-
Notifications
You must be signed in to change notification settings - Fork 132
140 lines (116 loc) · 4.76 KB
/
subca-external-test.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
name: Sub-CA with external cert
on: workflow_call
env:
DB_IMAGE: ${{ vars.DB_IMAGE || 'quay.io/389ds/dirsrv' }}
jobs:
# docs/installation/ca/Installing_CA_with_External_CA_Signing_Certificate.md
test:
name: Test
runs-on: ubuntu-latest
env:
SHARED: /tmp/workdir/pki
steps:
- name: Clone repository
uses: actions/checkout@v4
- name: Retrieve PKI images
uses: actions/cache@v4
with:
key: pki-images-${{ github.sha }}
path: pki-images.tar
- name: Load PKI images
run: docker load --input pki-images.tar
- name: Create network
run: docker network create example
- name: Set up DS container
run: |
tests/bin/ds-container-create.sh ds
env:
IMAGE: ${{ env.DB_IMAGE }}
HOSTNAME: ds.example.com
PASSWORD: Secret.123
- name: Connect DS container to network
run: docker network connect example ds --alias ds.example.com
- name: Set up PKI container
run: |
tests/bin/runner-init.sh pki
env:
HOSTNAME: pki.example.com
- name: Connect PKI container to network
run: docker network connect example pki --alias pki.example.com
- name: Create root CA in NSS database
run: |
docker exec pki pki -d nssdb nss-cert-request \
--subject "CN=Root CA Signing Certificate" \
--ext /usr/share/pki/server/certs/ca_signing.conf \
--csr root-ca_signing.csr
docker exec pki pki -d nssdb nss-cert-issue \
--csr root-ca_signing.csr \
--ext /usr/share/pki/server/certs/ca_signing.conf \
--cert root-ca_signing.crt
docker exec pki pki -d nssdb nss-cert-import \
--cert root-ca_signing.crt \
--trust CT,C,C \
root-ca_signing
- name: Install subordinate CA (step 1)
run: |
# https://github.com/dogtagpki/pki/wiki/Adding-CA-Signing-CSR-Extension
docker exec pki pkispawn \
-f /usr/share/pki/server/examples/installation/ca-external-cert-step1.cfg \
-s CA \
-D pki_ds_url=ldap://ds.example.com:3389 \
-D pki_req_ski=AEB2FA7A07115A0AB994FF9B5BDA8E75D536BC77 \
-D pki_req_ext_add=True \
-D pki_req_ext_oid=1.3.6.1.4.1.311.20.2 \
-D pki_req_ext_data=1E0A00530075006200430041 \
-v
docker exec pki /usr/share/pki/tests/ca/bin/test-subca-signing-csr-ext.sh ca_signing.csr
- name: Issue subordinate CA signing cert
run: |
docker exec pki pki -d nssdb nss-cert-issue \
--issuer root-ca_signing \
--csr ca_signing.csr \
--ext /usr/share/pki/server/certs/subca_signing.conf \
--cert ca_signing.crt
- name: Install subordinate CA (step 2)
run: |
# https://github.com/dogtagpki/pki/wiki/Adding-CA-Signing-CSR-Extension
docker exec pki pkispawn \
-f /usr/share/pki/server/examples/installation/ca-external-cert-step2.cfg \
-s CA \
-D pki_ds_url=ldap://ds.example.com:3389 \
-D pki_req_ski=AEB2FA7A07115A0AB994FF9B5BDA8E75D536BC77 \
-D pki_req_ext_add=True \
-D pki_req_ext_oid=1.3.6.1.4.1.311.20.2 \
-D pki_req_ext_data=1E0A00530075006200430041 \
-v
docker exec pki pki-server cert-find
docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
# check MS sub CA signing cert extensions
docker exec pki /usr/share/pki/tests/ca/bin/test-ms-subca-signing-cert-ext.sh ca_signing.crt
- name: Run PKI healthcheck
run: docker exec pki pki-healthcheck --failures-only
- name: Verify CA admin
run: |
docker exec pki pki client-cert-import ca_signing --ca-cert root-ca_signing.crt
docker exec pki pki pkcs12-import \
--pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
--pkcs12-password Secret.123
docker exec pki pki -n caadmin ca-user-show caadmin
- name: Check cert requests in CA
run: |
docker exec pki pki -n caadmin ca-cert-request-find
- name: Gather artifacts
if: always()
run: |
tests/bin/ds-artifacts-save.sh --output=/tmp/artifacts/pki ds
tests/bin/pki-artifacts-save.sh pki
continue-on-error: true
- name: Remove subordinate CA
run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
- name: Upload artifacts
if: always()
uses: actions/upload-artifact@v4
with:
name: subca-external
path: |
/tmp/artifacts/pki