Page Comparison

...

# WARNING - work in progress so still can change
{
   "cmpv2Servers":[
      {
         "caName":"TEST",
         "url":"http://127.0.0.1/ejbca/publicweb/cmp/cmp",
         "issuerDN":"CN=ManagementCA",
         "caMode":"CLIENT",
         "authentication":{
            "iak":"xxx",
            "rv":"yyy"
         }
      },
      {
         "caName":"TEST2",
         "url":"http://127.0.0.1/ejbca/publicweb/cmp/cmpRA",
         "issuerDN":"CN=ManagementCA2",
         "caMode":"RA",
         "authentication":{
            "iak":"xxx",
            "rv":"yyy"
         }
      }
   ]
}

CMPv2 client

Input table for CMPv2 client

CMPv2 will get two POJOs and one String: first with CSR, plain fields extracted from CSR (like subject DN, list of SANs, etc) and private key (in general data passed via REST API call) and second with CMPv2 server details and one String: CA name.

Input value	Input type	Description	Usage
CsrModel	Object	POJO which transfers sent CSR, plain fields extracted from CSR (like Common Name, Country, etc)
CsrModel:: csr	org.bouncycastle.pkcs.PKCS10CertificationRequest	Certificate Signing Request received via REST API
CsrModel:: subjectDN	org.bouncycastle.asn1.x500.X500Name	SubjectDN retrieved from sent CSR
CsrModel:: privateKey	java.security.PrivateKey	Private key received via REST API
CsrModel:: publicKey	java.security.PublicKey	Public key retrieved from sent CSR
CsrModel:: sans	List of Strings	Subject Alterative Names retrieved from sent CSR	CsrModel::	Others (plain data extracted from sent CSR)  if needed
CMPv2ServerDetails	Object	POJO which transfers CMPv2 server properties
CMPv2ServerDetails:: CA name	String	CA name as configured in CMPv2 server properties
CMPv2ServerDetails:: URL	URL or String	URL to CMPv2 server as configured in CMPv2 server details
CMPv2ServerDetails:: IssuerDN	org.bouncycastle.asn1.x500.X500Name	Issuer DN as configured in CMPv2 server details
CMPv2ServerDetails:: CA mode	ENUM	CA mode as configured in CMPv2 server details
CMPv2ServerDetails:: IAK	String	IAK as configured in CMPv2 server details
CMPv2ServerDetails:: RV	String	RV as configured in CMPv2 server details
CA name	String	CA name received via REST API

...

CMPv2 client

...

CMPv2 client returns:

List <java.security.cert.X509Certificate> certificateChain

List <java.security.cert.X509Certificate> trustedCerts

CMPv2 client POC

TBD

Currently the POC for CMPv2 client is working based on the inputs below.

...

Input Values

...

Description

...

Usage

...

csrMeta: CA Details

...

.cer file

...

used to validate response (.crt)/ certificate send from EJBCA server

...

Relevant values in Certificate Request message to EJBCA:

...

Value

...

Description

...

Information Included

...

SenderDN

IssuerDN

ProtectionAlgorithm (used for PkiProtection below)

...

CertificateRequestMessage, which includes:

SubjectDN

IssuerDN

SubjectPublicKey

...

call to CMPv2 server

Relevant values in Initialization Request (IR) message sent to CMPv2 server:

Return values from CMPv2 client

Following table represents return values from CMPv2 client.

Test code for running cmpv2 client against EJBCA server through unit test

@Test
  public void testServerWithRealUrl() throws CmpClientException {

    setValidCsrMetaValuesAndDateValues();

    csrMeta.caUrl("http://127.0.0.1/ejbca/publicweb/cmp/cmpRA");
    csrMeta.password("mypassword");

    CmpClientImpl cmpClient = new CmpClientImpl(HttpClients.createDefault());
    cmpClient.createCertificate("data", "RA", csrMeta, cert, notBefore, notAfter);
  }

  private void setValidCsrMetaValuesAndDateValues() {
    ArrayList<RDN> rdns = new ArrayList<>();
    try {
      rdns.add(new RDN("O=CommonCompany"));
    } catch (CertException e) {
      e.printStackTrace();
    }
    csrMeta = new CSRMeta(rdns);
    csrMeta.cn("CN=CommonName");
    csrMeta.san("CommonName.com");
    csrMeta.password("password");
    csrMeta.email("CommonName@cn.com");
    csrMeta.issuerCn("CN=ManagementCA");
    when(kpg.generateKeyPair()).thenReturn(keyPair);
    csrMeta.keypair();
    csrMeta.caUrl("http://127.0.0.1/ejbca/publicweb/cmp/cmp");

    try {
      notBefore =
              new SimpleDateFormat("yyyy/MM/dd HH:mm:ss").parse("2019/11/11 12:00:00");
      notAfter =
              new SimpleDateFormat("yyyy/MM/dd HH:mm:ss").parse("2020/11/11 12:00:00");
    } catch (ParseException e) {
      e.printStackTrace();
    }
  }

Usage

Docker

Run CertService as docker via following command: 

docker run -p $PORT_MAPPING --name $NAME --mount $CMPV2_SERVERS_CONFIGURATION $IMAGE_NAME
e.g.
docker run }-p 8080:8080  }

Usage

Docker

Run CertService as docker via following command: TBA

docker run -p 8080:8080 --name cert-service $IMAGE_NAME--name aaf-certservice-api --mount type=bind,source=/<absolute_path>/cmpServers.json,target=/etc/onap/aaf/certservice/cmpServers.json nexus3.onap.org:10001/onap/org.onap.aaf.certservice.aaf-certservice-api:$VERSION

Kubernetes

For Kubernetes helm chart is provided. Just overwrite needed values and deploy helm chart using following command: TBA

...

CertService's client input properties

...

Below table presents all properties which should/can be passed to CertService's client to make a successful call to CertService to enroll certificate.

...

Run CertService's client as docker via following command: TBA

TEST

Kuberenetes

Cause ONAP is deployed in K8s, CertService's client will be delivered as independent container and should run as init container for end component. Both init container and end component must mount the same volume (persistent or ephemeral) to transfer generated artifacts.

...