-
Notifications
You must be signed in to change notification settings - Fork 4.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
7 changed files
with
118 additions
and
101 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
74 changes: 0 additions & 74 deletions
74
enos/modules/verify_secrets_engines/scripts/kv-pki-verify-certificates.sh
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
91 changes: 91 additions & 0 deletions
91
enos/modules/verify_secrets_engines/scripts/pki-verify-certificates.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| #!/usr/bin/env bash | ||
| # Copyright (c) HashiCorp, Inc. | ||
| # SPDX-License-Identifier: BUSL-1.1 | ||
|
|
||
| set -e | ||
|
|
||
| fail() { | ||
| echo "$1" 1>&2 | ||
| exit 1 | ||
| } | ||
|
|
||
| [[ -z "$MOUNT" ]] && fail "MOUNT env variable has not been set" | ||
| [[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set" | ||
| [[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set" | ||
| [[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set" | ||
| [[ -z "$COMMON_NAME" ]] && fail "COMMON_NAME env variable has not been set" | ||
| [[ -z "$ISSUER_NAME" ]] && fail "ISSUER_NAME env variable has not been set" | ||
| [[ -z "$TTL" ]] && fail "TTL env variable has not been set" | ||
| [[ -z "$TEST_DIR" ]] && fail "TEST_DIR env variable has not been set" | ||
|
|
||
| binpath=${VAULT_INSTALL_DIR}/vault | ||
| test -x "$binpath" || fail "unable to locate vault binary at $binpath" || fail "The certificate appears to be improperly configured or contains errors" | ||
| export VAULT_FORMAT=json | ||
|
|
||
| # Verifying List Roles | ||
| ROLE=$("$binpath" list "${MOUNT}/roles" | jq -r '.[]') | ||
| [[ -z "$ROLE" ]] && fail "No roles created!" | ||
|
|
||
| # Verifying List Issuer | ||
| ISSUER=$("$binpath" list "${MOUNT}/issuers" | jq -r '.[]') | ||
| [[ -z "$ISSUER" ]] && fail "No issuers created!" | ||
|
|
||
| # Verifying Root CA Certificate | ||
| ROOT_CA_CERT=$("$binpath" read pki/cert/ca | jq -r '.data.certificate') | ||
| [[ -z "$ROOT_CA_CERT" ]] && fail "No root ca certificate generated" | ||
|
|
||
| # Verify List Certificate | ||
| VAULT_CERTS=$("$binpath" list "${MOUNT}/certs" | jq -r '.[]') | ||
| [[ -z "$VAULT_CERTS" ]] && fail "VAULT_CERTS should include vault certificates" | ||
|
|
||
| # Verifying Certificates | ||
| TMP_FILE="tmp-vault-cert.pem" | ||
| for CERT in $VAULT_CERTS; do | ||
| echo "Getting certificate from Vault PKI: ${CERT}" | ||
| "$binpath" read "${MOUNT}/cert/${CERT}" | jq -r '.data.certificate' > "${TEST_DIR}/${TMP_FILE}" | ||
| echo "Verifying certificate contents..." | ||
| openssl x509 -in "${TEST_DIR}/${TMP_FILE}" -text -noout || fail "The certificate appears to be improperly configured or contains errors" | ||
| CURR_CERT_SERIAL=$(echo "${CERT}" | tr -d ':' | tr '[:lower:]' '[:upper:]') | ||
| TMP_CERT_SUBJECT=$(openssl x509 -in "${TEST_DIR}/${TMP_FILE}" -noout -subject | awk -F'= ' '{print $2}') | ||
