Skip to content

Commit d63ae4a

Browse files
romdalfromdalf
authored
Merge pull request #22 from coding-gecko/dev/improvements
Dev/improvements
2 parents ac8dbea + 0d08d86 commit d63ae4a

18 files changed

Lines changed: 922 additions & 281 deletions

‎Containerfile-kleidi-kms-hsm‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
FROM docker.io/library/golang:1.22.0-bullseye AS build
1+
FROM docker.io/library/golang:1.24.5-bookworm AS build
22

33
ARG VERSION
4-
ENV VERSION $VERSION
4+
ENV VERSION=$VERSION
55
WORKDIR /work
66

77
# Copy the source
@@ -12,6 +12,8 @@ RUN go mod download
1212

1313
RUN CGO_ENABLED=1 GO111MODULE=on go build -ldflags "-X main.kleidiVersion=$VERSION" -a -installsuffix cgo cmd/kleidi/main.go
1414

15+
RUN go test -v ./...
16+
1517
FROM quay.io/centos/centos:stream9
1618
RUN dnf -y install jq opensc softhsm; dnf clean all;
1719

‎Containerfile-kleidi-kms-vault‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
FROM docker.io/library/golang:1.22.0-bullseye AS build
1+
FROM docker.io/library/golang:1.24.5-bookworm AS build
22

33
ARG VERSION
4-
ENV VERSION $VERSION
4+
ENV VERSION=$VERSION
55
WORKDIR /work
66

77
# Copy the source
@@ -12,6 +12,8 @@ RUN go mod download
1212

1313
RUN CGO_ENABLED=1 GO111MODULE=on go build -ldflags "-X main.kleidiVersion=$VERSION" -a -installsuffix cgo cmd/kleidi/main.go
1414

15+
RUN go test -v ./...
16+
1517
FROM quay.io/centos/centos:stream9
1618

1719
LABEL org.opencontainers.image.source=https://github.com/beezy-dev/kleidi

‎configuration/kleidi/cert-auth/ca/conf/openssl-ca.conf‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Generates CA cert to be the Root CA for intermediate CA (which then signes Kleidi client cert).
2+
# Example usage:
3+
# openssl req -x509 -config openssl-ca.conf -days 365 -newkey rsa:4096 -sha256 -nodes -out cacert.pem -outform PEM
4+
5+
HOME = .
6+
RANDFILE = $ENV::HOME/.rnd
7+
8+
####################################################################
9+
[ ca ]
10+
default_ca = CA_default # The default ca section
11+
[ CA_default ]
12+
13+
default_days = 365 # How long to certify for
14+
default_crl_days = 30 # How long before next CRL
15+
default_md = sha256 # Use public key default MD
16+
preserve = no # Keep passed DN ordering
17+
18+
x509_extensions = ca_extensions # The extensions to add to the cert
19+
20+
email_in_dn = no # Don't concat the email in the DN
21+
copy_extensions = copy # Required to copy SANs from CSR to cert
22+
23+
base_dir = .
24+
certificate = $base_dir/cacert.pem # The CA certifcate
25+
private_key = $base_dir/cakey.pem # The CA private key
26+
new_certs_dir = $base_dir # Location for new certs after signing
27+
database = $base_dir/index.txt # Database index file
28+
serial = $base_dir/serial.txt # The current serial number
29+
30+
unique_subject = no # Set to 'no' to allow creation of several certificates with same subject.
31+
32+
####################################################################
33+
[ req ]
34+
default_bits = 4096
35+
default_keyfile = cakey.pem
36+
distinguished_name = ca_distinguished_name
37+
x509_extensions = ca_extensions
38+
string_mask = utf8only
39+
40+
####################################################################
41+
[ ca_distinguished_name ]
42+
countryName = Country Name (2 letter code)
43+
countryName_default = AA
44+
45+
stateOrProvinceName = State or Province Name (full name)
46+
stateOrProvinceName_default = AAAAA
47+
48+
localityName = Locality Name (eg, city)
49+
localityName_default = AAAAA
50+
51+
organizationName = Organization Name (eg, company)
52+
organizationName_default = Some Company Ltd.
53+
54+
organizationalUnitName = Organizational Unit (eg, division)
55+
organizationalUnitName_default = Some-Org
56+
57+
commonName = Common Name (e.g. server FQDN or YOUR name)
58+
commonName_default = Kleidi-RootCA
59+
60+
####################################################################
61+
[ ca_extensions ]
62+
subjectKeyIdentifier = hash
63+
authorityKeyIdentifier = keyid:always, issuer
64+
basicConstraints = critical, CA:true
65+
keyUsage = keyCertSign, cRLSign
66+
####################################################################
67+
[ v3_intermediate_ca ]
68+
# Extensions for a typical intermediate CA (`man x509v3_config`).
69+
subjectKeyIdentifier = hash
70+
authorityKeyIdentifier = keyid:always,issuer
71+
basicConstraints = critical, CA:true, pathlen:0
72+
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
73+
####################################################################
74+
[ signing_policy ]
75+
countryName = optional
76+
stateOrProvinceName = optional
77+
localityName = optional
78+
organizationName = optional
79+
organizationalUnitName = optional
80+
commonName = supplied
81+
emailAddress = optional
82+
####################################################################
83+
[ signing_req ]
84+
subjectKeyIdentifier = hash
85+
authorityKeyIdentifier = keyid,issuer
86+
basicConstraints = CA:FALSE
87+
keyUsage = digitalSignature, keyEncipherment
88+
####################################################################

