scep-test.yml

name: SCEP responder

on: workflow_call

env:
  DB_IMAGE: ${{ vars.DB_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve PKI images
        uses: actions/cache@v4
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up DS container
        run: |
          tests/bin/ds-container-create.sh ds
        env:
          IMAGE: ${{ env.DB_IMAGE }}
          HOSTNAME: ds.example.com
          PASSWORD: Secret.123

      - name: Connect DS container to network
        run: docker network connect example ds --alias ds.example.com

      - name: Set up PKI container
        run: |
          tests/bin/runner-init.sh pki
        env:
          HOSTNAME: pki.example.com

      - name: Connect PKI container to network
        run: docker network connect example pki --alias pki.example.com

      - name: Install CA in PKI container
        run: |
          docker exec pki pkispawn \
              -f /usr/share/pki/server/examples/installation/ca.cfg \
              -s CA \
              -D pki_ds_url=ldap://ds.example.com:3389 \
              -v

          docker exec pki pki-server cert-find

      - name: Set up client container
        run: |
          docker run \
              --name client \
              --hostname client.example.com \
              --network example \
              --network-alias client.example.com \
              -it \
              --detach \
              quay.io/dogtagpki/sscep

      - name: Get client's IP address
        run: |
          docker inspect -f '{{ .NetworkSettings.Networks.example.IPAddress }}' client > client.ip
          echo "Client's IP: `cat client.ip`"

      # https://github.com/dogtagpki/pki/wiki/Configuring-SCEP-Responder
      - name: Configure SCEP in CA
        run: |
          docker exec pki pki-server ca-config-set ca.scep.enable true

          docker exec pki bash -c "echo UID:$(cat client.ip) > /var/lib/pki/pki-tomcat/conf/ca/flatfile.txt"
          docker exec pki bash -c "echo PWD:Secret.123 >> /var/lib/pki/pki-tomcat/conf/ca/flatfile.txt"

          # restart CA subsystem
          docker exec pki pki-server ca-redeploy --wait

      # https://github.com/dogtagpki/pki/wiki/Certificate-Enrollment-with-SSCEP
      - name: Get CA certificate using SSCEP
        run: |
          docker exec client sscep getca \
              -u http://pki.example.com:8080/ca/cgi-bin/pkiclient.exe \
              -c ca.crt
          docker exec client openssl x509 -text -noout -in ca.crt

      - name: Enroll certificate with IP address using SSCEP and DES3
        run: |
          docker exec client mkrequest -ip $(cat client.ip) Secret.123
          docker exec client openssl req -text -noout -in local.csr
          docker exec client sscep enroll \
              -u http://pki.example.com:8080/ca/cgi-bin/pkiclient.exe \
              -c ca.crt \
              -k local.key \
              -r local.csr \
              -l local.crt \
              -E 3des \
              -S sha256
          docker exec client openssl x509 -text -noout -in local.crt

      - name: Configure SCEP in CA with AES
        run: |
          docker exec pki pki-server ca-config-set ca.scep.encryptionAlgorithm AES 
          docker exec pki pki-server ca-config-set ca.scep.allowedEncryptionAlgorithms DES3,AES 
          docker exec pki bash -c "echo UID:$(cat client.ip) > /var/lib/pki/pki-tomcat/conf/ca/flatfile.txt"
          docker exec pki bash -c "echo PWD:Secret.123 >> /var/lib/pki/pki-tomcat/conf/ca/flatfile.txt"
          # restart CA subsystem
          docker exec pki pki-server ca-redeploy --wait

      - name: Enroll certificate with IP address using SSCEP and AES
        run: |
          docker exec client mkrequest -ip $(cat client.ip) Secret.123
          docker exec client openssl req -text -noout -in local.csr
          docker exec client sscep enroll \
              -u http://pki.example.com:8080/ca/cgi-bin/pkiclient.exe \
              -c ca.crt \
              -k local.key \
              -r local.csr \
              -l local.crt \
              -E aes \
              -S sha256
          docker exec client openssl x509 -text -noout -in local.crt

      - name: Remove CA from PKI container
        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

      - name: Check PKI server systemd journal
        if: always()
        run: |
          docker exec pki journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check CA debug log
        if: always()
        run: |
          docker exec pki find /var/lib/pki/pki-tomcat/logs/ca -name "debug.*" -exec cat {} \;

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh ds
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: scep
          path: /tmp/artifacts