Update pkispawn to verify admin cert

The pki nss-cert-verify has been added to verify that a cert
is issued by a trusted CA. The cert can be provided in an NSS
database, in a file, or via standard input.

The PKITrustManager class has been moved into pki-common.jar
such that it can be used by the CLI. This class is not yet
officially supported so it's not necessary to provide an
upgrade script.

The NSSDatabase.verify_cert() has been added to verify a cert
using pki nss-cert-verify.

The PKIDeployer.import_system_certs() and setup_admin_cert()
have been modified to verify the admin cert provided during
installation.

The test for installing CA with existing certs has been updated
to install the CA with a self-signed admin cert (which should
fail), then install it again with a CA-signed cert (which should
work).

Author: edewata

.github/workflows/ca-existing-certs-test.yml

@@ -189,54 +189,128 @@ jobs:
               nss-key-find \
               --nickname sslserver | tee sslserver.key.before
 
-      - name: Create admin cert
+      - name: Export system certs
+        run: |
+          docker exec pki pki \
+              pkcs12-export \
+              --pkcs12 ca-certs.p12 \
+              --password Secret.123 \
+              ca_signing \
+              ca_ocsp_signing \
+              ca_audit_signing \
+              subsystem \
+              sslserver
+          docker exec pki pki \
+              pkcs12-cert-find \
+              --pkcs12 ca-certs.p12 \
+              --password Secret.123
+
+      - name: Create self-signed admin cert
         run: |
+          # create cert request
           docker exec pki pki \
               nss-cert-request \
               --subject "CN=Administrator" \
               --ext /usr/share/pki/server/certs/admin.conf \
               --csr admin.csr
+
+          # create self-signed cert
           docker exec pki pki \
               nss-cert-issue \
-              --issuer ca_signing \
               --csr admin.csr \
               --ext /usr/share/pki/server/certs/admin.conf \
               --cert admin.crt
 
-          docker exec pki pki nss-cert-import \
+          # import cert
+          docker exec pki pki \
+              nss-cert-import \
               --cert admin.crt \
               caadmin
 
-          docker exec pki pki \
-              nss-cert-show \
-              caadmin
+          # check cert
+          docker exec pki pki nss-cert-show caadmin
 
-      - name: Export system certs
+          # cert should be invalid
+          docker exec pki pki nss-cert-verify caadmin \
+              > >(tee stdout) 2> >(tee stderr >&2) || true
+
+          cat > expected << EOF
+          ERROR: Invalid certificate: Unable to validate certificate signature: CN=Administrator
+          EOF
+
+          diff expected stderr
+
+      - name: Install CA with existing system certs and self-signed admin cert
         run: |
+          # run step 1
+          docker exec pki pkispawn \
+              -f /usr/share/pki/server/examples/installation/ca.cfg \
+              -s CA \
+              -D pki_ds_url=ldap://ds.example.com:3389 \
+              -D pki_external=True \
+              -D pki_external_step_two=False \
+              -v
+
+          # run step 2
+          rc=0
+          docker exec pki pkispawn \
+              -f /usr/share/pki/server/examples/installation/ca.cfg \
+              -s CA \
+              -D pki_ds_url=ldap://ds.example.com:3389 \
+              -D pki_external=True \
+              -D pki_external_step_two=True \
+              -D pki_pkcs12_path=ca-certs.p12 \
+              -D pki_pkcs12_password=Secret.123 \
+              -D pki_ca_signing_csr_path=ca_signing.csr \
+              -D pki_ocsp_signing_csr_path=ca_ocsp_signing.csr \
+              -D pki_audit_signing_csr_path=ca_audit_signing.csr \
+              -D pki_subsystem_csr_path=subsystem.csr \
+              -D pki_sslserver_csr_path=sslserver.csr \
+              -D pki_admin_cert_path=admin.crt \
+              -D pki_admin_csr_path=admin.csr \
+              -v \
+              || rc=$?
+
+          # pkispawn should fail
+          [ $rc -ne 0 ]
+
+      - name: Create CA-signed admin cert
+        run: |
+          # remove old cert
+          docker exec pki pki nss-cert-del caadmin
+
+          # create CA-signed cert
           docker exec pki pki \
-              pkcs12-export \
-              --pkcs12 ca-certs.p12 \
-              --password Secret.123 \
-              ca_signing \
-              ca_ocsp_signing \
-              ca_audit_signing \
-              subsystem \
-              sslserver
+              nss-cert-issue \
+              --issuer ca_signing \
+              --csr admin.csr \
+              --ext /usr/share/pki/server/certs/admin.conf \
+              --cert admin.crt
+
+          # import new cert
           docker exec pki pki \
-              pkcs12-cert-find \
-              --pkcs12 ca-certs.p12 \
-              --password Secret.123
+              nss-cert-import \
+              --cert admin.crt \
+              caadmin
 