‎configuration/kleidi/cert-auth/ca/conf/openssl-client.conf‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# client config to be used with intermediate ca
2+
# Example usage:
3+
# openssl req -config openssl-client.conf -newkey rsa:2048 -sha256 -nodes -out clientcert-intermediate.csr -outform PEM
4+
# creates server key and CSR for signing
5+
# sign it with the ca cert:
6+
# openssl ca -config openssl-intermediate.conf -policy signing_policy -extensions signing_req -out clientcert-intermediate.pem -infiles clientcert-intermediate.csr
7+
8+
HOME = .
9+
RANDFILE = $ENV::HOME/.rnd
10+
11+
####################################################################
12+
[ req ]
13+
default_bits = 2048
14+
default_keyfile = clientkey-intermediate.pem
15+
distinguished_name = client_distinguished_name
16+
req_extensions = client_req_extensions
17+
string_mask = utf8only
18+
19+
####################################################################
20+
[ client_distinguished_name ]
21+
countryName = Country Name (2 letter code)
22+
countryName_default = AA
23+
24+
stateOrProvinceName = State or Province Name (full name)
25+
stateOrProvinceName_default = AAAAA
26+
27+
localityName = Locality Name (eg, city)
28+
localityName_default = AAAAA
29+
30+
organizationName = Organization Name (eg, company)
31+
organizationName_default = Some Company Ltd.
32+
commonName = Common Name (e.g. server FQDN or YOUR name)
33+
commonName_default = Kleidi-Client
34+
35+
####################################################################
36+
[ client_req_extensions ]
37+
38+
subjectKeyIdentifier = hash
39+
basicConstraints = CA:FALSE
40+
keyUsage = digitalSignature, keyEncipherment
41+
extendedKeyUsage = serverAuth, clientAuth
42+
subjectAltName = @alternate_names
43+
nsComment = "OpenSSL Generated Certificate - Intermediate - Client"
44+
45+
####################################################################
46+
[ alternate_names ]
47+
48+
# adjust to your needs
49+
DNS.1 = kleidi-client.example.com
50+
# IPv4 localhost
51+
IP.1 = 127.0.0.1
52+
# IPv6 localhost
53+
IP.2 = ::1

