Skip to content

Commit d5bb88b

Browse files
aarongableaarongable
authored
Ceremony: remove support for delegated CRL and OCSP signers (#8309)
Delegated CRL Signers are forbidden by the Baseline Requirements, and we haven't used Delegated OCSP Responders since 2020. This code is dead, and creates unnecessary complexity, so remove it. At the same time, improve our README to reflect these changes and resolve several formatting lint warnings.
1 parent b9dbcdb commit d5bb88b

File tree

7 files changed

+111
-326
lines changed

7 files changed

+111
-326
lines changed

‎cmd/ceremony/README.md‎

Lines changed: 87 additions & 84 deletions
Large diffs are not rendered by default.

‎cmd/ceremony/cert.go‎

Lines changed: 1 addition & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -76,8 +76,6 @@ type certType int
7676
const (
7777
rootCert certType = iota
7878
intermediateCert
79-
ocspCert
80-
crlCert
8179
crossCert
8280
requestCert
8381
)
@@ -153,23 +151,12 @@ func (profile *certProfile) verifyProfile(ct certType) error {
153151
}
154152

155153
// BR 7.1.2.10.5 CA Certificate Certificate Policies
156-
// OID 2.23.140.1.2.1 is an anyPolicy
154+
// OID 2.23.140.1.2.1 is CABF BRs Domain Validated
157155
if len(profile.Policies) != 1 || profile.Policies[0].OID != "2.23.140.1.2.1" {
158156
return errors.New("policy should be exactly BRs domain-validated for subordinate CAs")
159157
}
160158
}
161159

162-
if ct == ocspCert || ct == crlCert {
163-
if len(profile.KeyUsages) != 0 {
164-
return errors.New("key-usages cannot be set for a delegated signer")
165-
}
166-
if profile.CRLURL != "" {
167-
return errors.New("crl-url cannot be set for a delegated signer")
168-
}
169-
if profile.OCSPURL != "" {
170-
return errors.New("ocsp-url cannot be set for a delegated signer")
171-
}
172-
}
173160
return nil
174161
}
175162

@@ -194,8 +181,6 @@ var stringToKeyUsage = map[string]x509.KeyUsage{
194181
"Cert Sign": x509.KeyUsageCertSign,
195182
}
196183

197-
var oidOCSPNoCheck = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 48, 1, 5}
198-
199184
func generateSKID(pk []byte) ([]byte, error) {
200185
var pkixPublicKey struct {
201186
Algo pkix.AlgorithmIdentifier
@@ -252,11 +237,6 @@ func makeTemplate(randReader io.Reader, profile *certProfile, pubKey []byte, tbc
252237
}
253238
ku |= kuBit
254239
}
255-
if ct == ocspCert {
256-
ku = x509.KeyUsageDigitalSignature
257-
} else if ct == crlCert {
258-
ku = x509.KeyUsageCRLSign
259-
}
260240
if ku == 0 {
261241
return nil, errors.New("at least one key usage must be set")
262242
}
@@ -296,14 +276,6 @@ func makeTemplate(randReader io.Reader, profile *certProfile, pubKey []byte, tbc
296276
// BR 7.1.2.1.2 Root CA Extensions
297277
// Extension Presence Critical Description
298278
// extKeyUsage MUST NOT N -
299-
case ocspCert:
300-
cert.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageOCSPSigning}
301-
// ASN.1 NULL is 0x05, 0x00
302-
ocspNoCheckExt := pkix.Extension{Id: oidOCSPNoCheck, Value: []byte{5, 0}}
303-
cert.ExtraExtensions = append(cert.ExtraExtensions, ocspNoCheckExt)
304-
cert.IsCA = false
305-
case crlCert:
306-
cert.IsCA = false
307279
case requestCert, intermediateCert:
308280
// id-kp-serverAuth is included in intermediate certificates, as required by
309281
// Section 7.1.2.10.6 of the CA/BF Baseline Requirements.

‎cmd/ceremony/cert_test.go‎

Lines changed: 0 additions & 176 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package main
22

33
import (
4-
"bytes"
54
"crypto/ecdsa"
65
"crypto/elliptic"
76
"crypto/rand"
@@ -174,73 +173,6 @@ func TestMakeTemplateRestrictedCrossCertificate(t *testing.T) {
174173
test.AssertEquals(t, cert.ExtKeyUsage[0], x509.ExtKeyUsageServerAuth)
175174
}
176175

