From 8376f9a92e5b0134401394e356dc60f3fcd76e5b Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Thu, 2 Jul 2026 08:35:35 +0000 Subject: [PATCH] enrol-broker: run in serving stack + fix step signer path end-to-end Verifying the step signer against a real step-ca surfaced two real bugs the mock signer had hidden, plus made the bench CA actually initialise: - signer.go: move --not-after from `step ca token` (validity caps ~1h -> "token validity too long") to `step ca sign` (it is the CERT lifetime). Without this the step signer never issues a cert. - dot1x-bench compose: DOCKER_STEPCA_INIT_PASSWORD_FILE pointed at a file that does not exist at first init (it is an INPUT path), so `step ca init` failed and never wrote secrets/password. Use DOCKER_STEPCA_INIT_PASSWORD (the value) which the entrypoint writes to secrets/password, where bootstrap + broker read. - bootstrap.sh: self-heal the root-owned ./pki Docker auto-creates; detect the CA password at $STEPPATH/password or secrets/password (varies by image version); raise authority.claims.maxTLSCertDuration so 720h fleet certs are allowed (stock cap 24h, which also blocked bootstrap's own RADIUS cert); fix RADIUS cert paths to write via the /export mount (were host paths run inside the container, so they never resolved). - serving stack: add the enrol-broker service (temporary home; nginx already proxies /enrol/) defaulting to the zero-dependency lab path (mock signer + insecure loopback admin), with ENROL_* knobs to switch to step + mTLS. - verify-serving.sh: exercise request -> approve -> cert through the deployed nginx /enrol/ proxy. - TODO #11: record the step-signer verification + the two fixes. Step signer VERIFIED end-to-end against a real step-ca: issued cert chains to the fleet root, EKU clientAuth, hostnqn derived from serial. --- docs/TODO.md | 26 ++++++ serving/.env.example | 33 +++++++ serving/docker-compose.yml | 45 ++++++++++ serving/dot1x-bench/docker-compose.yml | 8 +- serving/dot1x-bench/step-ca/bootstrap.sh | 104 +++++++++++++++++++---- serving/enrol-broker/signer.go | 23 +++-- serving/enrol-broker/verify-serving.sh | 50 +++++++++++ serving/enrol-pki/.gitignore | 4 + 8 files changed, 266 insertions(+), 27 deletions(-) create mode 100755 serving/enrol-broker/verify-serving.sh create mode 100644 serving/enrol-pki/.gitignore diff --git a/docs/TODO.md b/docs/TODO.md index 9915716..8ba4b02 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -1003,6 +1003,32 @@ authenticates EAP-TLS. **REMAINING:** the host-side inline empty-NV dracut branc (generate key/CSR → POST → Plymouth fingerprint → poll → NV write → reboot) + `tpm2-openssl` in the image. +**TEMPORARY (2026-06-28): broker also added to the MAIN serving stack** +(`serving/docker-compose.yml`, `enrol-broker` service + `ENROL_*` in +`serving/.env.example`) so a single `compose up` in `serving/` brings the +`/enrol/` endpoint up while the host side is built. Defaults to the +zero-dependency lab path — **`mock` signer** (ephemeral CA; certs NOT trusted by +RADIUS/NVMe) + **plaintext loopback admin** (`ENROL_ADMIN_INSECURE=true`). The +serving nginx already proxies `/enrol/`→`127.0.0.1:9090`. **SPLIT BACK OUT:** the +broker's proper home is a CA-co-located stack (it's still defined in +`dot1x-bench/` next to step-ca); real signing needs the fleet CA. Don't run both +copies on one host (they collide on 9090/9443). To use real signing from the +serving stack meanwhile: set `ENROL_SIGNER=step` + `ENROL_STEP_CA_URL` at a +reachable step-ca, populate `serving/enrol-pki/`, and `ENROL_ADMIN_INSECURE=false`. + +**STEP SIGNER VERIFIED end-to-end 2026-06-28** (broker → real step-ca → signed +cert that chains to the fleet root; hostnqn derived from serial; EKU clientAuth). +Verification found + fixed two things the `mock` path had hidden: +- **BUG FIXED (`signer.go`):** `--not-after` was passed to `step ca token` + (validity capped ~1h → "token validity too long") instead of `step ca sign`. + Moved to the sign step. Without it the step signer never issues a cert. +- **CA CLAIM REQUIRED:** a stock step-ca caps certs at 24h, so 720h is rejected + ("authorized maximum certificate duration of 24h"). `dot1x-bench/step-ca/bootstrap.sh` + now raises `authority.claims.maxTLSCertDuration` (+restarts the CA) — this also + unblocks bootstrap's own 720h RADIUS cert. Any other CA needs the same claim. +- **BENCH-VERIFY still open:** issued cert actually authenticates EAP-TLS through + FreeRADIUS (next, before host enrolment). + How a host gets its **802.1X EAP-TLS client identity** the first time — the key at TPM handle `0x81010001` + cert at NV `0x01800001` that invariant #1 says must come from enrolment, never the image. Distinct from #10 (that enrols *Secure Boot* diff --git a/serving/.env.example b/serving/.env.example index 2ce0277..d5b256f 100644 --- a/serving/.env.example +++ b/serving/.env.example @@ -85,6 +85,39 @@ SUBNQN=nqn.2026-06.org.example.fleet:rootfs TARGET_PORT=4420 SPDK_CPUMASK=0x1 # one polling core is plenty for a read-only boot fs +# --- TPM enrolment broker (TEMPORARY in this stack — see docs/TODO.md #11) --- +# The broker is the one unauthenticated pre-auth endpoint (nginx proxies /enrol/ +# to it). Defaults run the zero-dependency LAB path: a `mock` signer (ephemeral +# CA; certs NOT trusted by RADIUS/NVMe) + plaintext loopback admin — enough to +# exercise the request/approve/poll flow while the host side is built. +# +# For REAL enrolment: set ENROL_SIGNER=step, point ENROL_STEP_CA_URL at a +# reachable step-ca (e.g. the one in serving/dot1x-bench/), drop its root + +# provisioner password into ./enrol-pki/, generate the admin mTLS PKI +# (./enrol-broker/admin-pki.sh ./enrol-pki/broker ), and set +# ENROL_ADMIN_INSECURE=false. Then it belongs in its own CA-co-located stack. +ENROL_SIGNER=mock # mock (lab, no CA) | step (real, needs a CA) +ENROL_ADMIN_INSECURE=true # true = plaintext loopback admin (LAB ONLY); false = mTLS +ENROL_PENDING_TTL=10m # time-box on unapproved requests +ENROL_WORDS=8 # fingerprint word count +ENROL_HOSTNQN_BASE=nqn.2026-06.org.example.fleet:host- +# step signer (only when ENROL_SIGNER=step) — paths are INSIDE the container +# (./enrol-pki is mounted at /pki): +ENROL_STEP_CA_URL= # e.g. https://ca.fleet.lab:8443 +ENROL_STEP_CA_ROOT=/pki/root_ca.crt +ENROL_STEP_PROVISIONER=enrol +ENROL_STEP_PASSWORD_FILE=/pki/password +# Issued-cert lifetime. NOTE: the step-ca provisioner must ALLOW this — a stock +# step-ca caps certs at 24h, so 720h is rejected ("requested duration ... more +# than the authorized maximum certificate duration of 24h"). The bench +# step-ca/bootstrap.sh now raises authority.claims.maxTLSCertDuration; a +# different CA needs the same. Verified end-to-end against a real step-ca. +ENROL_CERT_NOT_AFTER=720h +# admin mTLS (only when