eliezio / simple-pki

A Simple PKI

Simple PKI

Overview

This application provides the basic services typically found on any PKI:

• Generates X.509 certificates;

• Allow preemptive revocation of issued certificates;

• Generates an updated CRL (Certificate Revocation List);

• Supply the CA certificate.

The PKI implemented is comprised of a single CA with no intermediate CAs.

Code Coverage

Building the application

To build the application from the sources just run:

./gradlew build

Docker Image

You can also build a Docker image from the source code using the [Jib plugin](https://github.com/GoogleContainerTools/jib/tree/master/jib-gradle-plugin#build-your-image) like, for example:

./gradlew jibDockerBuild

Installation

The first step is create the keystore with the CA entity. As an example, you can run the src/main/scripts/create-ca.sh that will create a ./data/ca.p12 keystore with default passwords set to changeit.

Running with 'debug' profile activated

If using Gradle, run:

./gradlew bootRun --args='--spring.profiles.active=debug'

License

Copyright © 2019-2022 Nordix Foundation.

simple-pki's Issues

Add support to MariaDB/MySQL as backend DB

Initially, H2 will still be supported and the default DBMS.

Validate CA at start

• it's a root CA (self-signed certificate => issuer == subject)
• basic constraints: CA (critical)
• key usages include keySignCertificate, cCRLSign

In case one or more checks fail, the server should be stuck at FAILURE state, always returning SC=500 for every valid request

Drop versioning using v1 in path

Implement traceability of internal server errors

• Send stack-traces to Apache Sentry
• Attach ""Correlation ID"" to SC=500 response

Remove CA auto-creation

The CA auto-creation is suitable for dev environments only. Primarily, it doesn't work with multiple instances of the service application.

Handle optimistic locking failure

The Pki#revoke() uses optimistic locking and will likely throw JpaOptimisticLockingFailureException in the face of multiple attempts to revoke the same certificate.
The operation must fail and the server must return SC=409 (https://httpstatuses.com/409).

Validate DB integrity on every persistence-related test

Check for invariants on EndEntity:

• the certificate contains a valid signature
• subject, .notValidBefore, .notValidAfter must match corresponding embedded fields on certificate
• version must be either 1 or 2
• revokedReason > 0 whenever .revocationDate != null

Eliminate tests inter dependencies on PkiRestControllerSpec to fix Pitest verification failure

Currently some tests depend on the result of one or more previous tests.

Use JCIP annotations to make thread-safety explicity