2018-10-05 21:48:36 +00:00
|
|
|
package ca
|
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto/tls"
|
|
|
|
"crypto/x509"
|
2019-05-27 00:41:10 +00:00
|
|
|
"fmt"
|
2019-04-25 19:37:25 +00:00
|
|
|
"log"
|
2018-10-05 21:48:36 +00:00
|
|
|
"net/http"
|
2019-05-27 00:41:10 +00:00
|
|
|
"net/url"
|
2019-05-10 22:58:37 +00:00
|
|
|
"reflect"
|
2021-03-26 15:21:02 +00:00
|
|
|
"sync"
|
2018-10-05 21:48:36 +00:00
|
|
|
|
|
|
|
"github.com/go-chi/chi"
|
|
|
|
"github.com/pkg/errors"
|
2019-05-27 00:41:10 +00:00
|
|
|
"github.com/smallstep/certificates/acme"
|
|
|
|
acmeAPI "github.com/smallstep/certificates/acme/api"
|
2021-03-05 07:10:46 +00:00
|
|
|
acmeNoSQL "github.com/smallstep/certificates/acme/db/nosql"
|
2018-11-01 04:36:01 +00:00
|
|
|
"github.com/smallstep/certificates/api"
|
|
|
|
"github.com/smallstep/certificates/authority"
|
2021-05-03 19:48:20 +00:00
|
|
|
adminAPI "github.com/smallstep/certificates/authority/admin/api"
|
2021-05-03 19:48:20 +00:00
|
|
|
"github.com/smallstep/certificates/authority/config"
|
2019-05-10 22:58:37 +00:00
|
|
|
"github.com/smallstep/certificates/db"
|
2018-11-01 04:36:01 +00:00
|
|
|
"github.com/smallstep/certificates/logging"
|
|
|
|
"github.com/smallstep/certificates/monitoring"
|
2021-02-12 11:03:08 +00:00
|
|
|
"github.com/smallstep/certificates/scep"
|
2021-02-12 16:02:39 +00:00
|
|
|
scepAPI "github.com/smallstep/certificates/scep/api"
|
2018-11-01 04:36:01 +00:00
|
|
|
"github.com/smallstep/certificates/server"
|
2019-05-27 00:41:10 +00:00
|
|
|
"github.com/smallstep/nosql"
|
2018-10-05 21:48:36 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
type options struct {
|
2021-03-24 21:53:19 +00:00
|
|
|
configFile string
|
|
|
|
password []byte
|
|
|
|
issuerPassword []byte
|
|
|
|
database db.AuthDB
|
2018-10-05 21:48:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (o *options) apply(opts []Option) {
|
|
|
|
for _, fn := range opts {
|
|
|
|
fn(o)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Option is the type of options passed to the CA constructor.
|
|
|
|
type Option func(o *options)
|
|
|
|
|
|
|
|
// WithConfigFile sets the given name as the configuration file name in the CA
|
|
|
|
// options.
|
|
|
|
func WithConfigFile(name string) Option {
|
|
|
|
return func(o *options) {
|
|
|
|
o.configFile = name
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithPassword sets the given password as the configured password in the CA
|
|
|
|
// options.
|
|
|
|
func WithPassword(password []byte) Option {
|
|
|
|
return func(o *options) {
|
|
|
|
o.password = password
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-03-25 18:06:37 +00:00
|
|
|
// WithIssuerPassword sets the given password as the configured certificate
|
|
|
|
// issuer password in the CA options.
|
2021-03-24 21:53:19 +00:00
|
|
|
func WithIssuerPassword(password []byte) Option {
|
|
|
|
return func(o *options) {
|
|
|
|
o.issuerPassword = password
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-05-10 22:58:37 +00:00
|
|
|
// WithDatabase sets the given authority database to the CA options.
|
|
|
|
func WithDatabase(db db.AuthDB) Option {
|
|
|
|
return func(o *options) {
|
|
|
|
o.database = db
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-10-05 21:48:36 +00:00
|
|
|
// CA is the type used to build the complete certificate authority. It builds
|
|
|
|
// the HTTP server, set ups the middlewares and the HTTP handlers.
|
|
|
|
type CA struct {
|
2021-05-03 19:48:20 +00:00
|
|
|
auth *authority.Authority
|
|
|
|
config *config.Config
|
|
|
|
srv *server.Server
|
|
|
|
insecureSrv *server.Server
|
|
|
|
opts *options
|
|
|
|
renewer *TLSRenewer
|
2018-10-05 21:48:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// New creates and initializes the CA with the given configuration and options.
