netgate-pki.yang

module netgate-pki {

    yang-version 1.1;

    namespace "urn:netgate:xml:yang:netgate-pki";
    prefix "ngpki";

    import ietf-inet-types {
	prefix "inet";
    }

    import netgate-common {
	prefix "ngcom";
    }

    organization "Netgate";

    contact "Web: <http://www.netgate.com>";

    description
	"This YANG module provides specifications of operations and data
	 related to PKI management on TNSR.

	 Copyright 2018-2022 Rubicon Communications, LLC.
	";

    revision 2023-06-15 {
	description
	    "TNSR Release 23.06.";
    }
    revision 2023-02-15 {
	description
	    "TNSR Release 23.02.";
    }

    revision 2022-06-15 {
	description
	    "TNSR Release 22.06.";
    }

    revision 2020-06-15 {
	description
	    "TNSR Release 20.06.";
    }

    revision 2020-02-15 {
	description
	    "TNSR Release 20.02.";
    }

    revision 2019-05-30 {
	description
	    "TNSR Release 19.05.";
    }

    revision 2019-02-15 {
	description
	    "TNSR Release 19.02.";
    }

    revision 2018-03-29 {
	description
	    "Initial revision.";
    }

    typedef private-key-algorithm-t {
	type enumeration {
	    enum RSA {
		description
		    "RSA";
	    }
	    enum ec-p256 {
		description
		    "Elliptic curve p-256";
	    }
	}

	description
	    "Supported public key algorithms.";
    }

    typedef csr-digest-t {
	type enumeration {
	    enum sha224 {
		description
		    "SHA2-224";
	    }
	    enum sha256 {
		description
		    "SHA2-256";
	    }
	    enum sha384 {
		description
		    "SHA2-384";
	    }
	    enum sha512 {
		description
		    "SHA2-512";
	    }
	}
    }

    typedef sign-purpose {
	type enumeration {
	    enum ca {
		description
		    "Issue CA cert";
	    }
	    enum server {
		description
		    "Issue TLS Web Server Auth cert";
	    }
	    enum client {
		description
		    "Issue TLS Web Client Auth cert";
	    }
	}
    }

    rpc pki-private-key-delete {
	description
	    "Delete an existing private key.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the key.";
	    }
	}
    }

    rpc pki-private-key-generate {
	description
	    "Generate a new private key.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name to be used for the key.";
	    }
	    leaf algorithm {
		type private-key-algorithm-t;
		description
		    "The algorithm to be used for the key.";
	    }
	    leaf length {
		type uint32;
		description
		    "The length in bits of the key.";
	    }
	}

	output {
	    leaf stdout {
		type string;
		description
		    "PEM-encoded text of new private key.";
	    }
	}
    }

    rpc pki-private-key-get {
	description
	    "Fetch the contents of an existing private key.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the key.";
	    }
	}

	output {
	    leaf stdout {
		type string;
		description
		    "Text of the requested private key.";
	    }
	}
    }

    rpc pki-private-key-list {
	description
	    "List the existing private keys.";

	output {
	    leaf-list name {
		type string;
		description
		    "Name of a key.";
	    }
	}
    }

    rpc pki-private-key-import {
	description
	    "Import a private key.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the private key.";
	    }
	    leaf contents {
		type string;
		mandatory true;
		description
		    "Text of a PEM-encoded private key, including the
		     'BEGIN PRIVATE KEY' and 'END PRIVATE KEY' blocks.";
	    }
	}
    }


    typedef ssh-key-choices {
	type enumeration {
	    enum private {
		description
		    "The private key.";
	    }
	    enum public {
		description
		    "The public key.";
	    }
	    enum both {
		description
		    "Both the public and private keys.";
	    }
	}

