Light

eliezio / simple-pki Goto Github PK

View Code? Open in Web Editor NEW

4.0 1.0 1.0 1.21 MB

A Simple PKI

Home Page: https://eliezio.github.io/simple-pki/

License: Other

Java 0.85% Groovy 43.29% Kotlin 54.08% Shell 1.45% JavaScript 0.33%

cryptography jce java-8 jacoco jib asciidoc restdoc mutation-testing structured-logging openapi3

simple-pki's Introduction

Simple PKI

Overview

This application provides the basic services typically found on any PKI:

Generates X.509 certificates;
Allow preemptive revocation of issued certificates;
Generates an updated CRL (Certificate Revocation List);
Supply the CA certificate.

The PKI implemented is comprised of a single CA with no intermediate CAs.

Code Coverage

Building the application

To build the application from the sources just run:

./gradlew build

Docker Image

You can also build a Docker image from the source code using the [Jib plugin](https://github.com/GoogleContainerTools/jib/tree/master/jib-gradle-plugin#build-your-image) like, for example:

./gradlew jibDockerBuild

Installation

The first step is create the keystore with the CA entity. As an example, you can run the src/main/scripts/create-ca.sh that will create a ./data/ca.p12 keystore with default passwords set to changeit.

Running with 'debug' profile activated

If using Gradle, run:

./gradlew bootRun --args='--spring.profiles.active=debug'

License

Copyright © 2019-2022 Nordix Foundation.

simple-pki's People

Contributors

Stargazers

Watchers

Forkers

simple-pki's Issues

Validate DB integrity on every persistence-related test

Check for invariants on EndEntity:

the certificate contains a valid signature
subject, .notValidBefore, .notValidAfter must match corresponding embedded fields on certificate
version must be either 1 or 2
revokedReason > 0 whenever .revocationDate != null

Remove CA auto-creation

The CA auto-creation is suitable for dev environments only. Primarily, it doesn't work with multiple instances of the service application.

Eliminate tests inter dependencies on PkiRestControllerSpec to fix Pitest verification failure

Currently some tests depend on the result of one or more previous tests.

Drop versioning using v1 in path

Add support to MariaDB/MySQL as backend DB

Initially, H2 will still be supported and the default DBMS.

Use JCIP annotations to make thread-safety explicity

Validate CA at start

it's a root CA (self-signed certificate => issuer == subject)
basic constraints: CA (critical)
key usages include keySignCertificate, cCRLSign

In case one or more checks fail, the server should be stuck at FAILURE state, always returning SC=500 for every valid request

Implement traceability of internal server errors

Send stack-traces to Apache Sentry
Attach ""Correlation ID"" to SC=500 response

Handle optimistic locking failure

The Pki#revoke() uses optimistic locking and will likely throw JpaOptimisticLockingFailureException in the face of multiple attempts to revoke the same certificate.
The operation must fail and the server must return SC=409 (https://httpstatuses.com/409).

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.