|
2021-05-03 19:48:20 +00:00
|
|
|
func New(config *config.Config, opts ...Option) (*CA, error) {
|
2018-10-05 21:48:36 +00:00
|
|
|
ca := &CA{
|
|
|
|
config: config,
|
|
|
|
opts: new(options),
|
|
|
|
}
|
|
|
|
ca.opts.apply(opts)
|
|
|
|
return ca.Init(config)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Init initializes the CA with the given configuration.
|
2021-05-03 19:48:20 +00:00
|
|
|
func (ca *CA) Init(config *config.Config) (*CA, error) {
|
2021-03-24 21:53:19 +00:00
|
|
|
// Intermediate Password.
|
|
|
|
if len(ca.opts.password) > 0 {
|
2018-10-05 21:48:36 +00:00
|
|
|
ca.config.Password = string(ca.opts.password)
|
|
|
|
}
|
|
|
|
|
2021-03-24 21:53:19 +00:00
|
|
|
// Certificate issuer password for RA mode.
|
|
|
|
if len(ca.opts.issuerPassword) > 0 {
|
|
|
|
if ca.config.AuthorityConfig != nil && ca.config.AuthorityConfig.CertificateIssuer != nil {
|
|
|
|
ca.config.AuthorityConfig.CertificateIssuer.Password = string(ca.opts.issuerPassword)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-05-10 22:58:37 +00:00
|
|
|
var opts []authority.Option
|
|
|
|
if ca.opts.database != nil {
|
|
|
|
opts = append(opts, authority.WithDatabase(ca.opts.database))
|
|
|
|
}
|
|
|
|
|
|
|
|
auth, err := authority.New(config, opts...)
|
2018-10-05 21:48:36 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2021-03-26 14:44:45 +00:00
|
|
|
ca.auth = auth
|
2018-10-05 21:48:36 +00:00
|
|
|
|
|
|
|
tlsConfig, err := ca.getTLSConfig(auth)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Using chi as the main router
|
|
|
|
mux := chi.NewRouter()
|
|
|
|
handler := http.Handler(mux)
|
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
insecureMux := chi.NewRouter()
|
|
|
|
insecureHandler := http.Handler(insecureMux)
|
|
|
|
|
2019-05-27 00:41:10 +00:00
|
|
|
// Add regular CA api endpoints in / and /1.0
|
2018-10-05 21:48:36 +00:00
|
|
|
routerHandler := api.New(auth)
|
|
|
|
routerHandler.Route(mux)
|
|
|
|
mux.Route("/1.0", func(r chi.Router) {
|
|
|
|
routerHandler.Route(r)
|
|
|
|
})
|
|
|
|
|
2019-05-27 00:41:10 +00:00
|
|
|
//Add ACME api endpoints in /acme and /1.0/acme
|
|
|
|
dns := config.DNSNames[0]
|
|
|
|
u, err := url.Parse("https://" + config.Address)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
port := u.Port()
|
|
|
|
if port != "" && port != "443" {
|
|
|
|
dns = fmt.Sprintf("%s:%s", dns, port)
|
|
|
|
}
|
|
|
|
|
2021-05-07 00:03:12 +00:00
|
|
|
// ACME Router
|
2019-05-27 00:41:10 +00:00
|
|
|
prefix := "acme"
|
2021-03-25 03:46:02 +00:00
|
|
|
var acmeDB acme.DB
|
|
|
|
if config.DB == nil {
|
|
|
|
acmeDB = nil
|
|
|
|
} else {
|
2021-05-03 19:48:20 +00:00
|
|
|
acmeDB, err = acmeNoSQL.New(auth.GetDatabase().(nosql.DB))
|
2021-03-25 03:46:02 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrap(err, "error configuring ACME DB interface")
|
|
|
|
}
|
2021-03-06 21:06:43 +00:00
|
|
|
}
|
|
|
|
acmeHandler := acmeAPI.NewHandler(acmeAPI.HandlerOptions{
|
2020-05-20 01:44:55 +00:00
|
|
|
Backdate: *config.AuthorityConfig.Backdate,
|
2021-03-06 21:06:43 +00:00
|
|
|
DB: acmeDB,
|
2020-05-20 01:44:55 +00:00
|
|
|
DNS: dns,
|
|
|
|
Prefix: prefix,
|
2021-03-05 07:10:46 +00:00
|
|
|
CA: auth,
|
2020-05-20 01:44:55 +00:00
|
|
|
})
|
2019-05-27 00:41:10 +00:00
|
|
|
mux.Route("/"+prefix, func(r chi.Router) {
|
2021-03-06 21:06:43 +00:00
|
|
|
acmeHandler.Route(r)
|
2019-05-27 00:41:10 +00:00
|
|
|
})
|
|
|
|
// Use 2.0 because, at the moment, our ACME api is only compatible with v2.0
|
|
|
|
// of the ACME spec.