ENROL_ADMIN_INSECURE=false): +ENROL_ADMIN_CERT=/pki/broker/server.crt +ENROL_ADMIN_KEY=/pki/broker/server.key +ENROL_ADMIN_CLIENT_CA=/pki/broker/admin-ca.crt + # --- SPDK version loader / reaper (declarative rolling updates) ------------- # The spdk-loader service stages + adds ${IMAGE_VERSION} to the long-lived target # on `compose up`, then auto-removes OLD versions once they drain. Migration = diff --git a/serving/docker-compose.yml b/serving/docker-compose.yml index dd31d46..f073952 100644 --- a/serving/docker-compose.yml +++ b/serving/docker-compose.yml @@ -189,6 +189,51 @@ services: # For HTTPS boot (production), terminate TLS here with the boot-infra CA's # cert and switch the dhcp-boot URL above to https://. Left HTTP for the lab. + # --- TPM enrolment broker (TEMPORARY home — see docs/TODO.md #11) ----------- + # The `http` nginx already reverse-proxies /enrol/ -> 127.0.0.1:9090 (this + # broker's public listener), so an empty-NV host can POST its CSR and poll for + # the signed cert via the normal serving host. For now the broker runs HERE so + # a single `compose up` in serving/ brings the enrolment endpoint up. + # + # ⚠ PROPER HOME is its own stack co-located with step-ca (the fleet CA), i.e. + # serving/dot1x-bench/, since REAL signing needs that CA. SPLIT THIS BACK OUT + # once the CA lives beside it. Do NOT run this AND dot1x-bench's enrol-broker on + # the same host — they collide on 9090/9443. + # + # Defaults below are the zero-dependency LAB path: `mock` signer (ephemeral + # in-process CA — certs are NOT trusted by RADIUS/NVMe) + plaintext loopback + # admin. For REAL enrolment, in .env set ENROL_SIGNER=step + point + # ENROL_STEP_CA_* at a reachable step-ca, and set ENROL_ADMIN_INSECURE=false + # after generating the admin mTLS PKI (a DEDICATED admin CA, not the fleet root): + # ./enrol-broker/admin-pki.sh ./enrol-pki/broker + # then import enrol-pki/broker/clients/.p12 and open https://127.0.0.1:9443/ + enrol-broker: + build: ./enrol-broker + network_mode: host # public on 127.0.0.1:9090 (nginx proxies /enrol/) + restart: unless-stopped + environment: + BROKER_PUBLIC_ADDR: "127.0.0.1:9090" # nginx /enrol/ proxies here + BROKER_ADMIN_ADDR: "127.0.0.1:9443" # mgmt/loopback ONLY — never the boot LAN + BROKER_SIGNER: ${ENROL_SIGNER:-mock} + BROKER_PENDING_TTL: ${ENROL_PENDING_TTL:-10m} + BROKER_WORDS: ${ENROL_WORDS:-8} + HOSTNQN_BASE: ${ENROL_HOSTNQN_BASE:-nqn.2026-06.org.example.fleet:host-} + # --- step signer (only consulted when ENROL_SIGNER=step) --- + STEP_CA_URL: ${ENROL_STEP_CA_URL:-} + STEP_CA_ROOT: ${ENROL_STEP_CA_ROOT:-/pki/root_ca.crt} + STEP_PROVISIONER: ${ENROL_STEP_PROVISIONER:-enrol} + STEP_PROVISIONER_PASSWORD_FILE: ${ENROL_STEP_PASSWORD_FILE:-/pki/password} + STEP_CERT_NOT_AFTER: ${ENROL_CERT_NOT_AFTER:-720h} + # --- admin mTLS (set ENROL_ADMIN_INSECURE=false for real mTLS) --- + BROKER_ADMIN_INSECURE: ${ENROL_ADMIN_INSECURE:-true} + BROKER_ADMIN_CERT: ${ENROL_ADMIN_CERT:-/pki/broker/server.crt} + BROKER_ADMIN_KEY: ${ENROL_ADMIN_KEY:-/pki/broker/server.key} + BROKER_ADMIN_CLIENT_CA: ${ENROL_ADMIN_CLIENT_CA:-/pki/broker/admin-ca.crt} + volumes: + # CA root + provisioner password (step signer) and admin mTLS certs live + # here; unused/empty for the default mock+insecure path. Gitignored. + - ./enrol-pki:/pki:ro + # --- Kiosk SPA (spaceship terminal shown by the diskless kiosk) ------------ # Svelte + Tailwind app built into a static bundle served