/*
|
* The contents of this file are subject to the terms of the Common Development and
|
* Distribution License (the License). You may not use this file except in compliance with the
|
* License.
|
*
|
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
|
* specific language governing permission and limitations under the License.
|
*
|
* When distributing Covered Software, include this CDDL Header Notice in each file and include
|
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
|
* Header, with the fields enclosed by brackets [] replaced by your own identifying
|
* information: "Portions copyright [year] [name of copyright owner]".
|
*
|
* Copyright 2026 3A Systems, LLC.
|
*/
|
package org.opends.quicksetup.installer;
|
|
import static org.opends.messages.QuickSetupMessages.*;
|
import static org.opends.quicksetup.util.Utils.createProtectedFile;
|
import static org.opends.server.config.ConfigConstants.ADS_CERTIFICATE_ALIAS;
|
|
import java.io.File;
|
import java.io.FileInputStream;
|
import java.io.InputStream;
|
import java.security.cert.Certificate;
|
import java.security.cert.CertificateException;
|
import java.security.cert.CertificateFactory;
|
import java.util.ArrayList;
|
import java.util.Collection;
|
import java.util.List;
|
import java.util.Locale;
|
|
import org.opends.quicksetup.ApplicationException;
|
import org.opends.quicksetup.ReturnCode;
|
import org.opends.server.util.CertificateManager;
|
import org.opends.server.util.SetupUtils;
|
|
/**
|
* Provisions the trust store used for server to server communication, {@code
|
* ads-truststore}, from a key store the operator already holds.
|
* <p>
|
* Replication reads both the key pair it presents on the replication port and the
|
* certificates it trusts there from that file, and from nowhere else: neither the key
|
* store configured for LDAPS nor the one of the administration connector is consulted.
|
* Without this, a server installs with the self-signed {@code ads-certificate} the trust
|
* store backend generates on the first start, and securing replication with an
|
* organisation's own certificates means stopping every server afterwards and repeating a
|
* {@code keytool} procedure by hand on each of them.
|
* <p>
|
* Two properties of the trust store shape what this class does:
|
* <ul>
|
* <li>Only a trusted certificate entry is a trust anchor. The certificate chain of a key
|
* entry is not: the trust managers take the certificate the key belongs to and none of
|
* its issuers. The issuing certificates are therefore imported as trusted certificate
|
* entries of their own, and a key pair which comes without any, and without certificates
|
* named separately, is reported rather than left to fail as a handshake later on.</li>
|
* <li>The {@code ads-certificate} key pair is not provisioned. It is the crypto manager
|
* instance key, published to the topology under {@code cn=instance keys,cn=admin data}
|
* and read by its alias, and the trust store backend generates it on the first start when
|
* the alias is free.</li>
|
* </ul>
|
*/
|
final class AdsTrustStoreProvisioner
|
{
|
/** The prefix of the aliases the trusted certificates are imported under. */
|
private static final String CA_ALIAS_PREFIX = "ads-ca-";
|
|
private final String trustStorePath;
|
private final String pinFilePath;
|
|
/**
|
* Creates a provisioner for the provided trust store.
|
*
|
* @param trustStorePath
|
* The path of the trust store file to create.
|
* @param pinFilePath
|
* The path of the file to write the generated PIN of the trust store to.
|
*/
|
AdsTrustStoreProvisioner(String trustStorePath, String pinFilePath)
|
{
|
this.trustStorePath = trustStorePath;
|
this.pinFilePath = pinFilePath;
|
}
|
|
/**
|
* Creates the trust store, holding the provided key pairs and the certificates to trust
|
* on the replication port, and writes its PIN file.
|
* <p>
|
* Everything is read and checked before anything is written: a refusal leaves no file
|
* behind, and a failure while writing removes the partial trust store.
|
*
|
* @param source
|
* The key store holding the key pairs to import.
|
* @param aliases
|
* The aliases of the key pairs to import, as the key store spells them, which
|
* become the certificate nicknames the crypto manager presents.
|
* @param caCertificateFiles
|
* The files holding certificates to trust, on top of the issuers found in the
|
* certificate chains of the imported key pairs. Every certificate of a file is
|
* trusted. May be empty.
|
* @throws ApplicationException
|
* If the key pairs cannot be read, if an alias is one the trust store reserves,
|
* if the trust store would end up trusting no certificate at all, if it
|
* already exists, or if it cannot be written.
|
*/
|
void provision(CertificateManager source, Collection<String> aliases, Collection<File> caCertificateFiles)
|
throws ApplicationException
|
{
|
final List<Certificate> trusted;
|
try
|
{
|
checkReservedAliases(aliases);
|
trusted = issuersOf(source, aliases);
|
for (File caCertificateFile : caCertificateFiles)
|
{
|
for (Certificate certificate : certificatesOf(caCertificateFile))
|
{
|
if (!trusted.contains(certificate))
|
{
|
trusted.add(certificate);
|
}
|
}
|
}
|
}
|
catch (ApplicationException e)
|
{
|
throw e;
|
}
|
catch (Exception e)
|
{
|
throw new ApplicationException(ReturnCode.CONFIGURATION_ERROR,
|
ERR_INSTALL_ADS_TRUSTSTORE.get(trustStorePath, String.valueOf(e)), e);
|
}
|
if (trusted.isEmpty())
|
{
|
throw new ApplicationException(ReturnCode.CONFIGURATION_ERROR,
|
ERR_INSTALL_ADS_TRUSTSTORE_NO_TRUST_ANCHOR.get(
|
source.getKeyStorePath(), joinAliases(aliases)), null);
|
}
|
if (new File(trustStorePath).exists())
|
{
|
// Only what this run writes is removed on failure, so a store which is already
|
// there is left alone rather than overwritten or deleted.