|
|
|
|
mux.Route("/2.0/"+prefix, func(r chi.Router) {
|
2021-03-06 21:06:43 +00:00
|
|
|
acmeHandler.Route(r)
|
2019-05-27 00:41:10 +00:00
|
|
|
})
|
|
|
|
|
2021-05-20 20:01:58 +00:00
|
|
|
// Admin API Router
|
2021-05-03 19:48:20 +00:00
|
|
|
if config.AuthorityConfig.EnableAdmin {
|
|
|
|
adminDB := auth.GetAdminDatabase()
|
|
|
|
if adminDB != nil {
|
|
|
|
adminHandler := adminAPI.NewHandler(auth)
|
|
|
|
mux.Route("/admin", func(r chi.Router) {
|
|
|
|
adminHandler.Route(r)
|
|
|
|
})
|
|
|
|
}
|
2021-05-07 00:03:12 +00:00
|
|
|
}
|
|
|
|
|
2021-02-12 16:02:39 +00:00
|
|
|
if ca.shouldServeSCEPEndpoints() {
|
2021-02-12 11:03:08 +00:00
|
|
|
scepPrefix := "scep"
|
|
|
|
scepAuthority, err := scep.New(auth, scep.AuthorityOptions{
|
|
|
|
Service: auth.GetSCEPService(),
|
|
|
|
DNS: dns,
|
|
|
|
Prefix: scepPrefix,
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrap(err, "error creating SCEP authority")
|
2021-04-14 22:35:43 +00:00
|
|
|
}
|
2021-02-12 11:03:08 +00:00
|
|
|
scepRouterHandler := scepAPI.New(scepAuthority)
|
|
|
|
|
|
|
|
// According to the RFC (https://tools.ietf.org/html/rfc8894#section-7.10),
|
|
|
|
// SCEP operations are performed using HTTP, so that's why the API is mounted
|
|
|
|
// to the insecure mux.
|
|
|
|
insecureMux.Route("/"+scepPrefix, func(r chi.Router) {
|
|
|
|
scepRouterHandler.Route(r)
|
|
|
|
})
|
|
|
|
|
|
|
|
// The RFC also mentions usage of HTTPS, but seems to advise
|
|
|
|
// against it, because of potential interoperability issues.
|
|
|
|
// Currently I think it's not bad to use HTTPS also, so that's
|
|
|
|
// why I've kept the API endpoints in both muxes and both HTTP
|
|
|
|
// as well as HTTPS can be used to request certificates
|
|
|
|
// using SCEP.
|
|
|
|
mux.Route("/"+scepPrefix, func(r chi.Router) {
|
|
|
|
scepRouterHandler.Route(r)
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2021-03-05 11:40:42 +00:00
|
|
|
// helpful routine for logging all routes
|
2021-02-12 11:03:08 +00:00
|
|
|
//dumpRoutes(mux)
|
2019-05-27 00:41:10 +00:00
|
|
|
|
2018-10-05 21:48:36 +00:00
|
|
|
// Add monitoring if configured
|
|
|
|
if len(config.Monitoring) > 0 {
|
|
|
|
m, err := monitoring.New(config.Monitoring)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
handler = m.Middleware(handler)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Add logger if configured
|
|
|
|
if len(config.Logger) > 0 {
|
|
|
|
logger, err := logging.New("ca", config.Logger)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
handler = logger.Middleware(handler)
|
|
|
|
}
|
|
|
|
|
|
|
|
ca.srv = server.New(config.Address, handler, tlsConfig)
|
2021-03-21 15:42:41 +00:00
|
|
|
|
2021-03-26 14:44:45 +00:00
|
|
|
// only start the insecure server if the insecure address is configured
|
|
|
|
// and, currently, also only when it should serve SCEP endpoints.
|
|
|
|
if ca.shouldServeSCEPEndpoints() && config.InsecureAddress != "" {
|
|
|
|
// TODO: instead opt for having a single server.Server but two
|
|
|
|
// http.Servers handling the HTTP and HTTPS handler? The latter
|
|
|
|
// will probably introduce more complexity in terms of graceful
|
|
|
|
// reload.
|
2021-03-21 15:42:41 +00:00
|
|
|
ca.insecureSrv = server.New(config.InsecureAddress, insecureHandler, nil)
|
|
|
|
}
|
|
|
|
|
2018-10-05 21:48:36 +00:00
|
|
|
return ca, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Run starts the CA calling to the server ListenAndServe method.