177-
func TestMakeTemplateOCSP(t *testing.T) {
178-
s, ctx := pkcs11helpers.NewSessionWithMock()
179-
ctx.GenerateRandomFunc = realRand
180-
randReader := newRandReader(s)
181-
profile := &certProfile{
182-
SignatureAlgorithm: "SHA256WithRSA",
183-
CommonName: "common name",
184-
Organization: "organization",
185-
Country: "country",
186-
OCSPURL: "ocsp",
187-
CRLURL: "crl",
188-
IssuerURL: "issuer",
189-
NotAfter: "2018-05-18 11:31:00",
190-
NotBefore: "2018-05-18 11:31:00",
191-
}
192-
pubKey := samplePubkey()
193-
194-
cert, err := makeTemplate(randReader, profile, pubKey, nil, ocspCert)
195-
test.AssertNotError(t, err, "makeTemplate failed")
196-
197-
test.Assert(t, !cert.IsCA, "IsCA is set")
198-
// Check KU is only KeyUsageDigitalSignature
199-
test.AssertEquals(t, cert.KeyUsage, x509.KeyUsageDigitalSignature)
200-
// Check there is a single EKU with id-kp-OCSPSigning
201-
test.AssertEquals(t, len(cert.ExtKeyUsage), 1)
202-
test.AssertEquals(t, cert.ExtKeyUsage[0], x509.ExtKeyUsageOCSPSigning)
203-
// Check ExtraExtensions contains a single id-pkix-ocsp-nocheck
204-
hasExt := false
205-
asnNULL := []byte{5, 0}
206-
for _, ext := range cert.ExtraExtensions {
207-
if ext.Id.Equal(oidOCSPNoCheck) {
208-
if hasExt {
209-
t.Error("template contains multiple id-pkix-ocsp-nocheck extensions")
210-
}
211-
hasExt = true
212-
if !bytes.Equal(ext.Value, asnNULL) {
213-
t.Errorf("id-pkix-ocsp-nocheck has unexpected content: want %x, got %x", asnNULL, ext.Value)
214-
}
215-
}
216-
}
217-
test.Assert(t, hasExt, "template doesn't contain id-pkix-ocsp-nocheck extensions")
218-
}
219-
220-
func TestMakeTemplateCRL(t *testing.T) {
221-
s, ctx := pkcs11helpers.NewSessionWithMock()
222-
ctx.GenerateRandomFunc = realRand
223-
randReader := newRandReader(s)
224-
profile := &certProfile{
225-
SignatureAlgorithm: "SHA256WithRSA",
226-
CommonName: "common name",
227-
Organization: "organization",
228-
Country: "country",
229-
OCSPURL: "ocsp",
230-
CRLURL: "crl",
231-
IssuerURL: "issuer",
232-
NotAfter: "2018-05-18 11:31:00",
233-
NotBefore: "2018-05-18 11:31:00",
234-
}
235-
pubKey := samplePubkey()
236-
237-
cert, err := makeTemplate(randReader, profile, pubKey, nil, crlCert)
238-
test.AssertNotError(t, err, "makeTemplate failed")
239-
240-
test.Assert(t, !cert.IsCA, "IsCA is set")
241-
test.AssertEquals(t, cert.KeyUsage, x509.KeyUsageCRLSign)
242-
}
243-
244176
func TestVerifyProfile(t *testing.T) {
245177
for _, tc := range []struct {
246178
profile certProfile
@@ -366,114 +298,6 @@ func TestVerifyProfile(t *testing.T) {
366298
},
367299
certType: []certType{rootCert},
368300
},
369-
{
370-
profile: certProfile{
371-
NotBefore: "a",
372-
NotAfter: "b",
373-
SignatureAlgorithm: "c",
374-
CommonName: "d",
375-
Organization: "e",
376-
Country: "f",
377-
IssuerURL: "g",
378-
KeyUsages: []string{"j"},
379-
},
380-
certType: []certType{ocspCert},
381-
expectedErr: "key-usages cannot be set for a delegated signer",
382-
},
383-
{
384-
profile: certProfile{
385-
NotBefore: "a",
386-
NotAfter: "b",
387-
SignatureAlgorithm: "c",
388-
CommonName: "d",
389-
Organization: "e",
390-
Country: "f",
391-
IssuerURL: "g",
392-
CRLURL: "i",
393-
},
394-
certType: []certType{ocspCert},
395-
expectedErr: "crl-url cannot be set for a delegated signer",
396-
},
397-
{
398-
profile: certProfile{
399-
NotBefore: "a",
400-
NotAfter: "b",
401-
SignatureAlgorithm: "c",
402-
CommonName: "d",
403-
Organization: "e",
404-
Country: "f",
405-
IssuerURL: "g",
406-
OCSPURL: "h",
407-
},
408-
certType: []certType{ocspCert},
409-
expectedErr: "ocsp-url cannot be set for a delegated signer",
410-
},
411-
{
412-
profile: certProfile{
413-
NotBefore: "a",
414-
NotAfter: "b",
415-
SignatureAlgorithm: "c",
416-
CommonName: "d",
417-
Organization: "e",
418-
Country: "f",
419-
IssuerURL: "g",
420-
},
421-
certType: []certType{ocspCert},
422-
},
423-
{
424-
profile: certProfile{
425-
NotBefore: "a",
426-
NotAfter: "b",
427-
SignatureAlgorithm: "c",
428-
CommonName: "d",
429-
Organization: "e",
430-
Country: "f",
431-
IssuerURL: "g",
432-
KeyUsages: []string{"j"},
433-
},
434-
certType: []certType{crlCert},
435-
expectedErr: "key-usages cannot be set for a delegated signer",
436-
},
437-
{
438-
profile: certProfile{
439-
NotBefore: "a",
440-
NotAfter: "b",
441-
SignatureAlgorithm: "c",
442-
CommonName: "d",
443-
Organization: "e",
444-
Country: "f",
445-
IssuerURL: "g",
446-
CRLURL: "i",
447-
},
448-
certType: []certType{crlCert},
449-
expectedErr: "crl-url cannot be set for a delegated signer",
450-
},
451-
{
452-
profile: certProfile{
453-
NotBefore: "a",
454-
NotAfter: "b",
455-
SignatureAlgorithm: "c",
456-
CommonName: "d",
457-
Organization: "e",
458-
Country: "f",
459-
IssuerURL: "g",
460-
OCSPURL: "h",
461-
},
462-
certType: []certType{crlCert},
463-
expectedErr: "ocsp-url cannot be set for a delegated signer",
464-
},
465-
{
466-
profile: certProfile{
467-
NotBefore: "a",
468-
NotAfter: "b",
469-
SignatureAlgorithm: "c",
470-
CommonName: "d",
471-
Organization: "e",
472-
Country: "f",
473-
IssuerURL: "g",
474-
},
475-
certType: []certType{crlCert},
476-
},
477301
{
478302
profile: certProfile{
479303
NotBefore: "a",

