Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

integration: save hierarchy across runs #5729

Merged
merged 3 commits into from
Oct 21, 2021
Merged

integration: save hierarchy across runs #5729

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f1a70cb
integration: save hierarchy across runs
jsha Oct 19, 2021
61719ec
Merge branch 'main' of github.com:letsencrypt/boulder into save-hiera…
jsha Oct 19, 2021
54e87d1
Remove debugging print
jsha Oct 20, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,3 +37,5 @@ tags
.idea

.vscode/*
.hierarchy/
.softhsm-tokens/
2 changes: 2 additions & 0 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ services:
volumes:
- .:/go/src/github.com/letsencrypt/boulder:cached
- ./.gocache:/root/.cache/go-build:cached
- ./.hierarchy:/hierarchy/:cached
- ./.softhsm-tokens/:/var/lib/softhsm/tokens/:cached
networks:
bluenet:
ipv4_address: 10.77.77.77
Expand Down
10 changes: 5 additions & 5 deletions test/cert-ceremonies/generate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ func genCert(path string) error {
func main() {
// If one of the output files already exists, assume this ran once
// already for the container and don't re-run.
outputFile := "/tmp/root-signing-pub-rsa.pem"
outputFile := "/hierarchy/root-signing-pub-rsa.pem"
if loc, err := os.Stat(outputFile); err == nil && loc.Mode().IsRegular() {
fmt.Println("skipping certificate generation: already exists")
return
Expand Down Expand Up @@ -113,13 +113,13 @@ func main() {
// signing key slots and IDs
rsaTmpIntermediateA, err := rewriteConfig("test/cert-ceremonies/intermediate-ceremony-rsa.yaml", map[string]string{
"SlotID": rsaRootKeySlot,
"CertPath": "/tmp/intermediate-cert-rsa-a.pem",
"CertPath": "/hierarchy/intermediate-cert-rsa-a.pem",
"CommonName": "CA intermediate (RSA) A",
})
cmd.FailOnError(err, "failed to rewrite RSA intermediate cert config with key ID")
ecdsaTmpIntermediateA, err := rewriteConfig("test/cert-ceremonies/intermediate-ceremony-ecdsa.yaml", map[string]string{
"SlotID": ecdsaRootKeySlot,
"CertPath": "/tmp/intermediate-cert-ecdsa-a.pem",
"CertPath": "/hierarchy/intermediate-cert-ecdsa-a.pem",
"CommonName": "CA intermediate (ECDSA) A",
})
cmd.FailOnError(err, "failed to rewrite ECDSA intermediate cert config with key ID")
Expand All @@ -134,13 +134,13 @@ func main() {
// signing key slots and IDs
rsaTmpIntermediateB, err := rewriteConfig("test/cert-ceremonies/intermediate-ceremony-rsa.yaml", map[string]string{
"SlotID": rsaRootKeySlot,
"CertPath": "/tmp/intermediate-cert-rsa-b.pem",
"CertPath": "/hierarchy/intermediate-cert-rsa-b.pem",
"CommonName": "CA intermediate (RSA) B",
})
cmd.FailOnError(err, "failed to rewrite RSA intermediate cert config with key ID")
ecdsaTmpIntermediateB, err := rewriteConfig("test/cert-ceremonies/intermediate-ceremony-ecdsa.yaml", map[string]string{
"SlotID": ecdsaRootKeySlot,
"CertPath": "/tmp/intermediate-cert-ecdsa-b.pem",
"CertPath": "/hierarchy/intermediate-cert-ecdsa-b.pem",
"CommonName": "CA intermediate (ECDSA) B",
})
cmd.FailOnError(err, "failed to rewrite ECDSA intermediate cert config with key ID")
Expand Down
4 changes: 2 additions & 2 deletions test/cert-ceremonies/intermediate-ceremony-ecdsa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@ pkcs11:
signing-key-slot: {{ .SlotID}}
signing-key-label: root signing key (ecdsa)
inputs:
public-key-path: /tmp/intermediate-signing-pub-ecdsa.pem
issuer-certificate-path: /tmp/root-cert-ecdsa.pem
public-key-path: /hierarchy/intermediate-signing-pub-ecdsa.pem
issuer-certificate-path: /hierarchy/root-cert-ecdsa.pem
outputs:
certificate-path: {{ .CertPath }}
certificate-profile:
Expand Down
4 changes: 2 additions & 2 deletions test/cert-ceremonies/intermediate-ceremony-rsa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@ pkcs11:
signing-key-slot: {{ .SlotID}}
signing-key-label: root signing key (rsa)
inputs:
public-key-path: /tmp/intermediate-signing-pub-rsa.pem
issuer-certificate-path: /tmp/root-cert-rsa.pem
public-key-path: /hierarchy/intermediate-signing-pub-rsa.pem
issuer-certificate-path: /hierarchy/root-cert-rsa.pem
outputs:
certificate-path: {{ .CertPath }}
certificate-profile:
Expand Down
