kra-cmc-test.yml

name: KRA with CMC

on:
  workflow_call:
    inputs:
      os:
        required: true
        type: string

jobs:
  # docs/installation/kra/Installing_KRA_with_External_Certificates.md
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v3

      - name: Retrieve runner image
        uses: actions/cache@v3
        with:
          key: pki-kra-runner-${{ inputs.os }}-${{ github.run_id }}
          path: pki-runner.tar

      - name: Load runner image
        run: docker load --input pki-runner.tar

      - name: Create network
        run: docker network create example

      - name: Set up CA DS container
        run: |
          tests/bin/ds-container-create.sh cads
        env:
          IMAGE: ${{ needs.init.outputs.db-image }}
          HOSTNAME: cads.example.com
          PASSWORD: Secret.123

      - name: Connect CA DS container to network
        run: docker network connect example cads --alias cads.example.com

      - name: Set up CA container
        run: |
          tests/bin/runner-init.sh ca
        env:
          HOSTNAME: ca.example.com

      - name: Connect CA container to network
        run: docker network connect example ca --alias ca.example.com

      - name: Install CA in CA container
        run: |
          docker exec ca pkispawn \
              -f /usr/share/pki/server/examples/installation/ca.cfg \
              -s CA \
              -D pki_ds_hostname=cads.example.com \
              -D pki_ds_ldap_port=3389 \
              -D pki_cert_id_generator=random \
              -D pki_request_id_generator=random \
              -v

          docker exec ca pki-server cert-find

      - name: Initialize CA admin in CA container
        run: |
          docker exec ca pki-server cert-export ca_signing --cert-file $SHARED/ca_signing.crt
          docker exec ca pki client-cert-import ca_signing --ca-cert $SHARED/ca_signing.crt
          docker exec ca pki client-cert-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password Secret.123

      - name: Set up KRA DS container
        run: |
          tests/bin/ds-container-create.sh krads
        env:
          IMAGE: ${{ needs.init.outputs.db-image }}
          HOSTNAME: krads.example.com
          PASSWORD: Secret.123

      - name: Connect KRA DS container to network
        run: docker network connect example krads --alias krads.example.com

      - name: Set up KRA container
        run: |
          tests/bin/runner-init.sh kra
        env:
          HOSTNAME: kra.example.com

      - name: Connect KRA container to network
        run: docker network connect example kra --alias kra.example.com

      - name: Install KRA in KRA container (step 1)
        run: |
          docker exec kra pkispawn \
              -f /usr/share/pki/server/examples/installation/kra-external-certs-step1.cfg \
              -s KRA \
              -D pki_cert_chain_path=$SHARED/ca_signing.crt \
              -D pki_ds_hostname=krads.example.com \
              -D pki_ds_ldap_port=3389 \
              -D pki_storage_csr_path=$SHARED/kra_storage.csr \
              -D pki_transport_csr_path=$SHARED/kra_transport.csr \
              -D pki_subsystem_csr_path=$SHARED/subsystem.csr \
              -D pki_sslserver_csr_path=$SHARED/sslserver.csr \
              -D pki_audit_signing_csr_path=$SHARED/kra_audit_signing.csr \
              -D pki_admin_csr_path=$SHARED/kra_admin.csr \
              -D pki_key_id_generator=random \
              -D pki_request_id_generator=random \
              -v

      # https://github.com/dogtagpki/pki/wiki/Issuing-KRA-Storage-Certificate-with-CMC
      - name: Issue KRA storage cert with CMC
        run: |
          # check cert request
          docker exec ca openssl req -text -noout -in $SHARED/kra_storage.csr

          # create CMC request
          docker exec ca mv $SHARED/kra_storage.csr kra_storage.csr
          docker exec ca CMCRequest \
              /usr/share/pki/server/examples/cmc/kra_storage-cmc-request.cfg

          # submit CMC request
          docker exec ca HttpClient \
              /usr/share/pki/server/examples/cmc/kra_storage-cmc-submit.cfg

          # convert CMC response (DER PKCS #7) into PEM PKCS #7 cert chain
          docker exec ca CMCResponse \
              -d /root/.dogtag/nssdb \
              -i kra_storage.cmc-response \
              -o $SHARED/kra_storage.p7b