‎cmd/ceremony/ecdsa.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,9 @@ import (
77
"fmt"
88
"log"
99

10-
"github.com/letsencrypt/boulder/pkcs11helpers"
1110
"github.com/miekg/pkcs11"
11+
12+
"github.com/letsencrypt/boulder/pkcs11helpers"
1213
)
1314

1415
var stringToCurve = map[string]elliptic.Curve{
@@ -70,7 +71,7 @@ func ecPub(
7071
return nil, err
7172
}
7273
if pubKey.Curve != expectedCurve {
73-
return nil, errors.New("Returned EC parameters doesn't match expected curve")
74+
return nil, errors.New("returned EC parameters doesn't match expected curve")
7475
}
7576
log.Printf("\tX: %X\n", pubKey.X.Bytes())
7677
log.Printf("\tY: %X\n", pubKey.Y.Bytes())

‎cmd/ceremony/key.go‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,9 @@ import (
77
"fmt"
88
"log"
99

10-
"github.com/letsencrypt/boulder/pkcs11helpers"
1110
"github.com/miekg/pkcs11"
11+
12+
"github.com/letsencrypt/boulder/pkcs11helpers"
1213
)
1314

1415
type hsmRandReader struct {
@@ -49,7 +50,7 @@ func generateKey(session *pkcs11helpers.Session, label string, outputPath string
4950
{Type: pkcs11.CKA_LABEL, Value: []byte(label)},
5051
})
5152
if err != pkcs11helpers.ErrNoObject {
52-
return nil, fmt.Errorf("expected no preexisting objects with label %q in slot for key storage. got error: %s", label, err)
53+
return nil, fmt.Errorf("expected no preexisting objects with label %q in slot for key storage. got error: %w", label, err)
5354
}
5455

5556
var pubKey crypto.PublicKey
@@ -58,25 +59,25 @@ func generateKey(session *pkcs11helpers.Session, label string, outputPath string
5859
case "rsa":
5960
pubKey, keyID, err = rsaGenerate(session, label, config.RSAModLength)
6061
if err != nil {
61-
return nil, fmt.Errorf("failed to generate RSA key pair: %s", err)
62+
return nil, fmt.Errorf("failed to generate RSA key pair: %w", err)
6263
}
6364
case "ecdsa":
6465
pubKey, keyID, err = ecGenerate(session, label, config.ECDSACurve)
6566
if err != nil {
66-
return nil, fmt.Errorf("failed to generate ECDSA key pair: %s", err)
67+
return nil, fmt.Errorf("failed to generate ECDSA key pair: %w", err)
6768
}
6869
}
6970

7071
der, err := x509.MarshalPKIXPublicKey(pubKey)
7172
if err != nil {
72-
return nil, fmt.Errorf("Failed to marshal public key: %s", err)
73+
return nil, fmt.Errorf("failed to marshal public key: %w", err)
7374
}
7475

7576
pemBytes := pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: der})
7677
log.Printf("Public key PEM:\n%s\n", pemBytes)
7778
err = writeFile(outputPath, pemBytes)
7879
if err != nil {
79-
return nil, fmt.Errorf("Failed to write public key to %q: %s", outputPath, err)
80+
return nil, fmt.Errorf("failed to write public key to %q: %w", outputPath, err)
8081
}
8182
log.Printf("Public key written to %q\n", outputPath)
8283

0 commit comments

Comments
 (0)