e241b33f26
Some checks failed
codecov / upload (push) Failing after 13m59s
CodeQL / Analyze (push) Failing after 1s
Testing / vet-proto (push) Failing after 1s
Testing / tests (arm, latest) (push) Waiting to run
Testing / extras (latest) (push) Failing after 1s
Testing / static checks (latest-1) (push) Failing after 1s
Testing / tests (-race, latest) (push) Failing after 1s
Testing / tests (i386, latest) (push) Failing after 1s
Testing / tests (latest) (push) Failing after 1s
Testing / tests (latest-1) (push) Failing after 1s
Lock Threads / lock (push) Failing after 1s
govulncheck / govulncheck (.) (push) Failing after 1s
govulncheck / govulncheck (./cmd/protoc-gen-go-grpc) (push) Failing after 1s
govulncheck / govulncheck (./gcp/observability) (push) Failing after 1s
govulncheck / govulncheck (./security/advancedtls) (push) Failing after 1s
govulncheck / govulncheck (./stats/opencensus) (push) Failing after 1s
Stale bot / stale (push) Failing after 1s
39 lines
2.0 KiB
Markdown
39 lines
2.0 KiB
Markdown
All of the following files in this directory except `server_spiffebundle.json`
|
|
and `client_spiffebundle.json` are generated with the `generate.sh` and
|
|
`intermediate_gen.sh` script in this directory.
|
|
|
|
These comprise a root trust certificate authority (CA) that signs two
|
|
certificates - `client_spiffe.pem` and `server_spiffe.pem`. These are valid
|
|
SPIFFE certificates (via the configuration in `spiffe-openssl.cnf`), and the
|
|
`*_spiffebundle.json` files are SPIFFE Bundle Maps for the client and server
|
|
respectively.
|
|
|
|
The SPIFFE trust bundle map files (`*_spiffebundle.json`) are manually created
|
|
for end to end testing. The `server_spiffebundle.json` contains the
|
|
`foo.bar.com` trust domain (only this entry is used in e2e tests) matching URI
|
|
SAN of `client_spiffe.pem`, and the CA certificate is `ca.pem`. The client
|
|
`spiffebundle.json` file contains `example.com` trust domain matching the URI
|
|
SAN of `server_spiffe.pem`, and the CA certificate there is also `ca.pem`.
|
|
|
|
`leaf_and_intermediate_chain.pem` is a certificate chain whose leaf is a valid
|
|
SPIFFE cert that is signed by an intermediate CA (`intermediate_ca.pem`). The
|
|
intermediate CA is signed by the root CA (`ca.pem`). Thus, this setup yields a
|
|
valid chain to the root of trust `ca.pem`.
|
|
|
|
If updating these files, the `x5c` field in the json is the raw PEM CA
|
|
certificate and can be copy pasted from the certificate file `ca.pem`. `n` and
|
|
`e` are values from the public key attached to this certificate. `e` should
|
|
*probably* be `AQAB` as it is the exponent. `n` can be fetched from the
|
|
certificate by getting the RSA key from the cert and extracting the value. This
|
|
can be done in golang with the following codeblock:
|
|
|
|
```
|
|
func GetBase64ModulusFromPublicKey(key *rsa.PublicKey) string {
|
|
return base64.RawURLEncoding.EncodeToString(key.N.Bytes())
|
|
}
|
|
|
|
block, _ := pem.Decode(rawPemCert) cert, _ := x509.ParseCertificate(block.Bytes)
|
|
publicKey := cert.PublicKey.(*rsa.PublicKey)
|
|
fmt.Println(GetBase64ModulusFromPublicKey(publicKey))
|
|
```
|