-
Notifications
You must be signed in to change notification settings - Fork 247
/
rekey.go
353 lines (315 loc) · 10.8 KB
/
rekey.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
package ca
import (
"crypto"
"math/rand"
"os"
"strconv"
"strings"
"syscall"
"time"
"github.com/pkg/errors"
"github.com/smallstep/certificates/pki"
"github.com/smallstep/cli/flags"
"github.com/smallstep/cli/utils"
"github.com/urfave/cli"
"go.step.sm/cli-utils/command"
"go.step.sm/cli-utils/errs"
"go.step.sm/cli-utils/ui"
"go.step.sm/crypto/keyutil"
"go.step.sm/crypto/pemutil"
)
func rekeyCertificateCommand() cli.Command {
return cli.Command{
Name: "rekey",
Action: command.ActionFunc(rekeyCertificateAction),
Usage: "rekey a certificate",
UsageText: `**step ca rekey** <crt-file> <key-file>
[**--out-cert**=<file>] [**--out-key**=<file>] [**--private-key**=<file>]
[**--ca-url**=<uri>] [**--root**=<file>] [**--password-file**=<file>]
[**--expires-in**=<duration>] [**--force**] [**--exec**=<string>] [**--daemon**]
[**--kty**=<type>] [**--curve**=<curve>] [**--size**=<size>]
[**--expires-in**=<duration>] [**--pid**=<int>] [**--pid-file**=<file>]
[**--signal**=<int>] [**--exec**=<string>] [**--rekey-period**=<duration>]`,
Description: `
**step ca rekey** command rekeys the given certificate (with a request to the
certificate authority) and writes the new certificate and private key
to disk - either overwriting <crt-file> and <key-file> positional arguments
or using new files when the **--out-cert**=<file> and **--out-key**=<file>
flags are used.
With the **--daemon** flag the command will periodically update the given
certificate. By default, it will rekey the certificate before 2/3 of the validity
period of the certificate has elapsed. A random jitter is used to avoid multiple
instances running at the same time. The amount of time between rekey and
certificate expiration can be configured using the **--expires-in** flag, or a
fixed period can be set with the **--rekey-period** flag.
The **--daemon** flag can be combined with **--pid**, **--signal**, or **--exec**
to provide certificate reloads on your services.
## POSITIONAL ARGUMENTS
<crt-file>
: The certificate in PEM format that we want to rekey.
<key-file>
: They key file of the certificate.
## EXAMPLES
Rekey a certificate:
'''
$ step ca rekey internal.crt internal.key
'''
Rekey a certificate without overwriting the existing certificate and key:
'''
$ step ca rekey --out-cert out.crt --out-key out.key internal.crt internal.key
'''
Rekey a certificate forcing the overwrite of the previous certificate and key
(overwrites the existing files without prompting):
'''
$ step ca rekey --force internal.crt internal.key
'''
Rekey a certificate providing the <--ca-url> and <--root> flags:
'''
$ step ca rekey --ca-url https://ca.smallstep.com:9000 \
--root /path/to/root_ca.crt internal.crt internal.key
Would you like to overwrite internal.crt [Y/n]: y
'''
Rekey a certificate only if it expires within the given time frame:
'''
$ step ca rekey --expires-in 8h internal.crt internal.key
'''
Rekey the certificate before 2/3 of the validity has passed:
'''
$ step ca rekey --daemon internal.crt internal.key
'''
Rekey the certificate before 8 hours and 30m of the expiration time:
'''
$ step ca rekey --daemon --expires-in 8h30m internal.crt internal.key
'''
Rekey the certificate every 16h:
'''
$ step ca rekey --daemon --rekey-period 16h internal.crt internal.key
'''
Rekey the certificate and reload nginx:
'''
$ step ca rekey --daemon --exec "nginx -s reload" internal.crt internal.key
'''
Rekey the certificate and convert it to DER:
'''
$ step ca rekey --daemon --rekey-period 16h \
--exec "step certificate format --force --out internal.der internal.crt" \
internal.crt internal.key
'''
Rekey a certificate using the offline mode, requires the configuration
files, certificates, and keys created with **step ca init**:
'''
$ step ca rekey --offline internal.crt internal.key
'''
Rekey the certificate and write it to specified files:
'''
$ step ca rekey internal.crt internal.key --out-crt foo.crt --out-key foo.key
'''
Rekey the certificate using a given private key:
'''
$ step ca rekey internal.crt internal.key --private-key foo.key
'''`,
Flags: []cli.Flag{
cli.StringFlag{
Name: "out-cert",
Usage: `The <file> where the new certificate will be saved to.
