// PKIOperation performs PKI operations and returns a SCEP response
PKIOperation performs PKI operations and returns a SCEP response
// PKIOperation performs PKI operations and returns a SCEP response
func (h *Handler) PKIOperation(ctx context.Context, request SCEPRequest) (SCEPResponse, error) {
	microMsg, err := microscep.ParsePKIMessage(request.Message)
	if err != nil {
		return SCEPResponse{}, err
	}
	p7, err := pkcs7.Parse(microMsg.Raw)
	if err != nil {
		return SCEPResponse{}, err
	}
	msg := &scep.PKIMessage{
		TransactionID: microMsg.TransactionID,
		MessageType:   microMsg.MessageType,
		SenderNonce:   microMsg.SenderNonce,
		Raw:           microMsg.Raw,
		P7:            p7,
	}
	if err := h.Auth.DecryptPKIEnvelope(ctx, msg); err != nil {
		return SCEPResponse{}, err
	}
	csr := msg.CSRReqMessage.CSR
	if msg.MessageType == microscep.PKCSReq {
		challengeMatches, err := h.Auth.MatchChallengePassword(ctx, msg.CSRReqMessage.ChallengePassword)
		if err != nil {
			return h.createFailureResponse(ctx, csr, msg, microscep.BadRequest, errors.New("error when checking password"))
		}
		if !challengeMatches {
			return h.createFailureResponse(ctx, csr, msg, microscep.BadRequest, errors.New("wrong password provided"))
		}
	}
	certRep, err := h.Auth.SignCSR(ctx, csr, msg)
	if err != nil {
		return h.createFailureResponse(ctx, csr, msg, microscep.BadRequest, errors.Wrap(err, "error when signing new certificate"))
	}
	response := SCEPResponse{
		Operation:   opnPKIOperation,
		Data:        certRep.Raw,
		Certificate: certRep.Certificate,
	}
	return response, nil
}
func ( h * Handler ) PKIOperation ( ctx context . Context , request SCEPRequest ) ( SCEPResponse , error ) { microMsg , err := microscep . ParsePKIMessage ( request . Message ) if err != nil { return SCEPResponse { } , err } p7 , err := pkcs7 . Parse ( microMsg . Raw ) if err != nil { return SCEPResponse { } , err } msg := & scep . PKIMessage { TransactionID : microMsg . TransactionID , MessageType : microMsg . MessageType , SenderNonce : microMsg . SenderNonce , Raw : microMsg . Raw , P7 : p7 , } if err := h . Auth . DecryptPKIEnvelope ( ctx , msg ) ; err != nil { return SCEPResponse { } , err } csr := msg . CSRReqMessage . CSR if msg . MessageType == microscep . PKCSReq { challengeMatches , err := h . Auth . MatchChallengePassword ( ctx , msg . CSRReqMessage . ChallengePassword ) if err != nil { return h . createFailureResponse ( ctx , csr , msg , microscep . BadRequest , errors . New ( " " ) ) } if ! challengeMatches { return h . createFailureResponse ( ctx , csr , msg , microscep . BadRequest , errors . New ( " " ) ) } } certRep , err := h . Auth . SignCSR ( ctx , csr , msg ) if err != nil { return h . createFailureResponse ( ctx , csr , msg , microscep . BadRequest , errors . Wrap ( err , " " ) ) } response := SCEPResponse { Operation : opnPKIOperation , Data : certRep . Raw , Certificate : certRep . Certificate , } return response , nil }
PKIOperation performs PKI operations and returns a SCEP response
PKIOperation performs PKI operations and returns a SCEP response
// parse the message using microscep implementation // return the error, because we can't use the msg for creating a CertRep // this is essentially doing the same as microscep.ParsePKIMessage, but // gives us access to the p7 itself in scep.PKIMessage. Essentially a small // wrapper for the microscep implementation. // copy over properties to our internal PKIMessage // NOTE: at this point we have sufficient information for returning nicely signed CertReps // TODO: can this be returned safely to the client? In the end, if the password was correct, that gains a bit of info too. // TODO: check if CN already exists, if renewal is allowed and if existing should be revoked; fail if not