From 6c2b862acdf592215b7100a176ef9a1272af5d8e Mon Sep 17 00:00:00 2001 From: ianhundere <138915+ianhundere@users.noreply.github.com> Date: Sat, 30 Nov 2024 12:31:49 -0500 Subject: [PATCH] feat: adds optional intermediate flag(s). --- cmd/certificate_maker/certificate_maker.go | 34 ++- pkg/certmaker/certmaker.go | 107 +++++---- pkg/certmaker/certmaker_test.go | 226 ++++++++++++------ .../templates/intermediate-template.json | 27 +++ pkg/certmaker/templates/leaf-template.json | 4 +- 5 files changed, 274 insertions(+), 124 deletions(-) create mode 100644 pkg/certmaker/templates/intermediate-template.json diff --git a/cmd/certificate_maker/certificate_maker.go b/cmd/certificate_maker/certificate_maker.go index 85ee413c..d645f124 100644 --- a/cmd/certificate_maker/certificate_maker.go +++ b/cmd/certificate_maker/certificate_maker.go @@ -48,18 +48,22 @@ var ( RunE: runCreate, } - kmsType string - kmsRegion string - kmsKeyID string - kmsVaultName string - kmsTenantID string - kmsCredsFile string - rootTemplatePath string - leafTemplatePath string - rootKeyID string - leafKeyID string - rootCertPath string - leafCertPath string + kmsType string + kmsRegion string + kmsKeyID string + kmsVaultName string + kmsTenantID string + kmsCredsFile string + rootTemplatePath string + leafTemplatePath string + rootKeyID string + leafKeyID string + rootCertPath string + leafCertPath string + withIntermediate bool + intermediateKeyID string + intermediateTemplate string + intermediateCert string rawJSON = []byte(`{ "level": "debug", @@ -96,6 +100,10 @@ func init() { createCmd.Flags().StringVar(&leafKeyID, "leaf-key-id", "", "KMS key identifier for leaf certificate") createCmd.Flags().StringVar(&rootCertPath, "root-cert", "root.pem", "Output path for root certificate") createCmd.Flags().StringVar(&leafCertPath, "leaf-cert", "leaf.pem", "Output path for leaf certificate") + createCmd.Flags().BoolVar(&withIntermediate, "with-intermediate", false, "Create certificate chain with intermediate CA") + createCmd.Flags().StringVar(&intermediateKeyID, "intermediate-key-id", "", "KMS key identifier for intermediate certificate") + createCmd.Flags().StringVar(&intermediateTemplate, "intermediate-template", "pkg/certmaker/templates/intermediate-template.json", "Path to intermediate certificate template") + createCmd.Flags().StringVar(&intermediateCert, "intermediate-cert", "intermediate.pem", "Output path for intermediate certificate") } func runCreate(cmd *cobra.Command, args []string) error { @@ -139,7 +147,7 @@ func runCreate(cmd *cobra.Command, args []string) error { return fmt.Errorf("leaf template error: %w", err) } - return certmaker.CreateCertificates(km, config, rootTemplatePath, leafTemplatePath, rootCertPath, leafCertPath) + return certmaker.CreateCertificates(km, config, rootTemplatePath, leafTemplatePath, rootCertPath, leafCertPath, withIntermediate, intermediateKeyID, intermediateTemplate, intermediateCert) } func main() { diff --git a/pkg/certmaker/certmaker.go b/pkg/certmaker/certmaker.go index a2c5c5de..bdcc2e73 100644 --- a/pkg/certmaker/certmaker.go +++ b/pkg/certmaker/certmaker.go @@ -19,6 +19,7 @@ package certmaker import ( "context" + "crypto" "crypto/x509" "encoding/pem" "fmt" @@ -34,11 +35,12 @@ import ( // KMSConfig holds config for KMS providers. type KMSConfig struct { - Type string // KMS provider type: "awskms", "cloudkms", "azurekms" - Region string // AWS region or Cloud location - RootKeyID string // Root CA key identifier - LeafKeyID string // Leaf CA key identifier - Options map[string]string // Provider-specific options + Type string + Region string + RootKeyID string + IntermediateKeyID string + LeafKeyID string + Options map[string]string } // InitKMS initializes KMS provider based on the given config, KMSConfig. @@ -83,69 +85,87 @@ func InitKMS(ctx context.Context, config KMSConfig) (apiv1.KeyManager, error) { // CreateCertificates generates a certificate chain using the configured KMS provider. // It creates both root and intermediate certificates using the provided templates // and KMS signing keys. -func CreateCertificates(km apiv1.KeyManager, config KMSConfig, rootTemplatePath, intermediateTemplatePath, rootCertPath, intermCertPath string) error { - // Parse root template +func CreateCertificates(km apiv1.KeyManager, config KMSConfig, + rootTemplatePath, leafTemplatePath string, + rootCertPath, leafCertPath string, + withIntermediate bool, + intermediateKeyID, intermediateTemplatePath, intermediateCertPath string) error { + + // Create root cert rootTmpl, err := ParseTemplate(rootTemplatePath, nil) if err != nil { return fmt.Errorf("error parsing root template: %w", err) } - rootKeyName := config.RootKeyID - if config.Type == "azurekms" { - rootKeyName = fmt.Sprintf("azurekms:vault=%s;name=%s", - config.Options["vault-name"], config.RootKeyID) - } rootSigner, err := km.CreateSigner(&apiv1.CreateSignerRequest{ - SigningKey: rootKeyName, + SigningKey: config.RootKeyID, }) if err != nil { return fmt.Errorf("error creating root signer: %w", err) } - // Create root cert rootCert, err := x509util.CreateCertificate(rootTmpl, rootTmpl, rootSigner.Public(), rootSigner) if err != nil { return fmt.Errorf("error creating root certificate: %w", err) } + if err := WriteCertificateToFile(rootCert, rootCertPath); err != nil { return fmt.Errorf("error writing root certificate: %w", err) } - // Parse / sign intermediate template - intermediateTmpl, err := ParseTemplate(intermediateTemplatePath, rootCert) - if err != nil { - return fmt.Errorf("error parsing intermediate template: %w", err) + var signingCert *x509.Certificate + var signingKey crypto.Signer + + if withIntermediate { + // Only create intermediate if flag is set + intermediateTmpl, err := ParseTemplate(intermediateTemplatePath, rootCert) + if err != nil { + return fmt.Errorf("error parsing intermediate template: %w", err) + } + + intermediateSigner, err := km.CreateSigner(&apiv1.CreateSignerRequest{ + SigningKey: intermediateKeyID, + }) + if err != nil { + return fmt.Errorf("error creating intermediate signer: %w", err) + } + + intermediateCert, err := x509util.CreateCertificate(intermediateTmpl, rootCert, intermediateSigner.Public(), rootSigner) + if err != nil { + return fmt.Errorf("error creating intermediate certificate: %w", err) + } + + if err := WriteCertificateToFile(intermediateCert, intermediateCertPath); err != nil { + return fmt.Errorf("error writing intermediate certificate: %w", err) + } + + signingCert = intermediateCert + signingKey = intermediateSigner + } else { + signingCert = rootCert + signingKey = rootSigner } - intermediateKeyName := config.LeafKeyID - if config.Type == "azurekms" { - intermediateKeyName = fmt.Sprintf("azurekms:vault=%s;name=%s", - config.Options["vault-name"], config.LeafKeyID) + + // Create leaf cert + leafTmpl, err := ParseTemplate(leafTemplatePath, signingCert) + if err != nil { + return fmt.Errorf("error parsing leaf template: %w", err) } - intermediateSigner, err := km.CreateSigner(&apiv1.CreateSignerRequest{ - SigningKey: intermediateKeyName, + + leafSigner, err := km.CreateSigner(&apiv1.CreateSignerRequest{ + SigningKey: config.LeafKeyID, }) if err != nil { - return fmt.Errorf("error creating intermediate signer: %w", err) + return fmt.Errorf("error creating leaf signer: %w", err) } - // Create intermediate/leaf cert - intermediateCert, err := x509util.CreateCertificate(intermediateTmpl, rootCert, intermediateSigner.Public(), rootSigner) + leafCert, err := x509util.CreateCertificate(leafTmpl, signingCert, leafSigner.Public(), signingKey) if err != nil { - return fmt.Errorf("error creating intermediate certificate: %w", err) - } - if err := WriteCertificateToFile(intermediateCert, intermCertPath); err != nil { - return fmt.Errorf("error writing intermediate certificate: %w", err) + return fmt.Errorf("error creating leaf certificate: %w", err) } - // Verify certificate chain - pool := x509.NewCertPool() - pool.AddCert(rootCert) - opts := x509.VerifyOptions{ - Roots: pool, - KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageTimeStamping}, - } - if _, err := intermediateCert.Verify(opts); err != nil { - return fmt.Errorf("certificate chain verification failed: %w", err) + if err := WriteCertificateToFile(leafCert, leafCertPath); err != nil { + return fmt.Errorf("error writing leaf certificate: %w", err) } return nil @@ -163,14 +183,19 @@ func WriteCertificateToFile(cert *x509.Certificate, filename string) error { return fmt.Errorf("failed to create file %s: %w", filename, err) } defer file.Close() + if err := pem.Encode(file, certPEM); err != nil { return fmt.Errorf("failed to write certificate to file %s: %w", filename, err) } + // Determine cert type certType := "root" - if cert.Subject.OrganizationalUnit != nil && cert.Subject.OrganizationalUnit[0] == "TSA Intermediate CA" { + if !cert.IsCA { + certType = "leaf" + } else if cert.MaxPathLen == 0 { certType = "intermediate" } + fmt.Printf("Your %s certificate has been saved in %s.\n", certType, filename) return nil } diff --git a/pkg/certmaker/certmaker_test.go b/pkg/certmaker/certmaker_test.go index 9facd47e..90d97ec5 100644 --- a/pkg/certmaker/certmaker_test.go +++ b/pkg/certmaker/certmaker_test.go @@ -47,16 +47,12 @@ func newMockKMS() *mockKMS { } // Pre-create test keys - rootKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) - if err != nil { - panic(fmt.Errorf("failed to generate root key: %v", err)) - } - leafKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) - if err != nil { - panic(fmt.Errorf("failed to generate leaf key: %v", err)) - } + rootKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) + intermediateKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) + leafKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) m.keys["root-key"] = rootKey + m.keys["intermediate-key"] = intermediateKey m.keys["leaf-key"] = leafKey return m @@ -124,17 +120,94 @@ func TestParseTemplate(t *testing.T) { // TestCreateCertificates tests certificate chain creation func TestCreateCertificates(t *testing.T) { - t.Run("TSA", func(t *testing.T) { + rootContent := `{ + "subject": { + "country": ["US"], + "organization": ["Sigstore"], + "organizationalUnit": ["Timestamp Authority Root CA"], + "commonName": "https://tsa.com" + }, + "issuer": { + "commonName": "https://tsa.com" + }, + "notBefore": "2024-01-01T00:00:00Z", + "notAfter": "2034-01-01T00:00:00Z", + "basicConstraints": { + "isCA": true, + "maxPathLen": 1 + }, + "keyUsage": [ + "certSign", + "crlSign" + ] + }` + + leafContent := `{ + "subject": { + "country": ["US"], + "organization": ["Sigstore"], + "organizationalUnit": ["Timestamp