by its own nginx. # Now an INDEPENDENT project — the `kiosk-app` git submodule (its own repo + diff --git a/serving/dot1x-bench/docker-compose.yml b/serving/dot1x-bench/docker-compose.yml index 08ad9be..75a8a59 100644 --- a/serving/dot1x-bench/docker-compose.yml +++ b/serving/dot1x-bench/docker-compose.yml @@ -25,7 +25,13 @@ services: DOCKER_STEPCA_INIT_DNS_NAMES: "${CA_DNS:-ca.fleet.lab},localhost" DOCKER_STEPCA_INIT_ADDRESS: ":${CA_PORT:-8443}" DOCKER_STEPCA_INIT_PROVISIONER_NAME: "enrol" - DOCKER_STEPCA_INIT_PASSWORD_FILE: "/home/step/secrets/password" + # Password to encrypt the CA keys + 'enrol' provisioner. Must be the VALUE + # (_PASSWORD), not _PASSWORD_FILE: the latter is an INPUT path the entrypoint + # reads FROM (for a mounted docker secret), which doesn't exist at first + # init → `step ca init` fails → no CA, no secrets/password (the "CA not + # initialised" error). With _PASSWORD the entrypoint WRITES it to + # /home/step/secrets/password, where bootstrap.sh + the enrol-broker read it. + DOCKER_STEPCA_INIT_PASSWORD: "${CA_PASSWORD:-changeme-bench}" volumes: - ./pki/stepca:/home/step # CA state (root/intermediate/keys/db) — gitignored - ./pki:/export # bootstrap.sh drops root_ca.crt here for the image/radius diff --git a/serving/dot1x-bench/step-ca/bootstrap.sh b/serving/dot1x-bench/step-ca/bootstrap.sh index cc81d44..0123036 100755 --- a/serving/dot1x-bench/step-ca/bootstrap.sh +++ b/serving/dot1x-bench/step-ca/bootstrap.sh @@ -1,12 +1,16 @@ #!/usr/bin/env bash # bootstrap.sh — one-time setup of the bench CA after `docker compose up -d step-ca`. # -# 1. wait for step-ca, export its root to pki/root_ca.crt (-> image radius-ca.pem) +# 1. export the CA root to pki/root_ca.crt (-> image radius-ca.pem) +# 1b. raise the cert-duration claim (so 720h fleet certs are allowed) # 2. ensure an enrolment provisioner exists (signs each host's TPM CSR) # 3. issue the RADIUS server cert/key into pki/radius/ (FreeRADIUS mounts it) # -# Runs the `step` CLI against the running CA. Flags vary a little across step -# versions — BENCH-VERIFY against your `step version` and adjust. Reads .env. +# `step` runs INSIDE the CA container (docker compose exec). Container paths: +# /home/step = CA state (certs/root_ca.crt, secrets/password, config/ca.json) +# /export = host ./pki (files written here appear on the host) +# Flags vary a little across step versions — BENCH-VERIFY against your `step +# version` and adjust. Reads .env. set -euo pipefail cd "$(dirname "$0")/.." @@ -15,29 +19,92 @@ CA_DNS=${CA_DNS:-ca.fleet.lab} CA_PORT=${CA_PORT:-8443} CA_URL="https://${CA_DNS}:${CA_PORT}" PKI=pki -mkdir -p "$PKI/radius" -# The CA's password (auto-init wrote it from this file in the container volume). -PW="$PKI/stepca/secrets/password" -[ -f "$PW" ] || { echo "CA not initialised yet ($PW missing) — is step-ca up?" >&2; exit 1; } +# step-ca initialises its state into ./pki/stepca as uid 1000, but Docker created +# the top-level ./pki as ROOT (it auto-creates a missing bind-mount source), so +# the host user can't write into it ("mkdir: Permission denied"). Self-heal — LAB +# ONLY: make the tree read/write for everyone, so BOTH your host user and the +# uid-1000 CA container can use it. (Pre-creating ./pki owned by you before +# `compose up` avoids this; once fixed it stays fixed.) +# The CA's password (auto-init wrote it here in the container volume). Also the +# 'enrol' provisioner