Skip to content

Commit ebe1cdc

Browse files
jiparisjiparis
authored
feat(signing): docs for EJBCA integration (#1265)
Signed-off-by: Jose I. Paris <[email protected]>
1 parent b0fb5e9 commit ebe1cdc

File tree

2 files changed

+155
-0
lines changed

2 files changed

+155
-0
lines changed

‎docs/docs/guides/ejbca/chainloop-ejbca-sequence.png‎

195 KB
Loading

‎docs/docs/guides/ejbca/ejbca.md‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
---
2+
title: Use Keyfactor EJBCA to generate ephemeral signing certificates
3+
categories:
4+
- signing
5+
- keyfactor
6+
---
7+
8+
### Summary
9+
Chainloop Vault can be configured to generate signing certs by using EJBCA as the certificate authority, when signing in "key-less" mode:
10+
EJBCA is a popular open source PKI, check it out at https://www.ejbca.org/.
11+
12+
### Prerequisites:
13+
If your organization doesn't have it already, you can follow these tutorials for a basic setup of EJBCA PKI solution.
14+
15+
Requirements:
16+
1. EJBCA is deployed following the [Quick Start Guide - Start EJBCA Container with Client Certificate Authenticated Access](https://docs.keyfactor.com/ejbca/latest/quick-start-guide-start-ejbca-container-with-clien)
17+
2. EJBCA is configured for issuing signing certificates. Check the Step 2 at [Tutorial - SignServer Container Signing with Cosign](https://docs.keyfactor.com/signserver/latest/tutorial-signserver-container-signing-with-cosign#id-(6.3latest)Tutorial-SignServerContainerSigningwithCosign-Step2-Issuesigningcertificate)
18+
3. EJBCA [Certificate Management APIs](https://doc.primekey.com/ejbca/ejbca-operations/ejbca-ca-concept-guide/protocols/ejbca-rest-interface#EJBCARESTInterface-GettingStartedgetting_started) are enabled.
19+
20+
### Configure Chainloop to use EJBCA as CA
21+
Check `ejbca_cA` section in Chainloop configuration options. In particular, set these values in your [config.yaml](https://github.com/chainloop-dev/chainloop/blob/main/app/controlplane/configs/config.devel.yaml) (these values are also mapped to the [chart values.yaml](https://github.com/chainloop-dev/chainloop/blob/main/deployment/chainloop/values.yaml#L668) file):
22+
```yaml
23+
certificate_authority:
24+
ejbca_ca:
25+
# Where EJBCA service is located
26+
server_url: "https://localhost/ejbca"
27+
28+
# Cert and private key for Client cert authentication against EJBCA
29+
key_path: "../../devel/devkeys/superadmin.key"
30+
cert_path: "../../devel/devkeys/superadmin.pem"
31+
32+
# Certificate chain
33+
root_ca_path: "../../devel/devkeys/ManagementCA.pem"
34+
35+
# EJBCA profile, end entity and CA names
36+
certificate_profile_name: "PlainSigner"
37+
end_entity_profile_name: "PlainSigner"
38+
certificate_authority_name: "ManagementCA"
39+
```
40+
41+
### Signing Chainloop attestations with EJBCA issued certificates
42+
43+
Using the following command (note that no `key` is provided), the following sequence of events will happen:
44+
1. Chainloop CLI creates a certificate request, and sends it to Chainloop
45+
2. Chainloop forwards the request to EJBCA's `v1/certificate/pkcs10enroll` API, which generates a new short-lived certificate for signing
46+
3. Chainloop CLI signs the In-toto payload, and sends the statement to Chainloop for storage.
47+
48+
```shell
49+
> chainloop attestation push --bundle bundle.json
50+
```
51+
52+
![chainloop-ejbca-sequence.png](chainloop-ejbca-sequence.png)
53+
54+
### Full example
55+
56+
#### Crafting and signing an attestation.
57+
```shell
58+
> chainloop att init --replace --name mywf
59+
INF Attestation initialized! now you can check its status or add materials to it
60+
┌───────────────────┬──────────────────────────────────────┐
61+
│ Initialized At │ 25 Jun 24 10:49 UTC │
62+
├───────────────────┼──────────────────────────────────────┤
63+
│ Attestation ID │ 966b2426-e5a6-4805-91ff-e4ea1e95c5ea │
64+
│ Name │ mywf │
65+
│ Team │ │
66+
│ Project │ myproject │
67+
│ Contract Revision │ 1 │
68+
└───────────────────┴──────────────────────────────────────┘
69+
70+
> chainloop att add --value evidence.txt
71+
INF material kind detected kind=ARTIFACT
72+
INF material added to attestation