          # check issued cert chain
          docker exec ca openssl pkcs7 -print_certs -in $SHARED/kra_storage.p7b

      # https://github.com/dogtagpki/pki/wiki/Issuing-KRA-Transport-Certificate-with-CMC
      - name: Issue KRA transport cert with CMC
        run: |
          # check cert request
          docker exec ca openssl req -text -noout -in $SHARED/kra_transport.csr

          # create CMC request
          docker exec ca mv $SHARED/kra_transport.csr kra_transport.csr
          docker exec ca CMCRequest \
              /usr/share/pki/server/examples/cmc/kra_transport-cmc-request.cfg

          # submit CMC request
          docker exec ca HttpClient \
              /usr/share/pki/server/examples/cmc/kra_transport-cmc-submit.cfg

          # convert CMC response (DER PKCS #7) into PEM PKCS #7 cert chain
          docker exec ca CMCResponse \
              -d /root/.dogtag/nssdb \
              -i kra_transport.cmc-response \
              -o $SHARED/kra_transport.p7b

          # check issued cert chain
          docker exec ca openssl pkcs7 -print_certs -in $SHARED/kra_transport.p7b

      # https://github.com/dogtagpki/pki/wiki/Issuing-Subsystem-Certificate-with-CMC
      - name: Issue subsystem cert with CMC
        run: |
          # check cert request
          docker exec ca openssl req -text -noout -in $SHARED/subsystem.csr

          # create CMC request
          docker exec ca mv $SHARED/subsystem.csr subsystem.csr
          docker exec ca CMCRequest \
              /usr/share/pki/server/examples/cmc/subsystem-cmc-request.cfg

          # submit CMC request
          docker exec ca HttpClient \
              /usr/share/pki/server/examples/cmc/subsystem-cmc-submit.cfg

          # convert CMC response (DER PKCS #7) into PEM PKCS #7 cert chain
          docker exec ca CMCResponse \
              -d /root/.dogtag/nssdb \
              -i subsystem.cmc-response \
              -o $SHARED/subsystem.p7b

          # check issued cert chain
          docker exec ca openssl pkcs7 -print_certs -in $SHARED/subsystem.p7b

      # https://github.com/dogtagpki/pki/wiki/Issuing-SSL-Server-Certificate-with-CMC
      - name: Issue SSL server cert with CMC
        run: |
          # check cert request
          docker exec ca openssl req -text -noout -in $SHARED/sslserver.csr

          # create CMC request
          docker exec ca mv $SHARED/sslserver.csr sslserver.csr
          docker exec ca CMCRequest \
              /usr/share/pki/server/examples/cmc/sslserver-cmc-request.cfg

          # submit CMC request
          docker exec ca HttpClient \
              /usr/share/pki/server/examples/cmc/sslserver-cmc-submit.cfg

          # convert CMC response (DER PKCS #7) into PEM PKCS #7 cert chain
          docker exec ca CMCResponse \
              -d /root/.dogtag/nssdb \
              -i sslserver.cmc-response \
              -o $SHARED/sslserver.p7b

          # check issued cert chain
          docker exec ca openssl pkcs7 -print_certs -in $SHARED/sslserver.p7b

      # https://github.com/dogtagpki/pki/wiki/Issuing-Audit-Signing-Certificate-with-CMC
      - name: Issue KRA audit signing cert with CMC
        run: |
          # check cert request
          docker exec ca openssl req -text -noout -in $SHARED/kra_audit_signing.csr

          # create CMC request
          docker exec ca mv $SHARED/kra_audit_signing.csr audit_signing.csr
          docker exec ca CMCRequest \
              /usr/share/pki/server/examples/cmc/audit_signing-cmc-request.cfg

          # submit CMC request
          docker exec ca HttpClient \
              /usr/share/pki/server/examples/cmc/audit_signing-cmc-submit.cfg

          # convert CMC response (DER PKCS #7) into PEM PKCS #7 cert chain
          docker exec ca CMCResponse \
              -d /root/.dogtag/nssdb \
              -i audit_signing.cmc-response \
              -o $SHARED/kra_audit_signing.p7b

          # check issued cert chain
          docker exec ca openssl pkcs7 -print_certs -in $SHARED/kra_audit_signing.p7b

      # https://github.com/dogtagpki/pki/wiki/Issuing-Admin-Certificate-with-CMC
      - name: Issue KRA admin cert with CMC
        run: |
          # check cert request
          docker exec ca openssl req -text -noout -in $SHARED/kra_admin.csr