|
|
|
|
func (ca *CA) Run() error {
|
2021-03-26 15:21:02 +00:00
|
|
|
var wg sync.WaitGroup
|
|
|
|
errors := make(chan error, 1)
|
|
|
|
|
|
|
|
if ca.insecureSrv != nil {
|
|
|
|
wg.Add(1)
|
|
|
|
go func() {
|
|
|
|
defer wg.Done()
|
|
|
|
errors <- ca.insecureSrv.ListenAndServe()
|
|
|
|
}()
|
|
|
|
}
|
|
|
|
|
|
|
|
wg.Add(1)
|
|
|
|
go func() {
|
|
|
|
defer wg.Done()
|
|
|
|
errors <- ca.srv.ListenAndServe()
|
|
|
|
}()
|
|
|
|
|
|
|
|
// wait till error occurs; ensures the servers keep listening
|
|
|
|
err := <-errors
|
|
|
|
|
|
|
|
wg.Wait()
|
|
|
|
|
|
|
|
return err
|
2018-10-05 21:48:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Stop stops the CA calling to the server Shutdown method.
|
|
|
|
func (ca *CA) Stop() error {
|
2018-11-27 23:57:13 +00:00
|
|
|
ca.renewer.Stop()
|
2019-03-05 08:07:13 +00:00
|
|
|
if err := ca.auth.Shutdown(); err != nil {
|
2019-04-25 19:37:25 +00:00
|
|
|
log.Printf("error stopping ca.Authority: %+v\n", err)
|
2019-03-05 08:07:13 +00:00
|
|
|
}
|
2018-10-05 21:48:36 +00:00
|
|
|
return ca.srv.Shutdown()
|
|
|
|
}
|
|
|
|
|
|
|
|
// Reload reloads the configuration of the CA and calls to the server Reload
|
|
|
|
// method.
|
|
|
|
func (ca *CA) Reload() error {
|
2021-05-03 19:48:20 +00:00
|
|
|
config, err := config.LoadConfiguration(ca.opts.configFile)
|
2018-10-05 21:48:36 +00:00
|
|
|
if err != nil {
|
2019-04-25 19:37:25 +00:00
|
|
|
return errors.Wrap(err, "error reloading ca configuration")
|
|
|
|
}
|
|
|
|
|
|
|
|
logContinue := func(reason string) {
|
|
|
|
log.Println(reason)
|
|
|
|
log.Println("Continuing to run with the original configuration.")
|
|
|
|
log.Println("You can force a restart by sending a SIGTERM signal and then restarting the step-ca.")
|
2018-10-05 21:48:36 +00:00
|
|
|
}
|
|
|
|
|
2019-05-10 22:58:37 +00:00
|
|
|
// Do not allow reload if the database configuration has changed.
|
2019-05-10 23:14:21 +00:00
|
|
|
if !reflect.DeepEqual(ca.config.DB, config.DB) {
|
2019-05-10 22:58:37 +00:00
|
|
|
logContinue("Reload failed because the database configuration has changed.")
|
|
|
|
return errors.New("error reloading ca: database configuration cannot change")
|
2019-04-25 19:37:25 +00:00
|
|
|
}
|
2019-05-10 22:58:37 +00:00
|
|
|
|
|
|
|
newCA, err := New(config,
|
|
|
|
WithPassword(ca.opts.password),
|
2021-03-24 21:53:19 +00:00
|
|
|
WithIssuerPassword(ca.opts.issuerPassword),
|
2019-05-10 22:58:37 +00:00
|
|
|
WithConfigFile(ca.opts.configFile),
|
|
|
|
WithDatabase(ca.auth.GetDatabase()),
|
|
|
|
)
|
2018-10-05 21:48:36 +00:00
|
|
|
if err != nil {
|
2019-05-10 22:58:37 +00:00
|
|
|
logContinue("Reload failed because the CA with new configuration could not be initialized.")
|
2018-10-05 21:48:36 +00:00
|
|
|
return errors.Wrap(err, "error reloading ca")
|
|
|
|
}
|
|
|
|
|
2019-04-25 19:37:25 +00:00
|
|
|
if err = ca.srv.Reload(newCA.srv); err != nil {
|
|
|
|
logContinue("Reload failed because server could not be replaced.")