	description
	    "Select which keys are involved in an operation.";
    }

    rpc pki-ssh-key-delete {
	description
	    "Delete an existing ssh key or key pair.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the key.";
	    }
	    leaf which-keys {
		type ssh-key-choices;
		description
		    "Delete the ssh public key, the private key,
		     or both keys.  A missing value is 'both'.";
	     }
	}
    }

    rpc pki-ssh-key-get {
	description
	    "Fetch the contents of an existing ssh key or key pair.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the key.";
	    }
	    leaf which-keys {
		type ssh-key-choices;
		description
		    "Retrieve the ssh public key, the private key,
		     or both keys.";
	    }
	}

	output {
	    leaf private-key {
		type string;
		description
		    "Text of new ssh private key.";
	    }
	    leaf public-key {
		type string;
		description
		    "Text of new ssh public key.";
	    }
	}
    }

    rpc pki-ssh-key-list {
	description
	    "List the existing ssh key pairs.";

	output {
	    list key {
		key name;

		leaf name {
		    type string;
		    description
			"Name of a key pair.";
		}

		leaf which-keys {
		    type ssh-key-choices;
		    description
			"States which ssh keys are configured: public,
			 private, or both.";
		}
	    }
	}
    }

    rpc pki-ssh-key-import {
	description
	    "Import an ssh key.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the ssh key.";
	    }
	    leaf private-key {
		type string;
		description
		    "Text of a PEM-encoded ssh private key, including
		     'the BEGIN OPENSSH PRIVATE KEY' and
		     'END OPENSSH PRIVATE KEY' lines.";
	    }
	    leaf public-key {
		type string;
		description
		    "Text of an ssh public key.";
	    }
	}
    }

    rpc pki-csr-generate {
	description
	    "Create a certificate signing request using a local private key.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the CSR (and key).";
	    }
	    leaf common-name {
		type string {
		    length "1..64";
		}
		mandatory true;
		description
		    "Common name for certificate. Typically this is the
		     hostname for a server certificate or the user's full
		     name for a user certificate.";
	    }
	    leaf country {
		type string {
		    length "2";
		}
		description
		    "2 letter country code.";
	    }
	    leaf state {
		type string {
		    length "1..128";
		}
		description
		    "State or Province.";
	    }
	    leaf city {
		type string {
		    length "1..128";
		}
		description
		    "City or Locality";
	    }
	    leaf org {
		type string {
		    length "1..64";
		}
		description
		    "Organization (Company, school, etc).";
	    }
	    leaf org-unit {
		type string {
		    length "1..64";
		}
		description
		    "Organization Unit (Department).";
	    }
	    leaf digest {
		type csr-digest-t;
		mandatory true;
		description
		    "Message digest to sign the CSR with.";
	    }
	    leaf purpose {
		type sign-purpose;
		description
		    "CA or server or client. Selected purpose
		     defines a set of standard X509 extensions.";
	    }

	    container subject-alt-names {
		description
		    "Additional identifiers for the Certificate Sign
		     Request.  Common name is automatically added here.";

		list subject-alt-name {
		    key "index";

		    leaf index {
			type uint8;
			description
			    "SAN index.";
		    }

		    choice subject-alt-name-type {
			case email {
			    leaf email {
				type inet:email-address;
			    }
			}
			case hostname {
			    leaf hostname {
				type inet:host;
			    }
			}
			case ipv4-address {
			    leaf ipv4-address {
				type inet:ipv4-address;
			    }
			}
			case ipv6-address {
			    leaf ipv6-address {
				type inet:ipv6-address;
			    }
			}
			case uri {
			    leaf uri {
				type inet:uri;
			    }
			}
		    }
		}
	    }
	}

	output {
	    leaf stdout {
		type string;
		description
		    "PEM-encoded text of new certificate signing request.";
	    }
	}
    }

    rpc pki-csr-delete {
	description
	    "Delete an existing certificate signing request.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the CSR (and key).";
	    }
	}
    }

    rpc pki-csr-get {
	description
	    "Retrieve an existing certificate signing request.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the CSR.";
	    }
	}