|
throw new ApplicationException(ReturnCode.CONFIGURATION_ERROR,
|
ERR_INSTALL_ADS_TRUSTSTORE_EXISTS.get(trustStorePath), null);
|
}
|
|
try
|
{
|
// The trust store is a JKS whatever the type of the key store the key pairs come
|
// from: ds-cfg-trust-store-type of the ads-truststore backend says JKS.
|
final String pin = new String(SetupUtils.createSelfSignedCertificatePwd());
|
final CertificateManager trustStore =
|
new CertificateManager(trustStorePath, CertificateManager.KEY_STORE_TYPE_JKS, pin);
|
for (String alias : aliases)
|
{
|
trustStore.importKeyEntry(alias, source, alias);
|
}
|
int trustedCertificates = 0;
|
for (Certificate certificate : trusted)
|
{
|
trustStore.addTrustedCertificate(CA_ALIAS_PREFIX + ++trustedCertificates, certificate);
|
}
|
createProtectedFile(pinFilePath, pin);
|
}
|
catch (Throwable t)
|
{
|
deletePartialTrustStore();
|
throw new ApplicationException(ReturnCode.CONFIGURATION_ERROR,
|
ERR_INSTALL_ADS_TRUSTSTORE.get(trustStorePath, String.valueOf(t)), t);
|
}
|
}
|
|
/**
|
* Refuses the aliases the trust store keeps for itself: {@code ads-certificate} is the
|
* instance key the server generates on its first start, which it would skip if the alias
|
* were taken, and {@code ads-ca-N} are the certificates trusted here.
|
*/
|
private void checkReservedAliases(Collection<String> aliases) throws ApplicationException
|
{
|
for (String alias : aliases)
|
{
|
if (alias.equalsIgnoreCase(ADS_CERTIFICATE_ALIAS)
|
|| alias.toLowerCase(Locale.ENGLISH).startsWith(CA_ALIAS_PREFIX))
|
{
|
throw new ApplicationException(ReturnCode.CONFIGURATION_ERROR,
|
ERR_INSTALL_ADS_TRUSTSTORE_RESERVED_ALIAS.get(alias, ADS_CERTIFICATE_ALIAS, CA_ALIAS_PREFIX), null);
|
}
|
}
|
}
|
|
/**
|
* Returns the issuers of the certificate chains of the provided key pairs, one entry
|
* per distinct certificate: the key pairs of one server are usually issued by the same
|
* authority, which is then to be trusted once rather than under one alias each.
|
*/
|
private List<Certificate> issuersOf(CertificateManager source, Collection<String> aliases) throws Exception
|
{
|
final List<Certificate> issuers = new ArrayList<>();
|
for (String alias : aliases)
|
{
|
final Certificate[] chain = source.getCertificateChain(alias);
|
if (chain == null || chain.length == 0)
|
{
|
throw new ApplicationException(ReturnCode.CONFIGURATION_ERROR,
|
ERR_INSTALL_ADS_TRUSTSTORE_NO_KEY_PAIR.get(source.getKeyStorePath(), alias), null);
|
}
|
for (int i = 1; i < chain.length; i++)
|
{
|
if (!issuers.contains(chain[i]))
|
{
|
issuers.add(chain[i]);
|
}
|
}
|
}
|
return issuers;
|
}
|
|
/**
|
* Returns every certificate held in the provided file, which may be a single DER or PEM
|
* certificate, a PEM bundle or a PKCS#7 chain: a file which holds a chain of authorities
|
* is trusted whole, rather than up to its first certificate only.
|
*/
|
private Collection<? extends Certificate> certificatesOf(File caCertificateFile) throws Exception
|
{
|
final Collection<? extends Certificate> certificates;
|
try (InputStream in = new FileInputStream(caCertificateFile))
|
{
|
certificates = CertificateFactory.getInstance("X.509").generateCertificates(in);
|
}
|
catch (CertificateException e)
|
{
|
throw new ApplicationException(ReturnCode.CONFIGURATION_ERROR,
|
ERR_INSTALL_ADS_TRUSTSTORE_CA_CERT_FILE_UNREADABLE.get(caCertificateFile.getPath(), e.getMessage()), e);
|
}
|
if (certificates.isEmpty())
|
{
|
throw new ApplicationException(ReturnCode.CONFIGURATION_ERROR,
|
ERR_INSTALL_ADS_TRUSTSTORE_CA_CERT_FILE_EMPTY.get(caCertificateFile.getPath()), null);
|
}
|
return certificates;
|
}
|
|
private void deletePartialTrustStore()
|
{
|
new File(trustStorePath).delete();
|
new File(pinFilePath).delete();
|
}
|
|
private String joinAliases(Collection<String> aliases)
|
{
|
return String.join(", ", aliases);
|
}
|
}
|
