Repository navigation
feat(pki): subordinate CA, agent trust updates and CA rotation - #217
Merged
Merged
Conversation
Run the Bor CA as a subordinate of an external certificate authority: - The CA certificate file may hold a chain: the signing certificate first, then its issuers up to a self-signed root. The chain is validated at startup (key match, CA flag, key usage, extended key usage, key strength, path length, name constraints). - Agent certificates are verified against the Bor signing certificate only. Before, every certificate in the CA file was trusted for client authentication, so a chain in the file let any CA under the same root issue agent certificates. - The auto-generated server certificate is served with the signing certificate and the intermediates. - New commands: bor-server ca csr | import | status. The CA key is created on the server (or the PKCS#11 token) and never leaves it. A certificate for the same key and subject replaces the CA certificate in place without re-enrolling agents. - New setting ca.agent_trust (BOR_CA_AGENT_TRUST): signing (default) or chain. Keep the CA certificates of enrolled agents current: an agent reports the fingerprint of its CA file with every heartbeat and the server answers with the certificates to trust when they differ. The agent reads its CA file and its own certificate again for every connection. Add the mechanism for replacing the CA with one that has a new key (stage, activate, retire), exposed to extension modules through pkg/ext together with CA status, signing request and install. The server asks agents holding a certificate of a replaced CA to renew. Migration 000047 records per node which CA certificates it trusts and which CA issued its certificate. Settings panels of extension modules can return a document to copy or download. An operator-supplied CA with a key below RSA 3072 or ECDSA P-256 now stops the server at startup. Closes #215
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…tificates The agent reads its CA certificate file again for every connection, so it follows a replacement of the server's CA. This was done by switching the built-in verification off and verifying in a VerifyConnection callback, which code scanning reports as a disabled certificate check. Use transport credentials that load the root CAs from the file for each handshake and run the regular crypto/tls handshake with them instead. The certificate chain and server name are verified by crypto/tls again; no hand-written verification remains.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Run the Bor CA as a subordinate of an external certificate authority:
Keep the CA certificates of enrolled agents current: an agent reports the fingerprint of its CA file with every heartbeat and the server answers with the certificates to trust when they differ. The agent reads its CA file and its own certificate again for every connection.
Add the mechanism for replacing the CA with one that has a new key (stage, activate, retire), exposed to extension modules through pkg/ext together with CA status, signing request and install. The server asks agents holding a certificate of a replaced CA to renew. Migration 000047 records per node which CA certificates it trusts and which CA issued its certificate.
Settings panels of extension modules can return a document to copy or download.
An operator-supplied CA with a key below RSA 3072 or ECDSA P-256 now stops the server at startup.
Closes #215