Authority"], + "commonName": "https://tsa.com" + }, + "issuer": { + "commonName": "https://tsa.com" + }, + "notBefore": "2024-01-01T00:00:00Z", + "notAfter": "2034-01-01T00:00:00Z", + "basicConstraints": { + "isCA": false + }, + "keyUsage": [ + "digitalSignature" + ], + "extKeyUsage": [ + "timeStamping" + ] + }` + + t.Run("TSA without intermediate", func(t *testing.T) { tmpDir, err := os.MkdirTemp("", "cert-test-tsa-*") require.NoError(t, err) t.Cleanup(func() { os.RemoveAll(tmpDir) }) - // root template (same for both) - rootContent := `{ + km := newMockKMS() + config := KMSConfig{ + Type: "mockkms", + RootKeyID: "root-key", + LeafKeyID: "leaf-key", + Options: make(map[string]string), + } + + rootTmplPath := filepath.Join(tmpDir, "root-template.json") + leafTmplPath := filepath.Join(tmpDir, "leaf-template.json") + rootCertPath := filepath.Join(tmpDir, "root.pem") + leafCertPath := filepath.Join(tmpDir, "leaf.pem") + + err = os.WriteFile(rootTmplPath, []byte(rootContent), 0600) + require.NoError(t, err) + + err = os.WriteFile(leafTmplPath, []byte(leafContent), 0600) + require.NoError(t, err) + + err = CreateCertificates(km, config, + rootTmplPath, leafTmplPath, + rootCertPath, leafCertPath, + false, "", "", "") + require.NoError(t, err) + + verifyDirectChain(t, rootCertPath, leafCertPath) + }) + + t.Run("TSA with intermediate", func(t *testing.T) { + tmpDir, err := os.MkdirTemp("", "cert-test-tsa-*") + require.NoError(t, err) + t.Cleanup(func() { os.RemoveAll(tmpDir) }) + + intermediateContent := `{ "subject": { "country": ["US"], "organization": ["Sigstore"], - "organizationalUnit": ["Timestamp Authority Root CA"], + "organizationalUnit": ["TSA Intermediate CA"], "commonName": "https://tsa.com" }, "issuer": { @@ -144,7 +217,7 @@ func TestCreateCertificates(t *testing.T) { "notAfter": "2034-01-01T00:00:00Z", "basicConstraints": { "isCA": true, - "maxPathLen": 1 + "maxPathLen": 0 }, "keyUsage": [ "certSign", @@ -152,36 +225,37 @@ func TestCreateCertificates(t *testing.T) { ] }` - // leaf template - leafContent := `{ - "subject": { - "country": ["US"], - "organization": ["Sigstore"], - "organizationalUnit": ["Timestamp Authority"], - "commonName": "https://tsa.com" - }, - "issuer": { - "commonName": "https://tsa.com" - }, - "notBefore": "2024-01-01T00:00:00Z", - "notAfter": "2034-01-01T00:00:00Z", - "basicConstraints": { - "isCA": false, - "maxPathLen": 0 - }, - "keyUsage": [ - "digitalSignature" - ], - "extensions": [ - { - "id": "2.5.29.37", - "critical": true, - "value": {{ asn1Seq (asn1Enc "oid:1.3.6.1.5.5.7.3.8") | toJson }} - } - ] - }` + km := newMockKMS() + config := KMSConfig{ + Type: "mockkms", + RootKeyID: "root-key", + IntermediateKeyID: "intermediate-key", + LeafKeyID: "leaf-key", + Options: make(map[string]string), + } + + rootTmplPath := filepath.Join(tmpDir, "root-template.json") + leafTmplPath := filepath.Join(tmpDir, "leaf-template.json") + intermediateTmplPath := filepath.Join(tmpDir, "intermediate-template.json") + rootCertPath := filepath.Join(tmpDir, "root.pem") + intermediateCertPath := filepath.Join(tmpDir, "intermediate.pem") + leafCertPath := filepath.Join(tmpDir, "leaf.pem") + + err = os.WriteFile(rootTmplPath, []byte(rootContent), 0600) + require.NoError(t, err) + err = os.WriteFile(intermediateTmplPath, []byte(intermediateContent), 0600) + require.NoError(t, err) + err = os.WriteFile(leafTmplPath, []byte(leafContent), 0600) + require.NoError(t, err) + + err = CreateCertificates(km, config, + rootTmplPath, leafTmplPath, + rootCertPath, leafCertPath, + true, + "intermediate-key", intermediateTmplPath, intermediateCertPath) + require.NoError(t, err) - testCertificateCreation(t, tmpDir, rootContent, leafContent) + verifyIntermediateChain(t, rootCertPath, intermediateCertPath, leafCertPath) }) } @@ -222,31 +296,6 @@ func TestWriteCertificateToFile(t *testing.T) { assert.Equal(t, "Test Cert", parsedCert.Subject.CommonName) } -// testCertificateCreation creates and verifies certificate chains -func testCertificateCreation(t *testing.T, tmpDir, rootContent, leafContent string) { - rootTmplPath := filepath.Join(tmpDir, "root-template.json") - leafTmplPath := filepath.Join(tmpDir, "leaf-template.json") - rootCertPath := filepath.Join(tmpDir, "root.pem") - leafCertPath := filepath.Join(tmpDir, "leaf.pem") - - err := os.WriteFile(rootTmplPath, []byte(rootContent), 0600) - require.NoError(t, err) - - err = os.WriteFile(leafTmplPath, []byte(leafContent), 0600) - require.NoError(t, err) - - km := newMockKMS() - config := KMSConfig{ - Type: "mockkms", - RootKeyID: "root-key", - LeafKeyID: "leaf-key", - Options: make(map[string]string), - } - - err = CreateCertificates(km, config, rootTmplPath, leafTmplPath, rootCertPath, leafCertPath) - require.NoError(t, err) -} - func TestValidateKMSConfig(t *testing.T) { tests := []struct { name string @@ -290,3 +339,46 @@ func TestValidateKMSConfig(t *testing.T) { }) } } + +func verifyDirectChain(t *testing.T, rootPath, leafPath string) { + root := loadCertificate(t, rootPath) + leaf := loadCertificate(t, leafPath) + + rootPool := x509.NewCertPool() + rootPool.AddCert(root) + + _, err := leaf.Verify(x509.VerifyOptions{ + Roots: rootPool, + }) + require.NoError(t, err) +} + +func verifyIntermediateChain(t *testing.T, rootPath, intermediatePath, leafPath string) { + root := loadCertificate(t, rootPath) + intermediate := loadCertificate(t, intermediatePath) + leaf := loadCertificate(t, leafPath) + + intermediatePool := x509.NewCertPool() + intermediatePool.AddCert(intermediate) + + rootPool := x509.NewCertPool() + rootPool.AddCert(root) + + _, err := leaf.Verify(x509.VerifyOptions{ + Roots: rootPool, + Intermediates: intermediatePool, + }) + require.NoError(t, err) +} + +func loadCertificate(t *testing.T, path string) *x509.Certificate { + data, err := os.ReadFile(path) + require.NoError(t, err) + + block, _ := pem.Decode(data) + require.NotNil(t, block) + + cert, err := x509.ParseCertificate(block.Bytes) + require.NoError(t, err) + return cert +} diff --git a/pkg/certmaker/templates/intermediate-template.json b/pkg/certmaker/templates/intermediate-template.json new file mode 100644 index 00000000..37378d91 --- /dev/null +++ b/pkg/certmaker/templates/intermediate-template.json @@ -0,0 +1,27 @@ +{ + "subject": { + "country": [ + "US" + ], + "organization": [ + "Sigstore" + ], + "organizationalUnit": [ + "TSA Intermediate CA" + ], + "commonName": "https://tsa.com" + }, + "issuer": { + "commonName": "https://tsa.com" + }, + "notBefore": "2024-01-01T00:00:00Z", + "notAfter": "2034-01-01T00:00:00Z", + "basicConstraints": { + "isCA": true, + "maxPathLen": 0 + }, + "keyUsage": [ + "certSign", + "crlSign" + ] +} \ No newline at end of file diff --git a/pkg/certmaker/templates/leaf-template.json b/pkg/certmaker/templates/leaf-template.json index 79f8c3e9..a5ab9c73 100644 --- a/pkg/certmaker/templates/leaf-template.json +++ b/pkg/certmaker/templates/leaf-template.json @@ -16,10 +16,8 @@ }, "notBefore": "2024-01-01T00:00:00Z", "notAfter": "2034-01-01T00:00:00Z", - "serialNumber": 2, "basicConstraints": { - "isCA": false, - "maxPathLen": 0 + "isCA": false }, "keyUsage": [ "digitalSignature"