{"action":"created","issue":{"url":"https://api.github.com/repos/cyberark/conjur/issues/651","repository_url":"https://api.github.com/repos/cyberark/conjur","labels_url":"https://api.github.com/repos/cyberark/conjur/issues/651/labels{/name}","comments_url":"https://api.github.com/repos/cyberark/conjur/issues/651/comments","events_url":"https://api.github.com/repos/cyberark/conjur/issues/651/events","html_url":"https://github.com/cyberark/conjur/issues/651","id":344888766,"node_id":"MDU6SXNzdWUzNDQ4ODg3NjY=","number":651,"title":"Conjur signs certificates using a configured CA","user":{"login":"jvanderhoof","id":124978,"node_id":"MDQ6VXNlcjEyNDk3OA==","avatar_url":"https://avatars3.githubusercontent.com/u/124978?v=4","gravatar_id":"","url":"https://api.github.com/users/jvanderhoof","html_url":"https://github.com/jvanderhoof","followers_url":"https://api.github.com/users/jvanderhoof/followers","following_url":"https://api.github.com/users/jvanderhoof/following{/other_user}","gists_url":"https://api.github.com/users/jvanderhoof/gists{/gist_id}","starred_url":"https://api.github.com/users/jvanderhoof/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvanderhoof/subscriptions","organizations_url":"https://api.github.com/users/jvanderhoof/orgs","repos_url":"https://api.github.com/users/jvanderhoof/repos","events_url":"https://api.github.com/users/jvanderhoof/events{/privacy}","received_events_url":"https://api.github.com/users/jvanderhoof/received_events","type":"User","site_admin":false},"labels":[{"id":999134376,"node_id":"MDU6TGFiZWw5OTkxMzQzNzY=","url":"https://api.github.com/repos/cyberark/conjur/labels/kind/design","name":"kind/design","color":"fbca04","default":false},{"id":999134377,"node_id":"MDU6TGFiZWw5OTkxMzQzNzc=","url":"https://api.github.com/repos/cyberark/conjur/labels/kind/epic","name":"kind/epic","color":"fbca04","default":false},{"id":999134381,"node_id":"MDU6TGFiZWw5OTkxMzQzODE=","url":"https://api.github.com/repos/cyberark/conjur/labels/triage/needs-info","name":"triage/needs-info","color":"d4c5f9","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2018-07-26T15:16:35Z","updated_at":"2018-08-02T13:38:27Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"## Overview\r\n\r\nPKI, or Public Key Infrastructure is a mechanism to enable organizations to authenticate and secure communication between nodes in a network. Conjur will operate as a Certificate Authority, signing and managing certificates for hosts managed by Conjur.\r\n\r\nMost PKI systems do not lend themselves to automation. The primary objective of this initiative is to enable organizations to leverage PKI practices at scale, in high automation environments.\r\n\r\n## Workflow\r\nIn order for Conjur to act as a certificate authority, it will need to support the following functions:\r\n- Perform certificate signing requests\r\n- Enable certificates to be rotated\r\n- Revoke certificates\r\n\r\n## CA Setup\r\n\r\nA best practice is to utilize an intermediate certificate to performing signing.  