‎configuration/kleidi/cert-auth/ca/conf/openssl-intermediate.conf‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# Creates Intermediate CA cert+key with specified parameters.
2+
# This intermediate CA can be put into Vault Cert endpoint and is used to verify the client cert given to Kleidi.
3+
# create folder intermediate, serial.txt and index.txt
4+
# openssl req -config openssl-intermediate.conf -newkey rsa:4096 -sha256 -nodes -out intermediate/intermediate.csr -outform PEM
5+
# openssl ca -config openssl-ca.conf -policy signing_policy -extensions v3_intermediate_ca -out intermediate/intermediate-cacert.pem -infiles intermediate/intermediate.csr
6+
7+
HOME = .
8+
RANDFILE = $ENV::HOME/.rnd
9+
####################################################################
10+
[ ca ]
11+
default_ca = CA_default # The default ca section
12+
13+
[ CA_default ]
14+
15+
default_days = 365 # How long to certify for
16+
default_crl_days = 30 # How long before next CRL
17+
default_md = sha256 # Use public key default MD
18+
preserve = no # Keep passed DN ordering
19+
20+
x509_extensions = ca_extensions # The extensions to add to the cert
21+
22+
email_in_dn = no # Don't concat the email in the DN
23+
copy_extensions = copy # Required to copy SANs from CSR to cert
24+
25+
base_dir = .
26+
certificate = $base_dir/intermediate/intermediate-cacert.pem # The CA certifcate
27+
private_key = $base_dir/intermediate/intermediate-cakey.pem # The CA private key
28+
new_certs_dir = $base_dir/intermediate # Location for new certs after signing
29+
database = $base_dir/intermediate/index.txt # Database index file
30+
serial = $base_dir/intermediate/serial.txt # The current serial number
31+
32+
unique_subject = no # Set to 'no' to allow creation of several certificates with same subject.
33+
####################################################################
34+
[ req ]
35+
default_bits = 4096
36+
default_keyfile = intermediate-cakey.pem
37+
distinguished_name = ca_distinguished_name
38+
x509_extensions = ca_extensions
39+
string_mask = utf8only
40+
####################################################################
41+
[ ca_distinguished_name ]
42+
countryName = Country Name (2 letter code)
43+
countryName_default = AA
44+
45+
stateOrProvinceName = State or Province Name (full name)
46+
stateOrProvinceName_default = AAAAA
47+
48+
localityName = Locality Name (eg, city)
49+
localityName_default = AAAAA
50+
51+
organizationName = Organization Name (eg, company)
52+
organizationName_default = Some Company Ltd.
53+
54+
organizationalUnitName = Organizational Unit (eg, division)
55+
organizationalUnitName_default = Some-Org
56+
57+
commonName = Common Name (e.g. server FQDN or YOUR name)
58+
commonName_default = Kleidi-IntermediateCA
59+
60+
####################################################################
61+
[ ca_extensions ]
62+
subjectKeyIdentifier = hash
63+
authorityKeyIdentifier = keyid:always,issuer
64+
basicConstraints = critical, CA:true, pathlen:0
65+
subjectAltName = @alternate_names
66+
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
67+
####################################################################
68+
[ server_req_extensions ]
69+
subjectKeyIdentifier = hash
70+
basicConstraints = CA:TRUE
71+
keyUsage = digitalSignature, keyEncipherment
72+
extendedKeyUsage = serverAuth, clientAuth
73+
subjectAltName = @alternate_names
74+
nsComment = "OpenSSL Generated Certificate - Intermediate CA"
75+
####################################################################
76+
[ signing_policy ]
77+
countryName = optional
78+
stateOrProvinceName = optional
79+
localityName = optional
80+
organizationName = optional
81+
organizationalUnitName = optional
82+
commonName = supplied
83+
emailAddress = optional
84+
####################################################################
85+
[ signing_req ]
86+
subjectKeyIdentifier = hash
87+
authorityKeyIdentifier = keyid,issuer
88+
basicConstraints = CA:FALSE
89+
keyUsage = digitalSignature, keyEncipherment
90+
####################################################################
91+
[ alternate_names ]
92+
# adjust to your needs
93+
DNS.1 = intermediate.example.com
94+
# DNS.2 = www.example.com
95+
# DNS.3 = mail.example.com
96+
# DNS.4 = ftp.example.com
97+
# IPv4 localhost
98+
IP.1 = 127.0.0.1
99+
# IPv6 localhost
100+
IP.2 = ::1

