Skip to content

Update KRA tests #5417

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
edewata merged 1 commit into from
Aug 12, 2026
+819 −198
Merged

Update KRA tests #5417

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
133 changes: 133 additions & 0 deletions .github/workflows/kra-basic-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,17 @@ jobs:
-D pki_audit_signing_nickname= \
-v

- name: Check keywrap config in CA
run: |
# OAEP should be disabled
docker exec pki pki-server ca-config-find \
| sed -n \
-e '/^keyWrap\./p' \
| sort \
| tee output

diff /dev/null output

- name: Check security domain config in CA
run: |
# CA should run security domain service
Expand Down Expand Up @@ -383,6 +394,86 @@ jobs:

diff expected_$TOMCAT_FLAVOR output

- name: Check keywrap config in KRA
run: |
# OAEP should be disabled
docker exec pki pki-server kra-config-find \
| sed -n \
-e '/^keyWrap\./p' \
| sort \
| tee output

diff /dev/null output

- name: Check transport unit config in KRA
run: |
docker exec pki pki-server kra-config-find \
| sed -n \
-e '/^kra\.transportUnit\./p' \
| sort \
| tee output

cat > expected << EOF
kra.transportUnit.nickName=kra_transport
kra.transportUnit.signingAlgorithm=SHA256withRSA
EOF

diff expected output

- name: Check storage unit config in KRA
run: |
docker exec pki pki-server kra-config-find \
| sed -n \
-e '/^kra\.storageUnit\.wrapping\._/d' \
-e '/^kra\.storageUnit\./p' \
| sort \
| tee output

cat > expected << EOF
kra.storageUnit.nickName=kra_storage
kra.storageUnit.wrapping.0.payloadEncryptionAlgorithm=DESede
kra.storageUnit.wrapping.0.payloadEncryptionIV=AQEBAQEBAQE=
kra.storageUnit.wrapping.0.payloadEncryptionMode=CBC
kra.storageUnit.wrapping.0.payloadEncryptionPadding=PKCS5Padding
kra.storageUnit.wrapping.0.payloadWrapAlgorithm=DES3/CBC/Pad
kra.storageUnit.wrapping.0.payloadWrapIV=AQEBAQEBAQE=
kra.storageUnit.wrapping.0.sessionKeyKeyGenAlgorithm=DESede
kra.storageUnit.wrapping.0.sessionKeyLength=168
kra.storageUnit.wrapping.0.sessionKeyType=DESede
kra.storageUnit.wrapping.0.sessionKeyWrapAlgorithm=RSA
kra.storageUnit.wrapping.1.payloadEncryptionAlgorithm=AES
kra.storageUnit.wrapping.1.payloadEncryptionIVLen=16
kra.storageUnit.wrapping.1.payloadEncryptionMode=CBC
kra.storageUnit.wrapping.1.payloadEncryptionPadding=PKCS5Padding
kra.storageUnit.wrapping.1.payloadWrapAlgorithm=AES KeyWrap/Padding
kra.storageUnit.wrapping.1.sessionKeyKeyGenAlgorithm=AES
kra.storageUnit.wrapping.1.sessionKeyLength=128
kra.storageUnit.wrapping.1.sessionKeyType=AES
kra.storageUnit.wrapping.1.sessionKeyWrapAlgorithm=RSA
kra.storageUnit.wrapping.2.payloadEncryptionAlgorithm=AES
kra.storageUnit.wrapping.2.payloadEncryptionIVLen=16
kra.storageUnit.wrapping.2.payloadEncryptionMode=CBC
kra.storageUnit.wrapping.2.payloadEncryptionPadding=PKCS5Padding
kra.storageUnit.wrapping.2.payloadWrapAlgorithm=AES KeyWrap/Padding
kra.storageUnit.wrapping.2.sessionKeyLength=256
kra.storageUnit.wrapping.2.sessionKeyType=AES
kra.storageUnit.wrapping.choice=1
EOF

diff expected output

- name: "Check PKCS #12 encryption config in KRA"
run: |
# PKCS #12 encryption should not be configured
docker exec pki pki-server kra-config-find \
| sed -n \
-e '/^kra\.legacyPKCS12=/p' \
-e '/^kra\.nonLegacyAlg=/p' \
| sort \
| tee output

diff /dev/null output

- name: Check PKI server system certs
run: |
docker exec pki pki-server cert-find
Expand Down Expand Up @@ -509,6 +600,48 @@ jobs:
sed -n '/^Command:/p' stderr | tee output
wc -l output

- name: Check CA info
run: |
cat > expected << EOF
{
"ArchivalMechanism": "keywrap",
"EncryptionAlgorithm": "AES/CBC/PKCS5Padding",
"KeyWrapAlgorithm": "AES KeyWrap/Padding",
"RsaPublicKeyWrapAlgorithm": "RSA",
"CaRsaPublicKeyWrapAlgorithm": "RSA",
"Attributes": {
"Attribute": []
}
}
EOF

docker exec pki curl -ks https://pki.example.com:8443/ca/v2/info \
| python -m json.tool \
| tee actual

diff expected actual

- name: Check KRA info
run: |
cat > expected << EOF
{
"ArchivalMechanism": "keywrap",
"RecoveryMechanism": "keywrap",
"EncryptionAlgorithm": "AES/CBC/PKCS5Padding",
"WrapAlgorithm": "AES KeyWrap/Padding",
"RsaPublicKeyWrapAlgorithm": "RSA",
"Attributes": {
"Attribute": []
}
}
EOF

docker exec pki curl -ks https://pki.example.com:8443/kra/v2/info \
| python -m json.tool \
| tee actual

diff expected actual

- name: Check KRA admin
run: |
docker exec pki pki-server cert-export \
Expand Down
99 changes: 99 additions & 0 deletions .github/workflows/kra-ecc-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,63 @@ jobs:
-D pki_ds_url=ldap://ds.example.com:3389 \
-v