This allows the root certificate to be kept securely, preferably in an air gapped environment. We will need to include the intermediate private key\r\n\r\nPolicy:\r\n```yml\r\n- !policy \r\n  id: conjur/<service-id>/ca\r\n  body:\r\n    # Private key used to sign certificates\r\n    - !variable intermediate-private-key\r\n\r\n    # Certificate chain for the intermediate-private-key\r\n    - !variable intermediate-certificate-chain\r\n\r\n    # Signed certificates will be valid for up to a year\r\n    - !webservice\r\n      annotations:\r\n        ca/max_ttl: P1Y\r\n\r\n    - !group clients\r\n\r\n    # Allow hosts in the `clients` group to be signed \r\n    - !permit\r\n      role: !group clients\r\n      privilege: [ signed ]\r\n      resource: !webservice\r\n```\r\n\r\nMultiple certificate authorities can be configured by creating multiple CA services. This approach further simplifies the process of replacing intermediate certificate (due to breach or expiration). A new CA can be created, then remote nodes refresh their certificates using the new CA. \r\n\r\nMultiple CAs can also be utilized to separate departments or divisions within an organization. Each certificate chain needs to include the appropriate certificates. We leave this as an exercise for the user.\r\n\r\n## Signing a Host CSR\r\n\r\nAny host that has a Conjur identity have its CSR signed. Below is the API endpoint specifications:\r\n\r\n### API Specification\r\n\r\n#### POST /ca/\\<service-id>/hosts/\\<host-id>/sign\r\n\r\n##### Headers\r\n\r\nField | Description | Example\r\n-- | -- | --\r\nAuthorization | Conjur access token | Token token=\"eyJkYX…Rhb=\"\r\n\r\n##### Request\r\nParameter | Description\r\n-- | --\r\ncsr | (required) CSR file to be signed\r\nttl | (optional) The length of time the signed certificate should be valid for. TTL duration is in ISO8601 duration format\r\n\r\n##### Response Codes\r\n\r\nCode | Description\r\n-- | --\r\n201 | Returns the signed CRT\r\n406 | Host ID does not match that of the CSR Common Name (CN)\r\n\r\n##### Response (201)\r\n```\r\n# Headers\r\nContent-Type: application/json\r\n\r\n# Body\r\n{\r\n  \"created_at\": \"2017-08-07T22:30:00.145+00:00\",\r\n  \"id\": \"myorg:host:staging/my-super-application/host1.my-super-application.staging.mycompany.com\",\r\n  \"expires_at\": \"2018-02-07T22:30:00.145+00:00\",\r\n  \"crt\": \"akfjlaksdjalfjsl...\"\r\n}\r\n```\r\n\r\n##### Example\r\n```\r\n$ curl --request PUT \\\r\n        --form \"csr=@/path/to/domain.csr\" \\\r\n        --form \"ttl=P6M\" \\\r\n        --header \"Authorization: Token token=\\\"$token\\\"\" \\\r\n     https://conjur.myorg.com/ca/<service-id>/hosts/<host-id>/sign\r\n\r\n201\r\n  {\r\n  \"created_at\": \"2017-08-07T22:30:00.145+00:00\",\r\n  \"id\": \"myorg:host:staging/my-super-application/host1.my-super-application.staging.mycompany.com\",\r\n  \"expires_at\": \"2018-02-07T22:30:00.145+00:00\",\r\n  \"crt\": \"akfjlaksdjalfjsl...\"\r\n  }\r\n```\r\n\r\nThe above request performs the following actions:\r\n- Validates the CSR CN matches the host id (`host1.my-super-application.staging.mycompany.com`)\r\n- Signs the CSR (CSR is removed from Conjur after signing) with an expiration date six months from the request (`ttl=P6M` - optional, without `ttl`, certificate is valid for one year)\r\n- Returns a JSON response with host ID and serialized CRT\r\n\r\n\r\n## CRT Authentication\r\n\r\nAdditionally, a signed CRT can be used to authenticate a host.\r\n\r\n#### POST /authn-ca/\\<service-id>/\\<conjur-account>/\\<hostname>/authenticate\r\n\r\n##### Request Body\r\nThe request body is the content of the CRT certificate.