password the broker needs (copy to ../enrol-pki/password). +# Location varies by smallstep image version: newer writes $STEPPATH/password, +# older $STEPPATH/secrets/password — accept whichever exists. +PW="$PKI/stepca/password" +[ -e "$PW" ] || { [ -e "$PKI/stepca/secrets/password" ] && PW="$PKI/stepca/secrets/password"; } +# same file as seen inside the container (/home/step is the ./pki/stepca mount). +CONTAINER_PW="/home/step/${PW#"$PKI/stepca/"}" -step() { docker compose exec -T step-ca step "$@"; } +# Two uid hazards, both self-healed here (LAB ONLY): +# - Docker auto-creates a missing ./pki as ROOT -> host mkdir denied. +# - step-ca writes its state as uid 1000 mode 600 -> host user can't read $PW. +# If we can't create the radius dir OR can't read the password, chmod the tree +# readable/writable for everyone (your user AND the uid-1000 CA container). +if ! mkdir -p "$PKI/radius" 2>/dev/null || { [ -e "$PKI/stepca" ] && [ ! -r "$PW" ]; }; then + echo "==> fixing $PKI perms with sudo (docker/uid-1000 owns it; lab)" + sudo chmod -R a+rwX "$PKI" + mkdir -p "$PKI/radius" +fi + +if [ ! -r "$PW" ]; then + echo "ERROR: CA password $PW missing/unreadable — step-ca did not initialise." >&2 + echo " Check: docker compose logs step-ca (look for an init failure)." >&2 + echo " Common cause: DOCKER_STEPCA_INIT_PASSWORD not set (see compose). To reset:" >&2 + echo " docker compose down && sudo rm -rf $PKI && docker compose up -d step-ca" >&2 + exit 1 +fi + +step() { docker compose exec -T step-ca step "$@"; } +incca() { docker compose exec -T step-ca "$@"; } # --- 1. export the root (becomes files/etc/dot1x/radius-ca.pem) -------------- echo "==> exporting CA root" -docker compose exec -T step-ca cat /home/step/certs/root_ca.crt > "$PKI/root_ca.crt" -FP=$(step certificate fingerprint "$PKI/root_ca.crt" 2>/dev/null || \ - openssl x509 -in "$PKI/root_ca.crt" -noout -fingerprint -sha256 | cut -d= -f2) +incca cp /home/step/certs/root_ca.crt /export/root_ca.crt +FP=$(openssl x509 -in "$PKI/root_ca.crt" -noout -fingerprint -sha256 | cut -d= -f2) echo " root fingerprint: $FP" echo " copy to: files/etc/dot1x/radius-ca.pem (image trust anchor)" +# --- 1b. raise the CA cert-duration claim (idempotent) ---------------------- +# A stock step-ca caps issued certs at 24h. Both the RADIUS server cert below +# AND the enrol-broker (--not-after 720h) need longer-lived fleet certs, so the +# CA rejects them with "requested duration ... more than the authorized maximum +# certificate duration of 24h". Patch authority.claims in the mounted ca.json +# and restart the CA. Set CA_MAX_CERT_DUR / CA_DEFAULT_CERT_DUR in .env to tune. +CA_JSON="$PKI/stepca/config/ca.json" +CA_MAX_CERT_DUR=${CA_MAX_CERT_DUR:-2160h} +CA_DEFAULT_CERT_DUR=${CA_DEFAULT_CERT_DUR:-720h} +if [ -f "$CA_JSON" ]; then + if python3 - "$CA_JSON" "$CA_MAX_CERT_DUR" "$CA_DEFAULT_CERT_DUR" <<'PY' +import json,sys +p,maxd,defd=sys.argv[1],sys.argv[2],sys.argv[3] +c=json.load(open(p)) +claims=c.setdefault("authority",{}).setdefault("claims",{}) +if claims.get("maxTLSCertDuration")==maxd and claims.get("defaultTLSCertDuration")==defd: + sys.exit(1) # already set — no restart needed +claims["maxTLSCertDuration"]=maxd +claims["defaultTLSCertDuration"]=defd +json.dump(c,open(p,"w"),indent=2) +PY + then + echo "==> raised CA claims (max=$CA_MAX_CERT_DUR default=$CA_DEFAULT_CERT_DUR); restarting step-ca" + docker compose