Certificate Generation

[susantjasinski]

No description provided.

[gtmills]

@susantjasinski Can you add a description?

[jandraa]

In addition to the traditional 'certificate upload', users are able to obtain a certificate by generating one and soliciting a CSR (certificate signing request) via a signing authority. Users must provide certain info (ex. company name, country, city, email, etc.) and key info (ex. bit length), to generate a private key and the file needed for the CSR. The file is exported and a user then goes to a signing authority (external to the BMC). Once a certificate has been signed by an authority, this file needs to be placed on the BMC, through the upload functionality.

[jandraa]

InVision prototype: https://ibm.invisionapp.com/share/K8NYRVZVEC5#/319042048_1-_Generate_Certificates

Open questions:

• How do users identify a certificate when there is more than one of a single type?
• How do users interact with the date? Why is knowing the exact valid from and valid until dates valuable vs the number of days until expiration? ('valid from - valid until' VS. 'X days left')
• What happens after a CSR has been generated? When and how is it accessed again and where should it live?
• How / when is the private key uploaded to be part of the CSR? (if at all)
• Where are private keys stored?
• Does each certificate have a different private key or do all of your certificates have the same private key because you are always you?
• How would it be beneficial to pre-populate CSR info for users? Could they pre-populate using the passphrase of a different certificate to copy the info?

[gtmills]

Resolved by https://gerrit.openbmc-project.xyz/c/openbmc/phosphor-webui/+/22468

[derick-montague]

@gtmills - This is merged, should this story be closed?

[gtmills]

Done.