\r\n\r\nCode | Description\r\n-- | --\r\n200 | The response body is the access token\r\n401 | The request lacks valid authentication credentials\r\n\r\n##### Response (200)\r\n```\r\n{\r\n  \"protected\": \"eyJhbGciOiJjb25qdXIub3JnL3Nsb3NpbG8vdjIiLCJraWQiOiI0NGIwMjBmNjY0MDBmNzFhZDQ3Y2I0N2IzYTFiNmU5MSJ9\",\r\n  \"payload\": \"eyJzdWIiOiJhbGljZSIsImlhdCI6MTUwNTgzMDY1MX0=\",\r\n  \"signature\": \"iRLTwNomb_b6TS4e539IIC-isPsc0kIn-F_ajlvnGdrN6brEEHnVha2vm0oDwOjpnmpFrMYLzn8aPo4_7DP3edssfQbpMG6OZI2Ea9DRfkhQGtSQ2fQvhDos_f16EX_jWQkYlsY6T_RurAxf_7VC4hEhjZA8nLkXOohA1DheyoJiT2-7vdpLmf42G7r1gPWHd_JuFkee28Ax2vCi35l4yQXkAHFaLkb3cAD2iwYuavv3qcFnYsT5WhLQqndPoNzgNa4dMvWRkVNUoVmvL30oE6lAlWPO4rFbPpmLwJRJFudDF8IVV9cVRKnV3z79_3RfEsHJ6YTHVX4Cv--cXmkT17QSFp87DK94DAOX3jKvJNo49DdqkzXqAPUIj3CD3IWI\"\r\n}\r\n```\r\n\r\n\r\n\r\n\r\n\r\n## Future Development\r\n\r\n### Revoking Certificates\r\n\r\nEach certificate is generated with a unique serial number. This allows a host's certificate to be revoked if the host has been breached, removed, or the signed certificate is set to expire. To revoke a host's certificate:\r\n```\r\n$ curl --request PUT \\\r\n        --header \"Authorization: Token token=\\\"$token\\\"\" \\\r\n     https://conjur.myorg.com/ca/<service-id>/hosts/<host-id>/revoke\r\n\r\n200\r\n```\r\n\r\n### Certificate Revocation List\r\n\r\nNodes need to be aware of certificates that have been revoked.  This is accomplished through a  Certificate Revocation List (CRL) Distribution Point. A CRL can optionally return a text (default) DER, or PEM. This endpoint does not require authentication.\r\n\r\nTo get the full set of expired certificates:\r\n```\r\n$ curl https://conjur.myorg.com/ca/<service_id>/revoked # (raw)\r\n$ curl https://conjur.myorg.com/ca/<service_id>/revoked.pem # (PEM encoded)\r\n$ curl https://conjur.myorg.com/ca/<service_id>/revoked.der # (DER encoded)\r\n```\r\n\r\nThe revoked endpoint returns a CRL file, in the desired format, listing the revoked certificates that have not expired.\r\n\r\n\r\n### Original Epic Goal & Resources\r\n* Document some opportunities for value delivery that is enabled with certificate signing.\r\n* How can Conjur be used to sign certificates?\r\n\r\nWe should take heavy inspiration from HC: \r\n* http://cuddletech.com/?p=959\r\n* https://www.vaultproject.io/docs/secrets/pki/index.html\r\n\r\nThe outcome of this effort is a epic document story."},"comment":{"url":"https://api.github.com/repos/cyberark/conjur/issues/comments/409929166","html_url":"https://github.com/cyberark/conjur/issues/651#issuecomment-409929166","issue_url":"https://api.github.com/repos/cyberark/conjur/issues/651","id":409929166,"node_id":"MDEyOklzc3VlQ29tbWVudDQwOTkyOTE2Ng==","user":{"login":"jonahx","id":699684,"node_id":"MDQ6VXNlcjY5OTY4NA==","avatar_url":"https://avatars3.githubusercontent.com/u/699684?v=4","gravatar_id":"","url":"https://api.github.com/users/jonahx","html_url":"https://github.com/jonahx","followers_url":"https://api.github.com/users/jonahx/followers","following_url":"https://api.github.com/users/jonahx/following{/other_user}","gists_url":"https://api.github.com/users/jonahx/gists{/gist_id}","starred_url":"https://api.github.com/users/jonahx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonahx/subscriptions","organizations_url":"https://api.github.com/users/jonahx/orgs","repos_url":"https://api.github.com/users/jonahx/repos","events_url":"https://api.github.com/users/jonahx/events{/privacy}","received_events_url":"https://api.github.com/users/jonahx/received_events","type":"User","site_admin":false},"created_at":"2018-08-02T13:38:27Z","updated_at":"2018-08-02T13:38:27Z","author_association":"CONTRIBUTOR","body":"@apotterri I'm curious what you don't like.  I much prefer this method to using google docs personally..."}}
{"actor":{"display_login":"jonahx"}}