restart step-ca >/dev/null + for _ in $(seq 1 50); do + curl -fsS -k "$CA_URL/health" >/dev/null 2>&1 && break; sleep 0.2 + done + else + echo "==> CA claims already set (max=$CA_MAX_CERT_DUR)" + fi +else + echo "WARNING: $CA_JSON not found — cannot raise cert-duration claim; 720h certs will be REJECTED." >&2 +fi + # --- 2. enrolment provisioner (idempotent) ---------------------------------- # JWK provisioner 'enrol' is created by auto-init (DOCKER_STEPCA_INIT_PROVISIONER_NAME). # Enrolment authorizes a CSR with a one-time token: # step ca token --provisioner enrol → passed to `step ca sign` -# That token-gated sign is what enrol/tpm-provision.sh uses. +# That token-gated sign is what the enrol-broker and enrol/tpm-provision.sh use. echo "==> provisioners:" -step ca provisioner list --ca-url "$CA_URL" --root "$PKI/root_ca.crt" \ +step ca provisioner list --ca-url "$CA_URL" --root /export/root_ca.crt \ | grep -E '"(name|type)"' || true # To UPGRADE to TPM attestation later, add an ACME attestation provisioner and @@ -49,13 +116,16 @@ step ca provisioner list --ca-url "$CA_URL" --root "$PKI/root_ca.crt" \ # (then `step ca acme` / an ACME client on the host instead of `step ca sign`.) # --- 3. RADIUS server cert (FreeRADIUS serves this; supplicant validates it) -- +# Written via /export so the files land in the host's pki/radius/ that FreeRADIUS +# mounts. Uses the in-container CA root + provisioner password (no host copies). echo "==> issuing RADIUS server cert (radius.${CA_DNS#ca.})" RADIUS_CN="radius.${CA_DNS#ca.}" +incca mkdir -p /export/radius step ca certificate "$RADIUS_CN" \ - "$PKI/radius/server.pem" "$PKI/radius/server.key" \ - --ca-url "$CA_URL" --root "$PKI/root_ca.crt" \ - --provisioner enrol --provisioner-password-file "$PW" \ + /export/radius/server.pem /export/radius/server.key \ + --ca-url "$CA_URL" --root /export/root_ca.crt \ + --provisioner enrol --provisioner-password-file "$CONTAINER_PW" \ --not-after 720h --force -cp "$PKI/root_ca.crt" "$PKI/radius/ca.pem" +incca cp /export/root_ca.crt /export/radius/ca.pem echo "==> done. FreeRADIUS will read pki/radius/{server.pem,server.key,ca.pem}." echo " Next: cp $PKI/root_ca.crt ../../files/etc/dot1x/radius-ca.pem && rebuild secure-path image." diff --git a/serving/enrol-broker/signer.go b/serving/enrol-broker/signer.go index d10d0c7..04c9668 100644 --- a/serving/enrol-broker/signer.go +++ b/serving/enrol-broker/signer.go @@ -66,30 +66,35 @@ func (s *stepSigner) Sign(ctx context.Context, csrPEM, cn string) (string, strin } // 1. one-time token (subject MUST equal the CSR CN for the JWK provisioner). - tokArgs := []string{ + // NOTE: token validity is the short-lived authorization window (a JWK + // provisioner caps it at ~1h), NOT the issued cert's lifetime — do not put + // s.notAfter here or a multi-day value fails "token validity too long". + token, err := s.run(ctx, "ca", "token", cn, "--provisioner", s.provisioner, "--ca-url", s.caURL, "--root", s.root, "--provisioner-password-file", s.passwordFile, - } - if s.notAfter != "" { - tokArgs = append(tokArgs, "--not-after", s.notAfter) - } - token, err := s.run(ctx, tokArgs...) + ) if err != nil { return "", "", fmt.Errorf("step ca token: %w", err) } token = strings.TrimSpace(token) - // 2. sign the CSR with that token. - if _, err := s.run(ctx, + // 2. sign the CSR with that token. The issued CERT's lifetime is set HERE + // (must be <= the