2 changes: 1 addition & 1 deletion test/cert-ceremonies/intermediate-key-ceremony-ecdsa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,4 @@ key:
type: ecdsa
ecdsa-curve: P-384
outputs:
public-key-path: /tmp/intermediate-signing-pub-ecdsa.pem
public-key-path: /hierarchy/intermediate-signing-pub-ecdsa.pem
2 changes: 1 addition & 1 deletion test/cert-ceremonies/intermediate-key-ceremony-rsa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,4 @@ key:
type: rsa
rsa-mod-length: 2048
outputs:
public-key-path: /tmp/intermediate-signing-pub-rsa.pem
public-key-path: /hierarchy/intermediate-signing-pub-rsa.pem
6 changes: 3 additions & 3 deletions test/cert-ceremonies/intermediate-ocsp-rsa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,10 @@ pkcs11:
signing-key-slot: {{ .SlotID}}
signing-key-label: root signing key (rsa)
inputs:
certificate-path: /tmp/intermediate-cert-rsa-a.pem
issuer-certificate-path: /tmp/root-cert-rsa.pem
certificate-path: /hierarchy/intermediate-cert-rsa-a.pem
issuer-certificate-path: /hierarchy/root-cert-rsa.pem
outputs:
response-path: /tmp/intermediate-ocsp-rsa.b64
response-path: /hierarchy/intermediate-ocsp-rsa.b64
ocsp-profile:
this-update: 2020-01-01 12:00:00
next-update: 2039-01-01 12:00:00
Expand Down
4 changes: 2 additions & 2 deletions test/cert-ceremonies/root-ceremony-ecdsa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ key:
type: ecdsa
ecdsa-curve: P-384
outputs:
public-key-path: /tmp/root-signing-pub-ecdsa.pem
certificate-path: /tmp/root-cert-ecdsa.pem
public-key-path: /hierarchy/root-signing-pub-ecdsa.pem
certificate-path: /hierarchy/root-cert-ecdsa.pem
certificate-profile:
signature-algorithm: ECDSAWithSHA384
common-name: CA root (ECDSA)
Expand Down
4 changes: 2 additions & 2 deletions test/cert-ceremonies/root-ceremony-rsa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ key:
type: rsa
rsa-mod-length: 4096
outputs:
public-key-path: /tmp/root-signing-pub-rsa.pem
certificate-path: /tmp/root-cert-rsa.pem
public-key-path: /hierarchy/root-signing-pub-rsa.pem
certificate-path: /hierarchy/root-cert-rsa.pem
certificate-profile:
signature-algorithm: SHA256WithRSA
common-name: CA root (RSA)
Expand Down
4 changes: 2 additions & 2 deletions test/config-next/ca-a.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@
"crlURL": "http://example.com/crl",
"location": {
"configFile": "test/test-ca.key-pkcs11.json",
"certFile": "/tmp/intermediate-cert-rsa-a.pem",
"certFile": "/hierarchy/intermediate-cert-rsa-a.pem",
"numSessions": 2
}
},
Expand All @@ -72,7 +72,7 @@
"crlURL": "http://example.com/crl",
"location": {
"configFile": "test/test-ca.key-pkcs11.json",
"certFile": "/tmp/intermediate-cert-rsa-b.pem",
"certFile": "/hierarchy/intermediate-cert-rsa-b.pem",
"numSessions": 2
}
}
Expand Down
4 changes: 2 additions & 2 deletions test/config-next/ca-b.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@
"crlURL": "http://example.com/crl",
"location": {
"configFile": "test/test-ca.key-pkcs11.json",
"certFile": "/tmp/intermediate-cert-rsa-a.pem",
"certFile": "/hierarchy/intermediate-cert-rsa-a.pem",
"numSessions": 2
}
},
Expand All @@ -72,7 +72,7 @@
"crlURL": "http://example.com/crl",
"location": {
"configFile": "test/test-ca.key-pkcs11.json",
"certFile": "/tmp/intermediate-cert-rsa-b.pem",
"certFile": "/hierarchy/intermediate-cert-rsa-b.pem",
"numSessions": 2
}
}
Expand Down
6 changes: 3 additions & 3 deletions test/config-next/ocsp-responder.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,9 @@
"path": "/",
"listenAddress": "0.0.0.0:4002",
"issuerCerts": [
"/tmp/intermediate-cert-rsa-a.pem",
"/tmp/intermediate-cert-rsa-b.pem",
"/tmp/intermediate-cert-ecdsa-a.pem"
"/hierarchy/intermediate-cert-rsa-a.pem",
"/hierarchy/intermediate-cert-rsa-b.pem",
"/hierarchy/intermediate-cert-ecdsa-a.pem"
],
"maxAge": "10s",
"timeout": "4.9s",
Expand Down
6 changes: 3 additions & 3 deletions test/config-next/orphan-finder.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
{
"backdate": "1h",
"issuerCerts": [
"/tmp/intermediate-cert-rsa-a.pem",
"/tmp/intermediate-cert-rsa-b.pem",
"/tmp/intermediate-cert-ecdsa-a.pem"
"/hierarchy/intermediate-cert-rsa-a.pem",
"/hierarchy/intermediate-cert-rsa-b.pem",
"/hierarchy/intermediate-cert-ecdsa-a.pem"
],

