Jarian Cottingham
4bd538b217
Critical: build_leaf_cert self-signed leaves with the leaf key instead of the YubiKey-held Intermediate CA key. Now extracts TBS, signs via pkcs11-tool (ECDSA-SHA384), reassembles, and verifies against the intermediate CA public key before returning. - setup-certauth.sh: ~1100 lines of stale inline api/ copies replaced with copy-from-repo (single source of truth); writes private /etc/certauth/certauth.env (0600); DB init loads env, no more swallowed errors; systemd unit gets EnvironmentFile= - config.py: YubiKey serials no longer hard-coded (env, fail closed); aarch64-only PKCS#11 path replaced with arch-neutral default; all paths env-overridable (CERTAUTH_*) - main.py: removed dead fastapi.security.CSRFProtection import (crashed startup); module-relative static/templates dirs; created_by resolved from the authenticated user instead of hard-coded 1; unclosed file handles fixed; domain_id 0 stored as NULL (FK bug) - models.py: certificates.domain_id FK pointed at users(id), now domains(id) - login: CSRF token now actually sent and validated - tests: 23 tests (auth, API flows, DER helpers, signing pipeline) - README, LICENSE, requirements.txt, pyproject.toml
51 lines
1.8 KiB
Plaintext
51 lines
1.8 KiB
Plaintext
# CertAuth API environment variables.
|
|
# Installed to /etc/certauth/certauth.env (mode 600, owned by the API user)
|
|
# and loaded via EnvironmentFile= in certauth-api.service.
|
|
#
|
|
# The API fails closed on startup if any of the REQUIRED variables below
|
|
# are missing.
|
|
|
|
# ---- REQUIRED -------------------------------------------------------------
|
|
|
|
# YubiKey hardware assignments (serials are printed by `ykman list`;
|
|
# setup-certauth.sh auto-detects them at provision time)
|
|
YK_ROOT_SERIAL=your-root-yubikey-serial
|
|
YK_INT_SERIAL=your-intermediate-yubikey-serial
|
|
|
|
# YubiKey PINs (change from the defaults with:
|
|
# ykman piv access change-pin -P <old> --new-pin <new>)
|
|
YK_ROOT_PIN=your-yk-root-pin
|
|
YK_INT_PIN=your-yk-intermediate-pin
|
|
|
|
# JWT signing secret (generate with: python3 -c "import secrets; print(secrets.token_hex(32))")
|
|
JWT_SECRET=your-64-char-hex-secret
|
|
|
|
# Admin web/API login password
|
|
ADMIN_PASSWORD=your-secure-admin-password
|
|
|
|
# ---- OPTIONAL (defaults shown) ---------------------------------------------
|
|
|
|
# Admin username (default: certauth)
|
|
ADMIN_USERNAME=certauth
|
|
|
|
# Filesystem layout (defaults match setup-certauth.sh production layout)
|
|
CERTAUTH_CA_BASE=/etc/ssl/ca
|
|
CERTAUTH_ROOT_CA=/etc/ssl/ca/root/root-ca.crt
|
|
CERTAUTH_INT_CA=/etc/ssl/ca/intermediate/intermediate-ca.crt
|
|
CERTAUTH_CA_CHAIN=/etc/ssl/ca/ca-chain.crt
|
|
CERTAUTH_ISSUED_DIR=/etc/ssl/ca/issued
|
|
CERTAUTH_TMP_DIR=/var/lib/certauth/tmp
|
|
CERTAUTH_DB_PATH=/var/lib/certauth/certauth.db
|
|
|
|
# PKCS#11 (defaults work on aarch64 and x86_64 Ubuntu)
|
|
PKCS11_MODULE=/usr/lib/opensc-pkcs11.so
|
|
# pkcs11-tool --token-label; leave empty to match by key label only
|
|
PKCS11_TOKEN_LABEL=
|
|
|
|
# Leaf certificate subject (matches setup-certauth.sh defaults)
|
|
CA_ORG=Home
|
|
CA_COUNTRY=US
|
|
|
|
# PFX download default password (overridable per download)
|
|
PFX_PASS=certauth
|