- name: Check transport unit config in KRA
run: |
docker exec pki pki-server kra-config-find \
| sed -n \
-e '/^kra\.transportUnit\./p' \
| sort \
| tee output

cat > expected << EOF
kra.transportUnit.nickName=kra_transport
kra.transportUnit.signingAlgorithm=SHA384withRSA
EOF

diff expected output

- name: Check storage unit config in KRA
run: |
docker exec pki pki-server kra-config-find \
| sed -n \
-e '/^kra\.storageUnit\.wrapping\._/d' \
-e '/^kra\.storageUnit\./p' \
| sort \
| tee output

cat > expected << EOF
kra.storageUnit.nickName=kra_storage
kra.storageUnit.wrapping.0.payloadEncryptionAlgorithm=DESede
kra.storageUnit.wrapping.0.payloadEncryptionIV=AQEBAQEBAQE=
kra.storageUnit.wrapping.0.payloadEncryptionMode=CBC
kra.storageUnit.wrapping.0.payloadEncryptionPadding=PKCS5Padding
kra.storageUnit.wrapping.0.payloadWrapAlgorithm=DES3/CBC/Pad
kra.storageUnit.wrapping.0.payloadWrapIV=AQEBAQEBAQE=
kra.storageUnit.wrapping.0.sessionKeyKeyGenAlgorithm=DESede
kra.storageUnit.wrapping.0.sessionKeyLength=168
kra.storageUnit.wrapping.0.sessionKeyType=DESede
kra.storageUnit.wrapping.0.sessionKeyWrapAlgorithm=RSA
kra.storageUnit.wrapping.1.payloadEncryptionAlgorithm=AES
kra.storageUnit.wrapping.1.payloadEncryptionIVLen=16
kra.storageUnit.wrapping.1.payloadEncryptionMode=CBC
kra.storageUnit.wrapping.1.payloadEncryptionPadding=PKCS5Padding
kra.storageUnit.wrapping.1.payloadWrapAlgorithm=AES KeyWrap/Padding
kra.storageUnit.wrapping.1.sessionKeyKeyGenAlgorithm=AES
kra.storageUnit.wrapping.1.sessionKeyLength=128
kra.storageUnit.wrapping.1.sessionKeyType=AES
kra.storageUnit.wrapping.1.sessionKeyWrapAlgorithm=RSA
kra.storageUnit.wrapping.2.payloadEncryptionAlgorithm=AES
kra.storageUnit.wrapping.2.payloadEncryptionIVLen=16
kra.storageUnit.wrapping.2.payloadEncryptionMode=CBC
kra.storageUnit.wrapping.2.payloadEncryptionPadding=PKCS5Padding
kra.storageUnit.wrapping.2.payloadWrapAlgorithm=AES KeyWrap/Padding
kra.storageUnit.wrapping.2.sessionKeyLength=256
kra.storageUnit.wrapping.2.sessionKeyType=AES
kra.storageUnit.wrapping.choice=1
EOF

diff expected output

- name: Check KRA storage cert
run: |
docker exec pki openssl req -text -noout \
Expand Down Expand Up @@ -206,6 +263,48 @@ jobs:
sed -n -e "s/\s*$//" -e "s/^\s*Signature Algorithm:\s*\(.*\)$/\1/p" output | uniq > actual
diff expected actual

- name: Check CA info
run: |
cat > expected << EOF
{
"ArchivalMechanism": "keywrap",
"EncryptionAlgorithm": "AES/CBC/PKCS5Padding",
"KeyWrapAlgorithm": "AES KeyWrap/Padding",
"RsaPublicKeyWrapAlgorithm": "RSA",
"CaRsaPublicKeyWrapAlgorithm": "RSA",
"Attributes": {
"Attribute": []
}
}
EOF

docker exec pki curl -ks https://pki.example.com:8443/ca/v2/info \
| python -m json.tool \
| tee actual

diff expected actual

- name: Check KRA info
run: |
cat > expected << EOF
{
"ArchivalMechanism": "keywrap",
"RecoveryMechanism": "keywrap",
"EncryptionAlgorithm": "AES/CBC/PKCS5Padding",
"WrapAlgorithm": "AES KeyWrap/Padding",
"RsaPublicKeyWrapAlgorithm": "RSA",
"Attributes": {
"Attribute": []
}
}
EOF

docker exec pki curl -ks https://pki.example.com:8443/kra/v2/info \
| python -m json.tool \
| tee actual

diff expected actual

- name: Run PKI healthcheck
run: docker exec pki pki-healthcheck --failures-only

Expand Down
Loading
Loading