          # create CMC request
          docker exec ca mv $SHARED/kra_admin.csr admin.csr
          docker exec ca CMCRequest \
              /usr/share/pki/server/examples/cmc/admin-cmc-request.cfg

          # submit CMC request
          docker exec ca HttpClient \
              /usr/share/pki/server/examples/cmc/admin-cmc-submit.cfg

          # convert CMC response (DER PKCS #7) into PEM PKCS #7 cert chain
          docker exec ca CMCResponse \
              -d /root/.dogtag/nssdb \
              -i admin.cmc-response \
              -o kra_admin.p7b

          # pki_admin_cert_path only supports a single cert so the admin cert
          # needs to be exported from the PKCS #7 cert chain
          # TODO: fix pki_admin_cert_path to support PKCS #7 cert chain
          docker exec ca pki pkcs7-cert-export \
              --pkcs7 kra_admin.p7b \
              --output-prefix kra_admin- \
              --output-suffix .crt
          docker exec ca mv kra_admin-1.crt $SHARED/kra_admin.crt

          # check issued cert
          docker exec ca openssl x509 -text -noout -in $SHARED/kra_admin.crt

      - name: Install KRA in KRA container (step 2)
        run: |
          docker exec kra pkispawn \
              -f /usr/share/pki/server/examples/installation/kra-external-certs-step2.cfg \
              -s KRA \
              -D pki_cert_chain_path=$SHARED/ca_signing.crt \
              -D pki_ds_hostname=krads.example.com \
              -D pki_ds_ldap_port=3389 \
              -D pki_storage_csr_path=$SHARED/kra_storage.csr \
              -D pki_transport_csr_path=$SHARED/kra_transport.csr \
              -D pki_subsystem_csr_path=$SHARED/subsystem.csr \
              -D pki_sslserver_csr_path=$SHARED/sslserver.csr \
              -D pki_audit_signing_csr_path=$SHARED/kra_audit_signing.csr \
              -D pki_admin_csr_path=$SHARED/kra_admin.csr \
              -D pki_storage_cert_path=$SHARED/kra_storage.p7b \
              -D pki_transport_cert_path=$SHARED/kra_transport.p7b \
              -D pki_subsystem_cert_path=$SHARED/subsystem.p7b \
              -D pki_sslserver_cert_path=$SHARED/sslserver.p7b \
              -D pki_audit_signing_cert_path=$SHARED/kra_audit_signing.p7b \
              -D pki_admin_cert_path=$SHARED/kra_admin.crt \
              -D pki_key_id_generator=random \
              -D pki_request_id_generator=random \
              -v

          docker exec kra pki-server cert-find

      # TODO: Fix DogtagKRAConnectivityCheck to work without CA
      # - name: Run PKI healthcheck
      #   run: docker exec kra pki-healthcheck --failures-only

      - name: Verify KRA admin
        run: |
          docker exec kra pki client-cert-import ca_signing --ca-cert $SHARED/ca_signing.crt
          docker exec kra pki client-cert-import \
              --pkcs12 /root/.dogtag/pki-tomcat/kra_admin_cert.p12 \
              --pkcs12-password Secret.123
          docker exec kra pki -n kraadmin kra-user-show kraadmin

      - name: Gather artifacts from CA containers
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh --output=/tmp/artifacts/ca cads
          tests/bin/pki-artifacts-save.sh ca
        continue-on-error: true

      - name: Gather artifacts from KRA containers
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh --output=/tmp/artifacts/kra krads
          tests/bin/pki-artifacts-save.sh kra
        continue-on-error: true

      - name: Remove KRA from KRA container
        run: docker exec kra pkidestroy -i pki-tomcat -s KRA -v

      - name: Remove CA from CA container
        run: docker exec ca pkidestroy -i pki-tomcat -s CA -v

      - name: Upload artifacts from CA containers
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: kra-cmc-ca-${{ inputs.os }}
          path: |
            /tmp/artifacts/ca

      - name: Upload artifacts from KRA containers
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: kra-cmc-kra-${{ inputs.os }}
          path: |
            /tmp/artifacts/kra