-      - name: Install CA with existing certs
+          # check new cert
+          docker exec pki pki nss-cert-show caadmin
+
+          # cert should be valid
+          docker exec pki pki nss-cert-verify caadmin
+
+      - name: Install CA with existing system certs and CA-signed admin cert
         run: |
+          # run step 1
           docker exec pki pkispawn \
               -f /usr/share/pki/server/examples/installation/ca.cfg \
               -s CA \
               -D pki_ds_url=ldap://ds.example.com:3389 \
               -D pki_external=True \
               -D pki_external_step_two=False \
               -v
-          sleep 1  # avoid pkispawn log conflict due to identical timestamps
+
+          # run step 2
           docker exec pki pkispawn \
               -f /usr/share/pki/server/examples/installation/ca.cfg \
               -s CA \
@@ -254,6 +328,8 @@ jobs:
               -D pki_admin_csr_path=admin.csr \
               -v
 
+          # pkispawn should succeed
+
       - name: Run PKI healthcheck
         run: docker exec pki pki-healthcheck --failures-only
 

base/common/python/pki/nssdb.py

@@ -2128,6 +2128,49 @@ def get_cert_info(self, nickname, token=None):
 
         return cert
 
+    def verify_cert(
+            self,
+            nickname=None,
+            token=None,
+            cert_data=None,
+            cert_file=None,
+            cert_format='PEM'):
+
+        if cert_file and not cert_data:
+            with open(cert_file, 'r', encoding='utf-8') as f:
+                cert_data = f.read()
+
+        if cert_data:
+            cert_data = convert_cert(cert_data, cert_format, 'PEM')
+
+        cmd = [
+            'pki',
+            '-d', self.directory,
+            '-f', self.password_conf
+        ]
+
+        token = self.get_effective_token(token)
+
+        if token:
+            cmd.extend(['--token', token])
+
+        cmd.append('nss-cert-verify')
+
+        if nickname:
+            if token:
+                fullname = token + ':' + nickname
+            else:
+                fullname = nickname
+            cmd.append(fullname)
+
+        if logger.isEnabledFor(logging.DEBUG):
+            cmd.append('--debug')
+
+        elif logger.isEnabledFor(logging.INFO):
+            cmd.append('--verbose')
+
+        self.run(cmd, input=cert_data, text=True, check=True, runas=True)
+
     @staticmethod
     def convert_time_to_millis(date):
         return date.timestamp() * 1000

base/tomcat/src/main/java/org/dogtagpki/tomcat/PKITrustManager.java renamed to base/common/src/main/java/org/dogtagpki/cert/PKITrustManager.java

@@ -1,5 +1,6 @@
-package org.dogtagpki.tomcat;
+package org.dogtagpki.cert;
 
+import java.security.SignatureException;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
@@ -20,8 +21,8 @@ public class PKITrustManager implements X509TrustManager {
 
     final static Logger logger = LoggerFactory.getLogger(PKITrustManager.class);
 
-    final static String SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
-    final static String CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
+    public final static String SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+    public final static String CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
 
     public void checkCertChain(X509Certificate[] certChain, String keyUsage) throws Exception {
 
@@ -57,6 +58,10 @@ public void checkCertChain(X509Certificate[] certChain, String keyUsage) throws
         }
     }
 
+    public void checkCert(X509Certificate cert) throws Exception {
+        checkCert(cert, getAcceptedIssuers(), null);
+    }
+
     public void checkCert(X509Certificate cert, X509Certificate[] caCerts, String keyUsage) throws Exception {
 
         logger.debug("PKITrustManager: checkCert(" + cert.getSubjectDN() + "):");
@@ -74,13 +79,13 @@ public void checkCert(X509Certificate cert, X509Certificate[] caCerts, String ke
                 cert.verify(caCert.getPublicKey(), "Mozilla-JSS");
                 issuer = caCert;
                 break;
-            } catch (Exception e) {
-                logger.debug("PKITrustManager: invalid certificate: " + e);
+            } catch (SignatureException e) {
+                logger.debug("PKITrustManager: cert not issued by " + caCert.getSubjectDN() + ": " + e.getMessage());
             }
         }
 
         if (issuer == null) {
-            throw new CertificateException("Unable to validate signature: " + cert.getSubjectDN());
+            throw new SignatureException("Unable to validate certificate signature: " + cert.getSubjectDN());
         }
 
         logger.debug("PKITrustManager: cert signed by " + issuer.getSubjectDN());

base/server/python/pki/server/cli/http.py

@@ -569,7 +569,7 @@ def execute(self, argv, args=None):
             HTTPConnectorCLI.set_param(connector, 'keyAlias', 'sslserver')
 
             HTTPConnectorCLI.set_param(connector, 'trustManagerClassName',
-                                       'org.dogtagpki.tomcat.PKITrustManager')
+                                       'org.dogtagpki.cert.PKITrustManager')
 
             HTTPConnectorCLI.set_param(connector, 'certdbDir', nss_database_dir)
             HTTPConnectorCLI.set_param(connector, 'passwordClass',

base/server/python/pki/server/deployment/__init__.py

@@ -44,9 +44,10 @@
 from cryptography import x509
 from cryptography.hazmat.backends import default_backend
 