"syslog": {
Expand Down
16 changes: 8 additions & 8 deletions test/config-next/publisher.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,20 +4,20 @@
"blockProfileRate": 1000000000,
"chains": [
[
"/tmp/intermediate-cert-rsa-a.pem",
"/tmp/root-cert-rsa.pem"
"/hierarchy/intermediate-cert-rsa-a.pem",
"/hierarchy/root-cert-rsa.pem"
],
[
"/tmp/intermediate-cert-rsa-b.pem",
"/tmp/root-cert-rsa.pem"
"/hierarchy/intermediate-cert-rsa-b.pem",
"/hierarchy/root-cert-rsa.pem"
],
[
"/tmp/intermediate-cert-ecdsa-a.pem",
"/tmp/root-cert-ecdsa.pem"
"/hierarchy/intermediate-cert-ecdsa-a.pem",
"/hierarchy/root-cert-ecdsa.pem"
],
[
"/tmp/intermediate-cert-ecdsa-b.pem",
"/tmp/root-cert-ecdsa.pem"
"/hierarchy/intermediate-cert-ecdsa-b.pem",
"/hierarchy/root-cert-ecdsa.pem"
]
],
"debugAddr": ":8009",
Expand Down
6 changes: 3 additions & 3 deletions test/config-next/ra.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@
"blockedKeyFile": "test/example-blocked-keys.yaml",
"orderLifetime": "168h",
"issuerCerts": [
"/tmp/intermediate-cert-rsa-a.pem",
"/tmp/intermediate-cert-rsa-b.pem",
"/tmp/intermediate-cert-ecdsa-a.pem"
"/hierarchy/intermediate-cert-rsa-a.pem",
"/hierarchy/intermediate-cert-rsa-b.pem",
"/hierarchy/intermediate-cert-ecdsa-a.pem"
],
"tls": {
"caCertFile": "test/grpc-creds/minica.pem",
Expand Down
2 changes: 1 addition & 1 deletion test/config-next/wfe.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,6 @@
},

