
Perso, je n'ai pas de contre indication réelle à générer un certificat client commun si ça permet de simplifier la PKI, mais dans ce cas, il faudrait que ça soit fait également pour les certificats serveur.
GiooDev
requested changes
Jan 7, 2026
Contributor
GiooDev
left a comment
GiooDev
left a comment
There was a problem hiding this comment.
Ne pas oublier de mettre à jour deployment/roles/reinit_security_certificates/templates/security.populate_certificates.js.j2
Ne pas oublier de mettre à jour la documentation de migration associée.
Comment on lines
+28
to
39
| {{ process(pki_dir + '/client-vitam/clients/cas-server/cas-server.pem', 'cas_context') }} | ||
|
|
||
| {{ process(pki_dir + '/server/hosts/%host%/ui-portal.pem', 'ui_portal_context', 'hosts_ui_portal') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-identity.pem', 'ui_identity_context', 'hosts_ui_identity') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-identity-admin.pem', 'ui_admin_identity_context', 'hosts_ui_identity_admin') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-referential.pem', 'ui_referential_context', 'hosts_ui_referential') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-archive-search.pem', 'ui_archive_search_context', 'hosts_ui_archive_search') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-ingest.pem', 'ui_ingest_context', 'hosts_ui_ingest') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-pastis.pem', 'ui_pastis_context', 'hosts_ui_pastis') }} | ||
| {{ process(pki_dir + '/server/hosts/%host%/ui-collect.pem', 'ui_collect_context', 'hosts_ui_collect') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-portal/ui-portal.pem', 'ui_portal_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-identity/ui-identity.pem', 'ui_identity_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-identity-admin/ui-identity-admin.pem', 'ui_admin_identity_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-referential/ui-referential.pem', 'ui_referential_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-archive-search/ui-archive-search.pem', 'ui_archive_search_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-ingest/ui-ingest.pem', 'ui_ingest_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-pastis/ui-pastis.pem', 'ui_pastis_context') }} | ||
| {{ process(pki_dir + '/client-vitam/clients/ui-collect/ui-collect.pem', 'ui_collect_context') }} | ||
|
|
||
| print("END v8.1.0-00_security.populate_certificates.js"); |
Contributor
There was a problem hiding this comment.
Si ça doit être backporté jusqu'en V8.1, alors le renommer en 3-00, sinon le déplacer dans le répertoire v9.1 si pas besoin de backport.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Séparation des certificats client et serveur pour les échanges mTLS