| TMP_CERT_ISSUER=$(openssl x509 -in "${TEST_DIR}/${TMP_FILE}" -noout -issuer | awk -F'= ' '{print $2}') | ||
| TMP_CERT_SERIAL=$(openssl x509 -in "${TEST_DIR}/${TMP_FILE}" -noout -serial | awk -F'=' '{print $2}') | ||
| [[ "${TMP_CERT_SUBJECT}" == *"${COMMON_NAME}.com"* ]] || fail "Subject is incorrect. Actual Subject: ${TMP_CERT_SUBJECT}" | ||
| [[ "${TMP_CERT_ISSUER}" == *"${COMMON_NAME}.com"* ]] || fail "Issuer is incorrect. Actual Issuer: ${TMP_CERT_ISSUER}" | ||
| [[ "${TMP_CERT_SERIAL}" == *"${CURR_CERT_SERIAL}"* ]] || fail "Certificate Serial is incorrect. Actual certificate Serial: ${CURR_CERT_SERIAL},${TMP_CERT_SERIAL}" | ||
| echo "Successfully verified certificate contents." | ||
|
|
||
| # Setting up variables for types of certificates | ||
| IS_CA=$(openssl x509 -in "${TEST_DIR}/${TMP_FILE}" -text -noout | grep -q "CA:TRUE" && echo "TRUE" || echo "FALSE") | ||
| if [[ "${IS_CA}" == "TRUE" ]]; then | ||
| if [[ "${COMMON_NAME}.com" == "${TMP_CERT_SUBJECT}" ]]; then | ||
| CA_CERT=${CERT} | ||
| elif [[ "intermediate-${COMMON_NAME}.com" == "${TMP_CERT_SUBJECT}" ]]; then | ||
| INTERMEDIATE_CA_CERT=${CERT} | ||
| fi | ||
| elif [[ "${IS_CA}" == "FALSE" ]]; then | ||
| INTERMEDIATE_ISSUED_CERT=${CERT} | ||
| fi | ||
|
|
||
| done | ||
|
|
||
| echo "Verifying that Vault PKI has successfully generated valid certificates for the CA, Intermediate CA, and issued certificates..." | ||
| if [[ -n "${CA_CERT}" ]] && [[ -n "${INTERMEDIATE_CA_CERT}" ]] && [[ -n "${INTERMEDIATE_ISSUED_CERT}" ]]; then | ||
| CA_NAME="ca.pem" | ||
| INTERMEDIATE_CA_NAME="intermediate-ca.pem" | ||
| ISSUED_NAME="issued.pem" | ||
| "$binpath" read "${MOUNT}/cert/${CA_CERT}" | jq -r '.data.certificate' > "${TEST_DIR}/${CA_NAME}" | ||
| "$binpath" read "${MOUNT}/cert/${INTERMEDIATE_CA_CERT}" | jq -r '.data.certificate' > "${TEST_DIR}/${INTERMEDIATE_CA_NAME}" | ||
| "$binpath" read "${MOUNT}/cert/${INTERMEDIATE_ISSUED_CERT}" | jq -r '.data.certificate' > "${TEST_DIR}/${ISSUED_NAME}" | ||
| openssl verify --CAfile "${TEST_DIR}/${CA_NAME}" -untrusted "${TEST_DIR}/${INTERMEDIATE_CA_NAME}" "${TEST_DIR}/${ISSUED_NAME}" || fail "One or more Certificate is not valid." | ||
| else | ||
| echo "CA Cert: ${CA_CERT}, Intermedidate Cert: ${INTERMEDIATE_CA_CERT}, Issued Cert: ${INTERMEDIATE_ISSUED_CERT}" | ||
| fi | ||
|
|
||
| echo "Revoking certificate: ${INTERMEDIATE_ISSUED_CERT}" | ||
| "$binpath" write "${MOUNT}/revoke" serial_number="${INTERMEDIATE_ISSUED_CERT}" || fail "Could not revoke certificate ${CA_CERT}" | ||
| echo "Verifying Revoked Certificate" | ||
| REVOKED_CERT_FROM_LIST=$("$binpath" list "${MOUNT}/certs/revoked" | jq -r '.[0]') | ||
| [[ "${INTERMEDIATE_ISSUED_CERT}" == "${REVOKED_CERT_FROM_LIST}" ]] || fail "Expected: ${INTERMEDIATE_ISSUED_CERT}, actual: ${REVOKED_CERT_FROM_LIST}" | ||
| echo "Successfully verified revoked certificate" | ||
|
|
||
|
|