Defaults to overwriting the <crt-file> positional argument.`,
},
cli.StringFlag{
Name: "out-key",
Usage: `The <file> to store the new private key.
Defaults to overwriting the <key-file> positional argument.`,
},
cli.StringFlag{
Name: "private-key",
Usage: `The <file> containing the private key for rekey-ing the certificate.
By default, a new random key pair will be generated.`,
},
cli.StringFlag{
Name: "expires-in",
Usage: `The amount of time remaining before certificate expiration,
at which point a rekey should be attempted. The certificate rekey will not
be performed if the time to expiration is greater than the **--expires-in** value.
A random jitter (duration/20) will be added to avoid multiple services hitting the
rekey endpoint at the same time. The <duration> is a sequence of decimal numbers,
each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".
Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".`,
},
cli.IntFlag{
Name: "pid",
Usage: `The process id to signal after the certificate has been rekeyed. By default the
the SIGHUP (1) signal will be used, but this can be configured with the **--signal**
flag.`,
},
cli.StringFlag{
Name: "pid-file",
Usage: `The <file> from which to read the process id that will be signaled after the certificate
has been rekeyed. By default the SIGHUP (1) signal will be used, but this can be configured with the **--signal**
flag.`,
},
cli.IntFlag{
Name: "signal",
Usage: `The signal <number> to send to the selected PID, so it can reload the
configuration and load the new certificate. Default value is SIGHUP (1)`,
Value: int(syscall.SIGHUP),
},
cli.StringFlag{
Name: "exec",
Usage: "The <command> to run after the certificate has been rekeyed.",
},
cli.BoolFlag{
Name: "daemon",
Usage: `Run the rekey command as a daemon, rekeying and overwriting the certificate
periodically. By default the daemon will rekey a certificate before 2/3 of the
time to expiration has elapsed. The period can be configured using the
**--rekey-period** or **--expires-in** flags.`,
},
cli.StringFlag{
Name: "rekey-period",
Usage: `The period with which to schedule rekeying of the certificate in daemon mode.
Requires the **--daemon** flag. The <duration> is a sequence of decimal numbers,
each with optional fraction and a unit suffix, such as "300ms", "1.5h", or "2h45m".
Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".`,
},
flags.KTY,
flags.Curve,
flags.Size,
flags.Force,
flags.Offline,
flags.PasswordFile,
flags.Root,
flags.CaURL,
flags.CaConfig,
},
}
}
func rekeyCertificateAction(ctx *cli.Context) error {
err := errs.NumberOfArguments(ctx, 2)
if err != nil {
return err
}
args := ctx.Args()
certFile := args.Get(0)
keyFile := args.Get(1)
passFile := ctx.String("password-file")
isDaemon := ctx.Bool("daemon")
execCmd := ctx.String("exec")
givenPrivate := ctx.String("private-key")
outCert := ctx.String("out-cert")
if outCert == "" {
outCert = certFile
}
outKey := ctx.String("out-key")
if outKey == "" {
outKey = keyFile
}
rootFile := ctx.String("root")
if rootFile == "" {
rootFile = pki.GetRootCAPath()
}
caURL, err := flags.ParseCaURL(ctx)
if err != nil {
return err
}
var expiresIn, rekeyPeriod time.Duration
if s := ctx.String("expires-in"); len(s) > 0 {
if expiresIn, err = time.ParseDuration(s); err != nil {
return errs.InvalidFlagValue(ctx, "expires-in", s, "")
}
}
if s := ctx.String("rekey-period"); len(s) > 0 {
if rekeyPeriod, err = time.ParseDuration(s); err != nil {
return errs.InvalidFlagValue(ctx, "rekey-period", s, "")
}
}
if expiresIn > 0 && rekeyPeriod > 0 {
return errs.IncompatibleFlagWithFlag(ctx, "expires-in", "rekey-period")
}
if rekeyPeriod > 0 && !isDaemon {
return errs.RequiredWithFlag(ctx, "rekey-period", "daemon")
}
if ctx.IsSet("pid") && ctx.IsSet("pid-file") {
return errs.MutuallyExclusiveFlags(ctx, "pid", "pid-file")
}
pid := ctx.Int("pid")
if ctx.IsSet("pid") && pid <= 0 {
return errs.InvalidFlagValue(ctx, "pid", strconv.Itoa(pid), "")
}
pidFile := ctx.String("pid-file")
if len(pidFile) > 0 {
pidB, err := os.ReadFile(pidFile)
if err != nil {
return errs.FileError(err, pidFile)
}
pid, err = strconv.Atoi(strings.TrimSpace(string(pidB)))
if err != nil {
return errs.Wrap(err, "error converting %s to integer process id", pidB)
}
if pid <= 0 {
return errs.InvalidFlagValue(ctx, "pid-file", strconv.Itoa(pid), "")
}
}
signum := ctx.Int("signal")
if ctx.IsSet("signal") && signum <= 0 {
return errs.InvalidFlagValue(ctx, "signal", strconv.Itoa(signum), "")
}
cert, err := tlsLoadX509KeyPair(certFile, keyFile, passFile)
if err != nil {
return err
}
leaf := cert.Leaf
if leaf.NotAfter.Before(time.Now()) {
return errors.New("cannot rekey an expired certificate")
}
cvp := leaf.NotAfter.Sub(leaf.NotBefore)
if rekeyPeriod > 0 && rekeyPeriod >= cvp {
return errors.Errorf("flag '--rekey-period' must be within (lower than) the certificate "+
"validity period; rekey-period=%v, cert-validity-period=%v", rekeyPeriod, cvp)
}
renewer, err := newRenewer(ctx, caURL, cert, rootFile)
if err != nil {
return err
}
afterRekey := getAfterRenewFunc(pid, signum, execCmd)
if isDaemon {
// Force is always enabled when daemon mode is used
ctx.Set("force", "true")
next := nextRenewDuration(leaf, expiresIn, rekeyPeriod)
return renewer.Daemon(outCert, next, expiresIn, rekeyPeriod, afterRekey)
}
// Do not rekey if (cert.notAfter - now) > (expiresIn + jitter)
if expiresIn > 0 {
//nolint:gosec // The random number below is not being used for crypto.
jitter := rand.Int63n(int64(expiresIn / 20))
if d := time.Until(leaf.NotAfter); d > expiresIn+time.Duration(jitter) {
ui.Printf("certificate not rekeyed: expires in %s\n", d.Round(time.Second))
return nil
}
}
var priv crypto.PrivateKey
if givenPrivate == "" {
kty, crv, size, err := utils.GetKeyDetailsFromCLI(ctx, false, "kty", "curve", "size")
if err != nil {
return err
}
priv, err = keyutil.GenerateKey(kty, crv, size)
if err != nil {
return err
}
} else {
priv, err = pemutil.Read(givenPrivate)
if err != nil {
return err
}
}
if _, err := renewer.Rekey(priv, outCert, outKey, ctx.IsSet("out-key") || givenPrivate == ""); err != nil {
return err
}
ui.PrintSelected("Certificate", outCert)
// The private key will be written out to disk if:
// 1) no private key was provided
// 2) a private key was provided but an outfile for the private key was specified as well
if givenPrivate == "" || ctx.IsSet("out-key") {
ui.PrintSelected("Private Key", outKey)
}
return afterRekey()
}