|
|
|
|
return errors.Wrap(err, "error reloading server")
|
|
|
|
}
|
2019-05-03 22:40:59 +00:00
|
|
|
|
|
|
|
// 1. Stop previous renewer
|
2021-02-12 01:38:14 +00:00
|
|
|
// 2. Safely shutdown any internal resources (e.g. key manager)
|
2021-02-02 01:14:44 +00:00
|
|
|
// 3. Replace ca properties
|
2019-05-03 22:40:59 +00:00
|
|
|
// Do not replace ca.srv
|
|
|
|
ca.renewer.Stop()
|
2021-02-02 01:14:44 +00:00
|
|
|
ca.auth.CloseForReload()
|
2019-05-03 22:40:59 +00:00
|
|
|
ca.auth = newCA.auth
|
|
|
|
ca.config = newCA.config
|
|
|
|
ca.opts = newCA.opts
|
|
|
|
ca.renewer = newCA.renewer
|
2019-04-25 19:37:25 +00:00
|
|
|
return nil
|
2018-10-05 21:48:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// getTLSConfig returns a TLSConfig for the CA server with a self-renewing
|
|
|
|
// server certificate.
|
|
|
|
func (ca *CA) getTLSConfig(auth *authority.Authority) (*tls.Config, error) {
|
|
|
|
// Create initial TLS certificate
|
|
|
|
tlsCrt, err := auth.GetTLSCertificate()
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Start tls renewer with the new certificate.
|
|
|
|
// If a renewer was started, attempt to stop it before.
|
|
|
|
if ca.renewer != nil {
|
|
|
|
ca.renewer.Stop()
|
|
|
|
}
|
|
|
|
|
|
|
|
ca.renewer, err = NewTLSRenewer(tlsCrt, auth.GetTLSCertificate)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
ca.renewer.Run()
|
|
|
|
|
|
|
|
var tlsConfig *tls.Config
|
|
|
|
if ca.config.TLS != nil {
|
|
|
|
tlsConfig = ca.config.TLS.TLSConfig()
|
|
|
|
} else {
|
|
|
|
tlsConfig = &tls.Config{
|
|
|
|
MinVersion: tls.VersionTLS12,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
certPool := x509.NewCertPool()
|
2019-01-07 23:30:28 +00:00
|
|
|
for _, crt := range auth.GetRootCertificates() {
|
|
|
|
certPool.AddCert(crt)
|
|
|
|
}
|
2018-10-05 21:48:36 +00:00
|
|
|
|
|
|
|
// GetCertificate will only be called if the client supplies SNI
|
|
|
|
// information or if tlsConfig.Certificates is empty.
|
|
|
|
// When client requests are made using an IP address (as opposed to a domain
|
|
|
|
// name) the server does not receive any SNI and may fallback to using the
|
|
|
|
// first entry in the Certificates attribute; by setting the attribute to
|
|
|
|
// empty we are implicitly forcing GetCertificate to be the only mechanism
|
|
|
|
// by which the server can find it's own leaf Certificate.
|
|
|
|
tlsConfig.Certificates = []tls.Certificate{}
|
2018-11-27 23:57:13 +00:00
|
|
|
tlsConfig.GetCertificate = ca.renewer.GetCertificateForCA
|
2018-10-05 21:48:36 +00:00
|
|
|
|
|
|
|
// Add support for mutual tls to renew certificates
|
|
|
|
tlsConfig.ClientAuth = tls.VerifyClientCertIfGiven
|
|
|
|
tlsConfig.ClientCAs = certPool
|
|
|
|
|
|
|
|
// Use server's most preferred ciphersuite
|
|
|
|
tlsConfig.PreferServerCipherSuites = true
|
|
|
|
|
|
|
|
return tlsConfig, nil
|
|
|
|
}
|
2021-02-12 11:03:08 +00:00
|
|
|
|
|
|
|
// shouldMountSCEPEndpoints returns if the CA should be
|
|
|
|
// configured with endpoints for SCEP. This is assumed to be
|
|
|
|
// true if a SCEPService exists, which is true in case a
|
|
|
|
// SCEP provisioner was configured.
|
|
|
|
func (ca *CA) shouldServeSCEPEndpoints() bool {
|
|
|
|
return ca.auth.GetSCEPService() != nil
|
|
|
|
}
|
|
|
|
|
|
|
|
//nolint // ignore linters to allow keeping this function around for debugging
|
|
|
|
func dumpRoutes(mux chi.Routes) {
|
|
|
|
// helpful routine for logging all routes //
|
|
|
|
walkFunc := func(method string, route string, handler http.Handler, middlewares ...func(http.Handler) http.Handler) error {
|
|
|
|
fmt.Printf("%s %s\n", method, route)
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
if err := chi.Walk(mux, walkFunc); err != nil {
|
|
|
|
fmt.Printf("Logging err: %s\n", err.Error())
|
|
|
|
}
|
|
|
|
}
|