"common": {
"issuerCert": "/tmp/intermediate-cert-rsa-a.pem"
"issuerCert": "/hierarchy/intermediate-cert-rsa-a.pem"
}
}
16 changes: 8 additions & 8 deletions test/config-next/wfe2.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,20 +41,20 @@
},
"chains": [
[
"/tmp/intermediate-cert-rsa-a.pem",
"/tmp/root-cert-rsa.pem"
"/hierarchy/intermediate-cert-rsa-a.pem",
"/hierarchy/root-cert-rsa.pem"
],
[
"/tmp/intermediate-cert-rsa-b.pem",
"/tmp/root-cert-rsa.pem"
"/hierarchy/intermediate-cert-rsa-b.pem",
"/hierarchy/root-cert-rsa.pem"
],
[
"/tmp/intermediate-cert-ecdsa-a.pem",
"/tmp/root-cert-ecdsa.pem"
"/hierarchy/intermediate-cert-ecdsa-a.pem",
"/hierarchy/root-cert-ecdsa.pem"
],
[
"/tmp/intermediate-cert-ecdsa-b.pem",
"/tmp/root-cert-ecdsa.pem"
"/hierarchy/intermediate-cert-ecdsa-b.pem",
"/hierarchy/root-cert-ecdsa.pem"
]
],
"staleTimeout": "5m",
Expand Down
4 changes: 2 additions & 2 deletions test/config/ca-a.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@
"crlURL": "http://example.com/crl",
"location": {
"configFile": "test/test-ca.key-pkcs11.json",
"certFile": "/tmp/intermediate-cert-rsa-a.pem",
"certFile": "/hierarchy/intermediate-cert-rsa-a.pem",
"numSessions": 2
}
},
Expand All @@ -72,7 +72,7 @@
"crlURL": "http://example.com/crl",
"location": {
"configFile": "test/test-ca.key-pkcs11.json",
"certFile": "/tmp/intermediate-cert-rsa-b.pem",
"certFile": "/hierarchy/intermediate-cert-rsa-b.pem",
"numSessions": 2
}
}
Expand Down
4 changes: 2 additions & 2 deletions test/config/ca-b.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@
"crlURL": "http://example.com/crl",
"location": {
"configFile": "test/test-ca.key-pkcs11.json",
"certFile": "/tmp/intermediate-cert-rsa-a.pem",
"certFile": "/hierarchy/intermediate-cert-rsa-a.pem",
"numSessions": 2
}
},
Expand All @@ -72,7 +72,7 @@
"crlURL": "http://example.com/crl",
"location": {
"configFile": "test/test-ca.key-pkcs11.json",
"certFile": "/tmp/intermediate-cert-rsa-b.pem",
"certFile": "/hierarchy/intermediate-cert-rsa-b.pem",
"numSessions": 2
}
}
Expand Down
6 changes: 3 additions & 3 deletions test/config/ocsp-responder.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,9 @@
"path": "/",
"listenAddress": "0.0.0.0:4002",
"issuerCerts": [
"/tmp/intermediate-cert-rsa-a.pem",
"/tmp/intermediate-cert-rsa-b.pem",
"/tmp/intermediate-cert-ecdsa-a.pem"
"/hierarchy/intermediate-cert-rsa-a.pem",
"/hierarchy/intermediate-cert-rsa-b.pem",
"/hierarchy/intermediate-cert-ecdsa-a.pem"
],
"maxAge": "10s",
"timeout": "4.9s",
Expand Down
6 changes: 3 additions & 3 deletions test/config/orphan-finder.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
{
"backdate": "1h",
"issuerCerts": [
"/tmp/intermediate-cert-rsa-a.pem",
"/tmp/intermediate-cert-rsa-b.pem",
"/tmp/intermediate-cert-ecdsa-a.pem"
"/hierarchy/intermediate-cert-rsa-a.pem",
"/hierarchy/intermediate-cert-rsa-b.pem",
"/hierarchy/intermediate-cert-ecdsa-a.pem"
],