	output {
	    leaf stdout {
		type string;
		description
		    "PEM-encoded text of certificate signing request.";
	    }
	}
    }

    rpc pki-csr-list {
	description
	    "List the existing certificate signing requests.";

	output {
	    leaf-list name {
		type string;
		description
		    "Name of a CSR.";
	    }
	}
    }

    rpc pki-csr-sign {
	description
	    "Sign an existing signing request. Creates a signed certificate.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the signing request.";
	    }
	    leaf ca-name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		description
		    "The name of the CA. If self-signing, omit this
		     parameter.";
	    }
	    leaf days-valid {
		type uint16 {
		    range "1..65535";
		}
		default 365;
		description
		    "The number of days the signed cert should be valid for.";
	    }
	    leaf digest {
		type csr-digest-t;
		default sha512;
		description
		    "Message digest to sign the CSR with.";
	    }
	    leaf purpose {
		type sign-purpose;
		description
		    "CA or server or client. Selected purpose
		     defines a set of standard X509 extensions.";
	    }
	}

	output {
	    leaf stdout {
		type string;
		description
		    "PEM-encoded text of certificate signing request.";
	    }
	}
    }

    rpc pki-cert-delete {
	description
	    "Delete an existing certificate.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the certificate.";
	    }
	}
    }

    rpc pki-cert-get {
	description
	    "Retrieve an existing certificate.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the certificate.";
	    }

	    leaf output-level {
		type uint8;
		default 0;
		description
		    "Level of output. Absence or 0 means PEM-encoded
		     text, 1 - short, 2 - full.";
	    }
	}

	output {
	    leaf stdout {
		type string;
		description
		    "PEM-encoded text of certificate.";
	    }
	}
    }

    rpc pki-cert-status-list {
	description
	    "List the existing certificates.";

	output {
	    list entry {
		key name;

		leaf name {
		    type string;
		    description
			"Name of a certificate.";
		}

		leaf not-after {
		    type string;
		}

		leaf days-left {
		    type int32;
		}

		leaf seconds-left {
		    type int32;
		}
	    }
	}
    }

    rpc pki-cert-list {
	description
	    "List the existing certificates.";

	output {
	    leaf-list name {
		type string;
		description
		    "Name of a certificate.";
	    }
	}
    }

    rpc pki-cert-import {
	description
	    "Import a signed certificate.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the certificate.";
	    }

	    leaf contents {
		type string;
		mandatory true;
		description
		    "Text of a PEM-encoded certificate, including the
		     'BEGIN CERTIFICATE' and 'END CERTIFICATE' blocks.";
	    }
	}
    }

    rpc pki-ca-delete {
	description
	    "Delete an existing CA certificate.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the CA certificate.";
	    }
	}
    }

    rpc pki-ca-get {
	description
	    "Retrieve an existing CA certificate.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the CA certificate.";
	    }

	    leaf output-level {
		type uint8;
		default 0;
		description
		    "Level of output. Absence or 0 means PEM-encoded
		    text, 1 - short, 2 - full.";
	    }
	}

	output {
	    leaf stdout {
		type string;
		description
		    "PEM-encoded text of CA certificate.";
	    }
	}
    }

    rpc pki-ca-list {
	description
	    "List the existing CA certificates.";

	output {
	    leaf-list name {
		type string;
		description
		    "Name of a CA certificate.";
	    }
	}
    }

    rpc pki-ca-status-list {
	description
	    "List the existing CA certificates.";

	output {
	    list entry {
		key name;

		leaf name {
		type string;
		description
		    "Name of a CA certificate.";
		}

		leaf not-after {
		    type string;
		}

		leaf days-left {
		    type int32;
		}

		leaf seconds-left {
		    type int32;
		}
	    }
	}
    }

    rpc pki-ca-import {
	description
	    "Import a CA certificate.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the CA certificate.";
	    }
	    leaf contents {
		type string;
		mandatory true;
		description
		    "Text of a PEM-encoded CA certificate, including the
		     'BEGIN CERTIFICATE' and 'END CERTIFICATE' blocks.";
	    }
	}
    }

