Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Input valueInput typeDescriptionUsage
CSRModelCsrModelObjectPOJO which transfers sent CSR, plain fields extracted from CSR (like Common Name, Country, etc)
CSRModelCsrModel:: csrorg.bouncycastle.pkcs.PKCS10CertificationRequestCertificate Signing Request received via REST API
CSRModelCsrModel:: subjectDNorg.bouncycastle.asn1.x500.X500NameSubjectDN retrieved from sent CSR
CSRModelCsrModel:: privateKeyEither org.bouncycastle.util.io.pem.PemObject or java.security.PrivateKeyPrivate key received via REST API
CSRModelCsrModel:: publicKeyEither org.bouncycastle.util.io.pem.PemObject or java.security.PublicKeyPublic key retrieved from sent CSR
CsrModel:: ????(warning) Others if needed (warning)

CMPv2ServerDetailsObjectPOJO which transfers CMPv2 server properties
CMPv2ServerDetails:: CA nameStringCA name as configured in CMPv2 server properties
CMPv2ServerDetails:: URLURL or String

CMPv2ServerDetails:: IssuerDNorg.bouncycastle.asn1.x500.X500Name

CMPv2ServerDetails:: CA modeENUM

CMPv2ServerDetails:: IAKString

CMPv2ServerDetails:: RVString

CA nameStringCA name received via REST API

...

Code Block
@Test
    public void testServerWithRealUrl()
        throws CmpClientException {

        setValidCsrMetaValuesAndDateValues();

        csrMeta.externalCaUrl("http://127.0.0.1/ejbca/publicweb/cmp/cmpcmpRA");
        csrMeta.password("mypassword");

        CmpClientImpl cmpClient = new CmpClientImpl();
        try {
            cmpClient.createCertRequest("data", "RA", csrMeta, cert, notBefore, notAfter);
        } catch (CAOfflineException e) {
            e.printStackTrace();
        }
    }

    private void setValidCsrMetaValuesAndDateValues() {
        ArrayList<RDN> rdns = new ArrayList<>();
        try {
            rdns.add(new RDN("O=CommonCompany"));
        } catch (CertException e) {
            e.printStackTrace();
        }
        csrMeta = new CSRMeta(rdns);
        csrMeta.cn("Node123");
        csrMeta.san("CommonName.com");
        csrMeta.password("password");
        csrMeta.email("CommonName@cn.com");
        csrMeta.issuerCn("ManagementCA");
        when(kpg.generateKeyPair()).thenReturn(keyPair);
        csrMeta.keypair(trans);
        csrMeta.externalCaUrl("http://127.0.0.1/ejbca/publicweb/cmp/cmpcmpRA");

        try {
            notBefore =  Optional.ofNullable(new SimpleDateFormat("yyyy/MM/dd HH:mm:ss").parse("2019/11/11 12:00:00"));
            notAfter =  Optional.ofNullable(new SimpleDateFormat("yyyy/MM/dd HH:mm:ss").parse("2020/11/11 12:00:00"));
        } catch (ParseException e) {
            e.printStackTrace();
        }
    }

...

Timeout
GroupParameter nameENV variable nameRequiredDefaultSyntaxDescriptionOrigin

UrlURLNohttp(s)://cert-service:8080/certificate/URLURL to Cert Service. Default value will be aligned with ONAP K8s deployment (Cert Service's K8s service name and port)

TimeoutTIMEOUTNo30s
Timeout for REST API callsApplication helm chart

PathOUTPUT_PATH30sTimeout for REST API callsApplication helm chartPathYes

Path where client will output generated keystore and truststore. Normally this path should be on a volume which is used to transfer keystore and truststore between CertService's client and end componentApplication helm chart

CA nameCA_NAMEYes

Name of CA which will enroll certificate. Must be same as configured on server side. Used in REST API callsOOM global value





CSR details

Common NameCOMMON_NAMEYes

Common name for which certificate from CMPv2 server should be issuedApplication helm chart
OrganizationORGANIZATIONYes

Organization for which certificate from CMPv2 server should be issuedOOM global value
Organization UnitORGANIZATION_UNITNo

Organization unit for which certificate from CMPv2 server should be issuedOOM global value
LocationLOCATIONNo

Location for which certificate from CMPv2 server should be issuedOOM global value
StateSTATEYes

State for which certificate from CMPv2 server should be issuedOOM global value
CountryCOUNTRYYes

Country for which certificate from CMPv2 server should be issuedOOM global value
SANsSANSNo

Subject Alternative Names (SANs) for which certificate from CMPv2 server should be issuedApplication helm chart

...

Cause ONAP is deployed in K8s, CertService's client will be delivered as independent container and should run as init container for end component. Both init container and end component must mount the same volume (persistent or ephemeral) to transfer generated artifacts.Within you K8s workload add CertService's client as init container:

Volume to transfer generated artifacts should be mounted to application container:

Code Block
...
kind: Deployment
metadata:
  ...
spec:
...
  template:
  ...
    spec:
      initContainers:
        ...
      containers:
        - name: {{ include "common.name" . }}
          image: "{{ include "common.repository" . }}/{{ .Values.image }}"
          imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
          resources:
{{ include "common.resources" . | indent 12 }}
          volumeMounts:
            - mountPath: /certificates/external
              name: {{ include "common.fullname" . }}-cmpv2-certs
              readOnly: true
          ...
      volumes:
        - name: {{ include "common.fullname" . }}-cmpv2-certs
          emptyDir: {}


Within K8s workload, CertService's client as init container should be added:

Code Block
...
kind: Deployment
metadata:
  ...
spec:
...
  template:
  ...
    spec:
      initContainers:
        - name: cert-service-client
          
      containers:
        - name: {{ include "common.name" . }}
          image: "{{ include "common.repository" . }}/{{ .Values.image }}"
          imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
          resources:
{{ include "common.resources" . | indent 12 }}
          volumeMounts:
            - mountPath: /certificates/external
              name: {{ include "common.fullname" . }}-cmpv2-certs
              readOnly: true
          ...
      volumes:
        - name: {{ include "common.fullname" . }}-cmpv2-certs
          emptyDir: {}

Make sure you pass as ENV variables all required parameters.

...