Expand Down
16 changes: 8 additions & 8 deletions test/config/publisher.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,20 +4,20 @@
"blockProfileRate": 1000000000,
"chains": [
[
"/tmp/intermediate-cert-rsa-a.pem",
"/tmp/root-cert-rsa.pem"
"/hierarchy/intermediate-cert-rsa-a.pem",
"/hierarchy/root-cert-rsa.pem"
],
[
"/tmp/intermediate-cert-rsa-b.pem",
"/tmp/root-cert-rsa.pem"
"/hierarchy/intermediate-cert-rsa-b.pem",
"/hierarchy/root-cert-rsa.pem"
],
[
"/tmp/intermediate-cert-ecdsa-a.pem",
"/tmp/root-cert-ecdsa.pem"
"/hierarchy/intermediate-cert-ecdsa-a.pem",
"/hierarchy/root-cert-ecdsa.pem"
],
[
"/tmp/intermediate-cert-ecdsa-b.pem",
"/tmp/root-cert-ecdsa.pem"
"/hierarchy/intermediate-cert-ecdsa-b.pem",
"/hierarchy/root-cert-ecdsa.pem"
]
],
"debugAddr": ":8009",
Expand Down
2 changes: 1 addition & 1 deletion test/config/ra.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
"weakKeyFile": "test/example-weak-keys.json",
"blockedKeyFile": "test/example-blocked-keys.yaml",
"orderLifetime": "168h",
"issuerCertPath": "/tmp/intermediate-cert-rsa-a.pem",
"issuerCertPath": "/hierarchy/intermediate-cert-rsa-a.pem",
"tls": {
"caCertFile": "test/grpc-creds/minica.pem",
"certFile": "test/grpc-creds/ra.boulder/cert.pem",
Expand Down
2 changes: 1 addition & 1 deletion test/config/wfe.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,6 @@
},

"common": {
"issuerCert": "/tmp/intermediate-cert-rsa-a.pem"
"issuerCert": "/hierarchy/intermediate-cert-rsa-a.pem"
}
}
8 changes: 4 additions & 4 deletions test/config/wfe2.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,12 +40,12 @@
}
},
"certificateChains": {
"http://boulder:4430/acme/issuer-cert": [ "/tmp/intermediate-cert-rsa-a.pem" ],
"http://127.0.0.1:4000/acme/issuer-cert": [ "/tmp/intermediate-cert-rsa-a.pem" ]
"http://boulder:4430/acme/issuer-cert": [ "/hierarchy/intermediate-cert-rsa-a.pem" ],
"http://127.0.0.1:4000/acme/issuer-cert": [ "/hierarchy/intermediate-cert-rsa-a.pem" ]
},
"alternateCertificateChains": {
"http://boulder:4430/acme/issuer-cert": [ "/tmp/intermediate-cert-rsa-a.pem" ],
"http://127.0.0.1:4000/acme/issuer-cert": [ "/tmp/intermediate-cert-rsa-a.pem" ]
"http://boulder:4430/acme/issuer-cert": [ "/hierarchy/intermediate-cert-rsa-a.pem" ],
"http://127.0.0.1:4000/acme/issuer-cert": [ "/hierarchy/intermediate-cert-rsa-a.pem" ]
},
"staleTimeout": "5m",
"authorizationLifetimeDays": 30,
Expand Down
Loading