Story #15673 & #15675: feat(pki) - Migrate to PKCS12 and optimize certificate generation. by GiooDev · Pull Request #3535 · ProgrammeVitam/vitam-ui

GiooDev · 2026-02-02T18:14:17Z

Description

Updating PKI

Remove unnecessary timestamping configurations.
Do not generate keystores for UI components.
Migrate keystores and truststores from proprietary JKS (Java KeyStore) format to industry-standard PKCS12 format.
Generate pem certs only for services needed to be loaded in database security/certificates (cas-server & ui-*).

Ansible

Update certificates loaded in the database conditionally, based on hosts defined in groups. Unwanted components are not loaded in security/certificates database.
Deploying keystores and truststores as p12 instead of jks.

Type de changement

PKI
Ansiblerie
Correction
Refactorisation de code

Contributeur

Programme Vitam

vitam-prg · 2026-02-02T18:19:53Z

Checkmarx One – Scan Summary & Details – cdc1a7c6-6480-4ff0-83bf-00d76b44744e

New Issues (2)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2026-2391	Npm-qs-6.14.1	details Recommended version: 6.14.2 Description: ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to c... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
2		CVE-2026-2391	Npm-qs-6.10.3	details Recommended version: 6.10.6 Description: ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to c... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package

Fixed Issues (14)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	~~CVE-2025-64087~~	Maven-fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker-2.1.0
	~~Log_Forging~~	/api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 80
	~~Log_Forging~~	/api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 106
	~~Log_Forging~~	/api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 65
	~~Log_Forging~~	/api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 80
	~~Log_Forging~~	/api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 105
	~~Log_Forging~~	/api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 105
	~~Log_Forging~~	/api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 106
	~~Log_Forging~~	/api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 80
	~~Log_Forging~~	/api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 80
	~~Log_Forging~~	/api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 81
	~~Log_Forging~~	/api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 105
	~~Log_Forging~~	/api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 106
	~~Log_Forging~~	/api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 65

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

deployment/roles/vitamui/tasks/referential.yml

GiooDev · 2026-02-06T19:05:08Z

cas/cas-server/src/main/config/cas-server-application-recette.yml

À quoi ça sert d'avoir 2 fichiers application.yml ? Il y a des usages différents dans certains cas ?

En tout cas il ne semble utilisé nulle part.

GiooDev · 2026-02-06T19:06:53Z

cas/cas-server/README.md


 1) Retrieval of the IdP metadata, IdP metadata are ignored, so test metdata can be used instead
-2) Creation of a keystore for the IdP: `keytool -genkeypair -alias idp-test -keypass password -keystore idp-test-keystore.jks -storepass password -keyalg RSA -keysize 2048 -validity 3650`
+2) Creation of a keystore for the IdP: `keytool -genkeypair -alias idp-test -keypass password -keystore idp-test-keystore.p12 -storepass password -keyalg RSA -keysize 2048 -validity 3650`


Il faut probablement rajouter un peu partout le paramètre -storetype PKCS12

GiooDev · 2026-02-06T19:08:43Z

api/api-referential/referential/src/test/resources/application.yml

Y'en a besoin dans les 2 chemins ? main & test ?

Un peu chiant à maintenir on peut pas centraliser sur un seul ?

GiooDev · 2026-02-13T18:30:15Z

deployment/roles/vitamui/tasks/main.yml

+      notify: restart service
+
+    # Copy the client-external truststore to authorize external applications to communicate with vitamui components.
+    - name: Copy client-external truststore


Need to fix this later ? Currently we can't call with client-external certificates the APIs.

deployment/roles/vitamui/templates/collect/application.yml.j2

GiooDev · 2026-02-13T18:34:15Z

deployment/roles/vitamui/templates/collect/application.yml.j2

-    trust-store-password: {{ truststores_vitamui }}
+    key-store: {{ vitamui_folder_conf }}/keystore_server_{{ vitamui_struct.vitamui_component }}.p12
+    key-store-password: {{ keystore_vitamui_services_servers_collect }}
+    # key-password: {{ keystore_vitamui_services_servers_collect }}


Useless as the key stored in the keystore doesn't have a password.