    rpc pki-ca-append {
	description
	    "Append a CA to the current CA. Used to build CA chains.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the CA certificate to write.";
	    } 
	    leaf source-name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the CA certificate to read.";
	    } 
	}
    }

    rpc pki-all-restconf-cert {
        description
            "Generate self-signed CA and restconf required keys and certs.";

        input {
            leaf length {
                type uint32;
                description
                    "The bit-length of the keys.";
            }

	    container subject-alt-names {
		description
		    "Additional identifiers for the Certificate";

		list subject-alt-name {
		    key "index";

		    leaf index {
			type uint8;
			description
			    "SAN index.";
		    }

		    choice subject-alt-name-type {
			case hostname {
			    leaf hostname {
				type inet:host;
			    }
			}
			case ipv4-address {
			    leaf ipv4-address {
				type inet:ipv4-address;
			    }
			}
			case ipv6-address {
			    leaf ipv6-address {
				type inet:ipv6-address;
			    }
			}
		    }
		}
	    }
        }

        output {
            leaf stdout {
                type string;
                description
                    "List of generated certificates.";
            }
        }
    }

    typedef p12-pbe-algorithm-t {
	type enumeration {
	    enum PBE-SHA1-3DES {
		description
		    "PBE with SHA1 and 3DES";
	    }
	    enum AES-256-CBC {
		description
		    "PBE with 256 bit AES-CBC";
	    }
	}

	description
	    "Supported encryption algorithms for PBE with PCKS-12 archives.";
    }

    typedef p12-mac-algorithm-t {
	type enumeration {
	    enum sha1 {
		description
		    "SHA1";
	    }
	    enum sha256 {
		description
		    "SHA256";
	    }
	}

	description
	    "Supported digest algorithms for MAC with PCKS-12 archives.";
    }

    rpc pki-p12-delete {
	description
	    "Delete an existing PKCS-12 archive.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the key.";
	    }
	}
    }

    rpc pki-p12-generate {
	description
	    "Generate a new PKCS-12 archive.";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of an existing  key and certificate to build
		     a PKCS-12 archive from.";
	    }
	    leaf ca-name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		description
		    "The name of an existing CA cert to include in the archive.";
	    }
	    leaf key-pbe-algorithm {
		type p12-pbe-algorithm-t;
		description
		    "The PBE algorithm to be used for the key.";
	    }
	    leaf certificate-pbe-algorithm {
		type p12-pbe-algorithm-t;
		description
		    "The PBE algorithm to be used for the certificate.";
	    }
	    leaf mac-algorithm {
		type p12-mac-algorithm-t;
		description
		    "The digest algorithm to use in MAC.";
	    }
	    leaf export-password {
		type ngcom:string-xml-no-escape {
		    length "8..64";
		}
		mandatory true;
		description
		     "Password to protect privacy of archive contents.";
	    }
	}

	output {
	    leaf base64 {
		type string;
		description
		    "base64-encoded text of new PCKS-12 archive.";
	    }
	}
    }

    rpc pki-p12-list {
	description
	    "List the existing PKCS-12 archives.";

	output {
	    leaf-list name {
		type string;
		description
		    "Name of a PKCS-12 archive.";
	    }
	}
    }

    rpc pki-p12-get {
	description
	    "Fetch contents of an existing PKCS-12 archive (base64 encoded).";

	input {
	    leaf name {
		type string {
		    length "1..32";
		    pattern "[0-9A-Za-z_-]+";
		}
		mandatory true;
		description
		    "The name of the key.";
	    }
	}

	output {
	    leaf base64 {
		type string;
		description
		    "base64-encoded text of existing PCKS-12 archive.";
	    }
	}
    }

}