73+
74+
> chainloop --debug att push --bundle bundle-with-ejbca.json
75+
INF generating Sigstore bundle bundle-with-ejbca.json
76+
INF push completed
77+
┌───────────────────┬──────────────────────────────────────┐
78+
│ Initialized At │ 25 Jun 24 10:49 UTC │
79+
├───────────────────┼──────────────────────────────────────┤
80+
│ Attestation ID │ 966b2426-e5a6-4805-91ff-e4ea1e95c5ea │
81+
│ Name │ mywf │
82+
│ Team │ │
83+
│ Project │ myproject │
84+
│ Contract Revision │ 1 │
85+
└───────────────────┴──────────────────────────────────────┘
86+
┌────────────────────────────────────────────────────────────────────────────────────┐
87+
│ Materials │
88+
├──────────┬─────────────────────────────────────────────────────────────────────────┤
89+
│ Name │ material-1719312595918293000 │
90+
│ Type │ ARTIFACT │
91+
│ Set │ Yes │
92+
│ Required │ No │
93+
│ Value │ evidence.txt │
94+
│ Digest │ sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 │
95+
└──────────┴─────────────────────────────────────────────────────────────────────────┘
96+
Attestation Digest: sha256:bafaffc629d5ffe4c3b6519b740459db6883a55c6092c438426ded7ec328f135
97+
```
98+
99+
#### Storing and inspecting the generated certificate:
100+
```shell
101+
> cat bundle-with-ejbca.json | jq -r ".verificationMaterial.x509CertificateChain.certificates.[].rawBytes" | base64 --decode | openssl x509 -inform DER -outform PEM > signingcert.pem
102+
103+
> cat signingcert.pem | openssl x509 -text
104+
Certificate:
105+
Data:
106+
Version: 3 (0x2)
107+
Serial Number:
108+
6f:42:e2:ec:6d:b3:25:41:97:6d:66:3b:73:fc:dc:d2:cc:67:c7:ce
109+
Signature Algorithm: sha256WithRSAEncryption
110+
Issuer: UID=c-0kxd0tu03vo9bdv86, CN=ManagementCA, O=EJBCA Container Quickstart
111+
Validity
112+
Not Before: Jun 25 10:49:04 2024 GMT
113+
Not After : Jun 25 10:49:03 2025 GMT
114+
Subject: CN=fce05d49-b633-4862-be1d-3345081ecaea
115+
...
116+
```
117+
118+
#### Verifying the attestation
119+
120+
Verifying the attestation requires the signing cert extracted from the bundle and the root CA (provided by your organization out-of-band):
121+
```shell
122+
> chainloop wf run describe --digest sha256:bafaffc629d5ffe4c3b6519b740459db6883a55c6092c438426ded7ec328f135 --verify true --cert signingcert.pem --cert-chain ../keyfactor/ManagementCA.pem
123+
WRN Both user credentials and $CHAINLOOP_TOKEN set. Ignoring $CHAINLOOP_TOKEN.
124+
┌──────────────────────────────────────────────────────────────────────────────────────────┐
125+
│ Workflow │
126+
├────────────────┬─────────────────────────────────────────────────────────────────────────┤
127+
│ ID │ eb7b4633-96e2-4efe-b23f-f667f3f7acdc │
128+
│ Name │ mywf │
129+
│ Team │ │
130+
│ Project │ myproject │
131+
├────────────────┼─────────────────────────────────────────────────────────────────────────┤
132+
│ Workflow Run │ │
133+
├────────────────┼─────────────────────────────────────────────────────────────────────────┤
134+
│ ID │ 966b2426-e5a6-4805-91ff-e4ea1e95c5ea │
135+
│ Initialized At │ 25 Jun 24 10:49 UTC │
136+
│ Finished At │ 25 Jun 24 10:59 UTC │
137+
│ State │ success │
138+
│ Runner Link │ │
139+
├────────────────┼─────────────────────────────────────────────────────────────────────────┤
140+
│ Statement │ │
141+
├────────────────┼─────────────────────────────────────────────────────────────────────────┤
142+
│ Payload Type │ application/vnd.in-toto+json │
143+
│ Digest │ sha256:bafaffc629d5ffe4c3b6519b740459db6883a55c6092c438426ded7ec328f135 │
144+
│ Verified │ true │
145+
└────────────────┴─────────────────────────────────────────────────────────────────────────┘
146+
┌────────────────────────────────────────────────────────────────────────────────────┐
147+
│ Materials │
148+
├──────────┬─────────────────────────────────────────────────────────────────────────┤
149+
│ Name │ material-1719312595918293000 │
150+
│ Type │ ARTIFACT │
151+
│ Filename │ evidence.txt │
152+
│ Digest │ sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 │
153+
└──────────┴─────────────────────────────────────────────────────────────────────────┘
154+
155+
```

0 commit comments

Comments
 (0)