-import pki.nssdb
 import pki.account
+import pki.cli
 import pki.client
+import pki.nssdb
 import pki.pkcs12
 import pki.server
 import pki.server.deployment.scriptlets.configuration
@@ -2552,6 +2553,14 @@ def import_system_certs(self, nssdb, subsystem):
 
             admin_cert = self.load_admin_cert()
             if admin_cert:
+
+                cert_file = self.mdict.get('pki_admin_cert_path')
+                try:
+                    logger.info('Verifying admin cert in %s', cert_file)
+                    self.instance.verify_cert(admin_cert)
+                except Exception:
+                    raise pki.cli.CLIException('Invalid admin certificate in %s' % cert_file)
+
                 self.import_admin_cert(admin_cert)
 
         if subsystem.name == 'ocsp':
@@ -2561,6 +2570,14 @@ def import_system_certs(self, nssdb, subsystem):
 
             admin_cert = self.load_admin_cert()
             if admin_cert:
+
+                cert_file = self.mdict.get('pki_admin_cert_path')
+                try:
+                    logger.info('Verifying admin cert in %s', cert_file)
+                    self.instance.verify_cert(admin_cert)
+                except Exception:
+                    raise pki.cli.CLIException('Invalid admin certificate in %s' % cert_file)
+
                 self.import_admin_cert(admin_cert)
 
         self.import_system_cert(nssdb, subsystem, 'sslserver')
@@ -4000,6 +4017,13 @@ def setup_admin_cert(self, subsystem):
                 pem_cert = pki.nssdb.convert_cert(cert_info['data'], 'base64', 'pem')
                 logger.debug('Admin cert:\n%s', pem_cert)
 
+                try:
+                    logger.info('Verifying admin cert in %s', client_nssdb.directory)
+                    self.instance.verify_cert(pem_cert)
+                except Exception:
+                    raise pki.cli.CLIException(
+                        'Invalid admin certificate in %s' % client_nssdb.directory)
+
                 if external and subsystem.type != 'CA' or standalone:
                     # no need to re-import admin cert into NSS database
                     self.store_admin_cert(pem_cert)
@@ -4019,24 +4043,27 @@ def setup_admin_cert(self, subsystem):
                     and os.path.exists(pkcs12_file) \
                     and os.path.getsize(pkcs12_file) > 0:
 
-                logger.info('Importing admin cert from %s', pkcs12_file)
+                logger.info('Exporting admin cert from %s', pkcs12_file)
                 pkcs12_password = self.mdict['pki_client_pkcs12_password']
 
-                client_nssdb.import_pkcs12(
-                    pkcs12_file=pkcs12_file,
-                    pkcs12_password=pkcs12_password)
+                pkcs12 = pki.pkcs12.PKCS12(
+                    path=pkcs12_file,
+                    password=pkcs12_password)
 
-                cert_info = client_nssdb.get_cert_info(nickname)
+                pem_cert = pkcs12.get_cert(nickname)
+                logger.debug('Admin cert:\n%s', pem_cert)
 
-            if cert_info:
-                logger.info('Found %s cert in %s:', nickname, pkcs12_file)
-                logger.info('- serial: %s', hex(cert_info['serial_number']))
-                logger.info('- subject: %s', cert_info['subject'])
-                logger.info('- issuer: %s', cert_info['issuer'])
-                logger.info('- trust flags: %s', cert_info['trust_flags'])
+                try:
+                    logger.info('Verifying admin cert in %s', pkcs12_file)
+                    self.instance.verify_cert(pem_cert)
+                except Exception:
+                    raise pki.cli.CLIException('Invalid admin certificate in %s' % pkcs12_file)
 
-                pem_cert = pki.nssdb.convert_cert(cert_info['data'], 'base64', 'pem')
-                logger.debug('Admin cert:\n%s', pem_cert)
+                logger.info('Importing admin cert into %s', client_nssdb.directory)
+
+                client_nssdb.import_pkcs12(
+                    pkcs12_file=pkcs12_file,
+                    pkcs12_password=pkcs12_password)
 
                 if external and subsystem.type != 'CA' or standalone:
                     # no need to re-import admin cert into NSS database
@@ -4058,6 +4085,12 @@ def setup_admin_cert(self, subsystem):
 
             logger.debug('Admin cert:\n%s', pem_cert)
 
+            try:
+                logger.info('Verifying admin cert in %s', cert_path)
+                self.instance.verify_cert(pem_cert)
+            except Exception:
+                raise pki.cli.CLIException('Invalid admin certificate in %s' % cert_path)
+
             if external and subsystem.type != 'CA' or standalone:
                 self.import_admin_cert(pem_cert)
                 self.store_admin_cert(pem_cert)
@@ -4076,6 +4109,12 @@ def setup_admin_cert(self, subsystem):
 
             logger.debug('Admin cert:\n%s', pem_cert)
 
+            try:
+                logger.info('Verifying admin cert in %s', cert_file)
+                self.instance.verify_cert(pem_cert)
+            except Exception:
+                raise pki.cli.CLIException('Invalid admin certificate in %s' % cert_file)
+
             if external and subsystem.type != 'CA' or standalone:
                 self.import_admin_cert(pem_cert)
                 self.store_admin_cert(pem_cert)