‎configuration/kleidi/cert-auth/ca/gen-ca.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/usr/bin/bash
2+
# create root CA with serial and index
3+
# works in the current directory
4+
echo "0ABC" > serial.txt
5+
touch index.txt
6+
openssl req -x509 -config conf/openssl-ca.conf -days 365 -newkey rsa:4096 -sha256 -nodes -out cacert.pem -outform PEM
7+
8+
# create intermediate CA and it's folder structure
9+
mkdir intermediate
10+
touch intermediate/index.txt
11+
# create CSR
12+
openssl req -config conf/openssl-intermediate.conf -newkey rsa:4096 -sha256 -nodes -out intermediate/intermediate.csr -outform PEM
13+
# sign it with the previous root CA
14+
openssl ca -config conf/openssl-ca.conf -policy signing_policy -extensions v3_intermediate_ca -out intermediate/intermediate-cacert.pem -infiles intermediate/intermediate.csr
15+
mv intermediate-cakey.pem intermediate/intermediate-cakey.pem
16+
# create client csr and key
17+
openssl req -config conf/openssl-client.conf -newkey rsa:2048 -sha256 -nodes -out clientcert-intermediate.csr -outform PEM
18+
openssl ca -config conf/openssl-intermediate.conf -rand_serial -policy signing_policy -extensions signing_req -out clientcert-intermediate.pem -infiles clientcert-intermediate.csr

‎configuration/kleidi/cert-auth/kleidi.env‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
VAULT_CACERT=/etc/ssl/certs/vault-cert.pem
2+
VAULT_CLIENT_CERT=/etc/ssl/certs/clientcert-intermediate.pem
3+
VAULT_CLIENT_KEY=/etc/ssl/certs/clientkey-intermediate.pem

‎configuration/kleidi/cert-auth/start-kleidi.sh‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Example config to run kleidi with cert auth in standalone docker container
2+
# Before starting, do not forget to configure auth/cert in Vault with the generated intermediate CA cert.
3+
# File kleidi.env is used to populate env variables that are being read by cert auth from the container.
4+
# Adjust to your local configuration.
5+
#!/usr/bin/bash
6+
docker run -d --privileged --restart always \
7+
--net=host --name kleidi \
8+
-v /etc/kleidi/vault-config-cert.json:/etc/kleidi/config.json \
9+
-v /var/run/kleidi/:/var/run/kleidi/:rw \
10+
-v /etc/kleidi/tls/vault-cert.pem:/etc/ssl/certs/vault-cert.pem \
11+
-v /etc/kleidi/tls/clientcert-intermediate.pem:/etc/ssl/certs/clientcert-intermediate.pem \
12+
-v /etc/kleidi/tls/clientkey-intermediate.pem:/etc/ssl/certs/clientkey-intermediate.pem \
13+
--env-file /etc/kleidi/kleidi.env \
14+
github.com/beezy-dev/kleidi-kms-plugin:latest \
15+
-provider=hvault -configfile=/etc/kleidi/config.json -debugmode=true -listen=unix:///var/run/kleidi/kms.socket

‎configuration/kleidi/cert-auth/vault-config-cert.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"namespace": "",
3+
"transitkey": "kleidi",
4+
"vaultrole": "kleidi",
5+
"address": "http://172.20.10.9:8200",
6+
"transitpath": "transit",
7+
"authmethod": "cert",
8+
"authpath": "certauth"
9+
}

‎configuration/kleidi/vault-config.json‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,8 @@
22
"namespace": "",
33
"transitkey": "kleidi",
44
"vaultrole": "kleidi",
5-
"address": "http://172.20.10.9:8200"
5+
"address": "http://172.20.10.9:8200",
6+
"transitpath": "transit",
7+
"authmethod": "k8s",
8+
"authpath": "kubernetes"
69
}

0 commit comments

Comments
 (0)