Is it usefull if we remove -nodes parameters for generate_certs ?

GiooDev · 2026-02-13T18:34:54Z

deployment/roles/vitamui/templates/cas-server/application.yml.j2

-    key-password: {{ password_keystore_server }}
+    key-store: {{ vitamui_folder_conf }}/keystore_server_{{ vitamui_struct.vitamui_component }}.p12
+    key-store-password: {{ keystore_vitamui_services_servers_cas_server }}
+    key-password: {{ keystore_vitamui_services_servers_cas_server }}


But needed for cas-server, otherwise it won't start...

GiooDev · 2026-02-13T18:35:36Z

deployment/roles/vitamui/templates/iam/application.yml.j2

+    # key-password: {{ keystore_vitamui_services_servers_iam }}
+    trust-store: {{ vitamui_folder_conf }}/truststore_vitamui-services.p12
+    trust-store-password: {{ truststore_vitamui_services }}
    client-auth: want


Everybody calls it with a certificate, do we need to update it to client-auth: need ?

GiooDev · 2026-02-13T19:00:20Z

deployment/pki/scripts/lib/certs.sh

+        -passout pass:"${KEY_PASS}" \
+        -keyout "${SERVER_CERTIFICATE_PATH}/${COMPOSANT}.key" \
+        -out "${SERVER_CERTIFICATE_PATH}/${COMPOSANT}.req" \
        -nodes \


For later, remove -nodes.

Now that the variables are fully correct between generate_certs and generate_stores, it could be reactivated.

Need more test for clients for UI-* components configured with nginx to put the associated passphrase. Not the same vault used to store certs passphrases and keystores passphrases.

More coherent variables. Updating comments and logs in english.

…(Java KeyStore) format to industry-standard PKCS12 format. This eliminates the keytool warning and aligns with modern Java best practices.

…e of pki scripts.

…rchitecture. * Regenerate new passphrase for certs & keystores everytime we execute scripts. * Do not generate server certs for UI-* components, currently not supported.

GiooDev · 2026-02-15T18:56:25Z

deployment/pki/scripts/lib/stores.sh

-    # Remove old keystores & servers directories
-    find ${REPERTOIRE_KEYSTORES} -mindepth 1 -maxdepth 1 -type d -exec rm -rf {} \;
+    # Remove old keystores clients & server directories
+    find ${KEYSTORES_DIRECTORY:?} -mindepth 1 -maxdepth 1 -type d -exec rm -vrf {} \;


Pourquoi on supprime ici sans vérifier si on a mis le ERASE à true ?

* Using get_authorities function as reference for generating expected authorities. * Simplification of scripts avoiding useless functions. * Keep translating to english.

GiooDev added this to the IT 165 milestone Feb 2, 2026

GiooDev self-assigned this Feb 2, 2026

GiooDev added Security Modules update OPS REVIEW Mandatory if deployment/ directory is modified. labels Feb 2, 2026

GiooDev force-pushed the story_15673 branch 2 times, most recently from fd0cb24 to f66e6ca Compare February 2, 2026 19:03

GiooDev changed the title ~~Story #15673: Major PKI cleaning~~ Story #15673 & #15675: Major PKI cleaning Feb 2, 2026

GiooDev force-pushed the story_15673 branch 4 times, most recently from 9d993bd to 5c002f1 Compare February 2, 2026 22:12

GiooDev mentioned this pull request Feb 3, 2026

Story #15211: Cleaning PKI. #3509

Draft

GiooDev changed the title ~~Story #15673 & #15675: Major PKI cleaning~~ Story #15673 & #15675: feat(pki) - Migrate to PKCS12 and optimize certificate generation. Feb 3, 2026

