...
| Parameter name | Required | Syntax | Description | Validation rules |
|---|---|---|---|---|
| CA Name | Yes | String (1-128) | The CA name should include the name of the external CA server and the issuerDN, which is the distinguished name of the CA on the external CA server that will sign our certificate. | String (1-128) |
| URL | Yes | Schema + IPv4/FQDN + port + path | Url to CMPv2 server; includes mandatory parts: scheme (http://) and IPv4/FQDN and optional parts: port and path (alias); e.g. http://127.0.0.1:8080/pkix or http://127.0.0.1/ejbca/publicweb/cmp/cmp NOTE: If FQDN is given ONAP must be able to resolve it without extra manual configuration | Must be correct URL Must start with http:// scheme If port given, port from 1-65535 range |
| Issuer DN | Yes | String (4-256) | Distinguished Name of the CA that will sign the certificate on the CMPv2 server side. When creating an end entity on the external CA server for client mode this IssuerDN will be passed through as the ca to sign for that user. | String (4-256) Correct DN |
| CA Mode | Yes | Enum (CLIENT|RA) | Issuer mode (either Registration Authority (RA) or client mode) | Value from predefined set |
| Authentication data::IAK | Yes | String (1-256) | Initial authentication key, used, together with RV, to authenticate request in CMPv2 server | String (1-256) |
| Authentication data::RV | Yes | String (1-256) | Reference value, used, together with IAK, to authenticate request in CMPv2 server | String (1-256) |
Example
| Code Block |
|---|
Example CMPv2 server configuration will be here. Probably it will be JSON based to easy read and map to object.# WARNING - work in progress so can still can change { "cmpv2Servers":[ { "caName":"TEST", "url":"http://127.0.0.1/ejbca/publicweb/cmp/cmp", "issuerDN":"CN=ManagementCA", "caMode":"CLIENT", "authentication":{ "iak":"xxx", "rv":"yyy" } }, { "caName":"TEST2", "url":"http://127.0.0.1/ejbca/publicweb/cmp/cmp", "issuerDN":"CN=ManagementCA2", "caMode":"RA", "authentication":{ "iak":"xxx", "rv":"yyy" } } ] } |
CMPv2 client
Input table for CMPv2 client
CMPv2 will get two POJOs and one String: first with CSR, plain fields extracted from CSR (like Common Name, Country, etc) , and private key and CA name (in general data passed via REST API call) and second with CMPv2 server details .and CA name
More info TBA
Currently the POC for CMPv2 client is working based on the inputs below.
Input Values | Input Type | Description | Usage |
|---|---|---|---|
| csrMeta | object | csrMeta object from aaf, would contain values needed for certificate request. any needed values that should be stored in the csrMeta will be mentioned below. | stores all pertinent values for certificate request - these will be detailed below, and should be set before being passed to the cmpv2 client. |
| csrMeta:IssuerDn | org.bouncycastle.asn1.x500.X500Name | distinguished name of the CA we're receiving certificate from. Cannot be null | used in the creation of the cert on EJBCA server |
| csrMeta: SubjectDn | org.bouncycastle.asn1.x500.X500Name | Distinguished name of the Entity the certificate is being issued to/ Certificate Requesting Entity. Cannot be null. | used in the creation of the cert on EJBCA server |
| csrMeta: KeyPair | java.security.KeyPair | KeyPair associated with the entity the certificate is being issued to. Cannot be null | used to create proof of possession for request to EJBCA server |
| csrMeta: Password | object which contains iak/rv? | secret password value shared by EJBCA server. Cannot be null | used to authenticate ourselves to the EJBCA serve |
csrMeta: CA Details | object | Certification Authority Details ( Http address, Port number and Path (which includes alias if used)). Cannot be null | used to Post Http request to External CA. |
.cer file | java.security.cert.X509Certificate | .cer (CSR) generated by Cert-man using Key-pair. Cannot be null. | used to validate response (.crt)/ certificate send from EJBCA server |
| caName | string | the name which is a general description of the external CA | used for debugging purposes |
| caMode | enum | string noting whether the server we are contacting will be operating in either client or RA mode | used for debugging purposes |
...