provisioner's maxTLSCertDuration claim, else step-ca + // rejects it — raise that claim on the CA for multi-day fleet certs). + signArgs := []string{ "ca", "sign", csrPath, outPath, "--token", token, "--ca-url", s.caURL, "--root", s.root, "--force", - ); err != nil { + } + if s.notAfter != "" { + signArgs = append(signArgs, "--not-after", s.notAfter) + } + if _, err := s.run(ctx, signArgs...); err != nil { return "", "", fmt.Errorf("step ca sign: %w", err) } certPEM, err := os.ReadFile(outPath) diff --git a/serving/enrol-broker/verify-serving.sh b/serving/enrol-broker/verify-serving.sh new file mode 100755 index 0000000..58fd045 --- /dev/null +++ b/serving/enrol-broker/verify-serving.sh @@ -0,0 +1,50 @@ +#!/usr/bin/env bash +# Verify the enrol-broker as deployed in the serving stack. Run ON THE SERVING +# HOST. Exercises the FULL path: public side through the nginx /enrol/ proxy +# (:80) + the admin plane on loopback :9443. +# +# ./verify-serving.sh # admin insecure (ENROL_ADMIN_INSECURE=true) +# ADMIN_P12=enrol-pki/broker/clients/alice.p12 ./verify-serving.sh # admin mTLS +# +# Stand-in for the (not-yet-built) host side: an openssl CSR plays the TPM key. +set -euo pipefail + +PUB_BASE="${PUB_BASE:-http://127.0.0.1/enrol}" # via nginx; use http://127.0.0.1:9090 to hit broker directly +ADMIN_BASE="${ADMIN_BASE:-http://127.0.0.1:9443}" +ADMIN_P12="${ADMIN_P12:-}" # set => admin is mTLS (https + client cert) + +WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT +jqget() { python3 -c 'import json,sys;print(json.load(sys.stdin)["'"$1"'"])'; } + +# admin curl: plaintext by default, or mTLS if a .p12 is given. +admin() { + if [ -n "$ADMIN_P12" ]; then + openssl pkcs12 -in "$ADMIN_P12" -clcerts -nokeys -passin pass: -out "$WORK/ac.pem" 2>/dev/null + openssl pkcs12 -in "$ADMIN_P12" -nocerts -nodes -passin pass: -out "$WORK/ak.pem" 2>/dev/null + curl -fsS --cert "$WORK/ac.pem" --key "$WORK/ak.pem" -k "${ADMIN_BASE/http:/https:}$1" "${@:2}" + else + curl -fsS "$ADMIN_BASE$1" "${@:2}" + fi +} + +echo "== healthz (through nginx) ==" +curl -fsS "$PUB_BASE/healthz"; echo + +echo "== generate CSR (stand-in for the TPM key) ==" +openssl ecparam -name prime256v1 -genkey -noout -out "$WORK/h.key" 2>/dev/null +openssl req -new -key "$WORK/h.key" -subj "/CN=fleet-host" -out "$WORK/h.csr" 2>/dev/null +CSR_JSON=$(python3 -c 'import json,sys;print(json.dumps(open(sys.argv[1]).read()))' "$WORK/h.csr") + +echo "== POST /enrol/request ==" +REQ=$(curl -fsS -X POST "$PUB_BASE/request" -H 'Content-Type: application/json' \ + -d "{\"csr\": $CSR_JSON, \"context\": {\"mac\":\"de:ad:be:ef:00:01\",\"dmi_serial\":\"VERIFY-001\"}}") +echo "$REQ" +ID=$(echo "$REQ" | jqget enrol_id) +echo "enrol_id=$ID fingerprint=$(echo "$REQ" | jqget fingerprint)" + +echo "== admin /pending =="; admin /pending; echo +echo "== approve $ID =="; admin "/approve/$ID" -X POST; echo +echo "== /enrol/status/$ID (expect approved + cert) ==" +curl -fsS "$PUB_BASE/status/$ID" | python3 -m json.tool +echo +echo "PASS: request -> approve -> cert through the serving deployment." diff --git a/serving/enrol-pki/.gitignore b/serving/enrol-pki/.gitignore new file mode 100644 index 0000000..a48118d --- /dev/null +++ b/serving/enrol-pki/.gitignore @@ -0,0 +1,4 @@ +# enrol-broker PKI material (CA root, provisioner password, admin mTLS certs). +# Mounted read-only at /pki. Keep the dir, never commit its contents. +* +!.gitignore