GiooDev requested review from bbenaissa, lotfivitam and mkhediri February 3, 2026 10:35

bbenaissa approved these changes Feb 4, 2026

View reviewed changes

mkhediri reviewed Feb 4, 2026

View reviewed changes

deployment/roles/vitamui/tasks/referential.yml Show resolved Hide resolved

GiooDev force-pushed the story_15673 branch 11 times, most recently from 987dfae to 7420b46 Compare February 13, 2026 17:35

GiooDev commented Feb 13, 2026

View reviewed changes

GiooDev requested a review from bbenaissa February 13, 2026 18:38

GiooDev force-pushed the story_15673 branch from e7af28a to afe05a8 Compare February 13, 2026 18:57

GiooDev commented Feb 13, 2026

View reviewed changes

GiooDev force-pushed the story_15673 branch from afe05a8 to c0b4ea7 Compare February 13, 2026 21:52

GiooDev added 9 commits February 14, 2026 16:44

Story #15673: Load only selected components in database.

952b2dd

Story #15673: Removing useless timestamping elements.

161bdfe

Story #15673: Cleaning CA & Certs scripts.

2296640

More coherent variables. Updating comments and logs in english.

Story #15673: Generating pem certificates only for mandatory components.

88d5948

Story #15673: Do not generate keystore for UI components.

790b2e3

Story #15675: Migrate keystores and truststores from proprietary JKS …

3f9ced6

…(Java KeyStore) format to industry-standard PKCS12 format. This eliminates the keytool warning and aligns with modern Java best practices.

Story #15673: Trying to avoid "career-ender" problems.

c94c1c7

Story #15673: Fully rewriting generate_stores scripts.

e7ce304

Story #15675: Migrate dev keystores from jks to p12 after full rewrit…

cfdbd83

…e of pki scripts.

GiooDev force-pushed the story_15673 branch 3 times, most recently from cfefcba to 6f5ae54 Compare February 15, 2026 14:49

Story #15673: Updating generate_certs scripts to align with current a…

e40bd57

…rchitecture. * Regenerate new passphrase for certs & keystores everytime we execute scripts. * Do not generate server certs for UI-* components, currently not supported.

GiooDev force-pushed the story_15673 branch 4 times, most recently from a923663 to 78cc0ae Compare February 15, 2026 18:54

GiooDev commented Feb 15, 2026

View reviewed changes

GiooDev force-pushed the story_15673 branch 4 times, most recently from 13c9c69 to c0d4e18 Compare February 15, 2026 22:43

GiooDev requested a review from mkhediri February 15, 2026 22:53

Story #15673: Updating PKI.

ce903c6

* Using get_authorities function as reference for generating expected authorities. * Simplification of scripts avoiding useless functions. * Keep translating to english.

GiooDev force-pushed the story_15673 branch from c0d4e18 to ce903c6 Compare February 16, 2026 10:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Story #15673 & #15675: feat(pki) - Migrate to PKCS12 and optimize certificate generation.#3535

Story #15673 & #15675: feat(pki) - Migrate to PKCS12 and optimize certificate generation.#3535
GiooDev wants to merge 11 commits intodevelopfrom
story_15673

GiooDev commented Feb 2, 2026 •

edited

Loading

Uh oh!

vitam-prg commented Feb 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

GiooDev Feb 6, 2026

Uh oh!

GiooDev Feb 6, 2026

Uh oh!

GiooDev Feb 6, 2026

Uh oh!

GiooDev Feb 13, 2026

Uh oh!

Uh oh!

GiooDev Feb 13, 2026

Uh oh!

GiooDev Feb 14, 2026

Uh oh!

GiooDev Feb 13, 2026

Uh oh!

GiooDev Feb 13, 2026

Uh oh!

GiooDev Feb 13, 2026

Uh oh!

GiooDev Feb 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

GiooDev commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Updating PKI

Ansible

Type de changement

Contributeur

Uh oh!

vitam-prg commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

GiooDev commented Feb 2, 2026 •

edited

Loading

vitam-prg commented Feb 2, 2026 •

edited

Loading