Skip to content

Commit 51d9df9

Browse files
gfourgfour
committed
Set up certificates using local IACA certificate
1 parent 40e4bcb commit 51d9df9

10 files changed

+296
-73
lines changed

‎.github/README.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,16 @@ This setup assumes two devices (one Android, one Linux).
1616
environment, install dependencies, generate self-signed certificate
1717
bound to the local host IP).
1818

19+
3. Optional: consult the last section in the output of the command
20+
above to find how to set up local signing certificates (signed
21+
by a local IACA certificate).
22+
1923
4. Run `./run-issuer.sh` to spin up the issuer server.
2024

2125
### Android wallet
2226

2327
1. Clone [the Android app fork](https://github.com/gfour/eudi-app-android-wallet-ui)
24-
and switch to branch "local-deploy".
28+
and switch to branch "local-deploy-v2".
2529

2630
3. Run the issuer as above
2731

‎iaca.key

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN EC PRIVATE KEY-----
2+
MHcCAQEEICIoPMsIqxayJXj4PKtz0EKTfw7wz6xh1ACO9stjooWjoAoGCCqGSM49
3+
AwEHoUQDQgAEwFNM8IyEp1s0tzgdDQMnyvul5dCkk6iEJ2siHLliLxcTKmNFHaPz
4+
MRtlXO3NTe/LGtAegXq8BTfSWArRkUqNKw==
5+
-----END EC PRIVATE KEY-----

‎iaca.pem

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIICnjCCAkOgAwIBAgIUFE0Dgl2yQ3/sGNmTsq68RepL8icwCgYIKoZIzj0EAwIw
3+
PTEeMBwGA1UEAwwVUElEIElzc3VlciBDQSAtIEdSIDAxMQ4wDAYDVQQKDAVHUk5F
4+
VDELMAkGA1UEBhMCR1IwHhcNMjUwMzExMDc1NjE3WhcNMjYwMzExMDc1NjE3WjA9
5+
MR4wHAYDVQQDDBVQSUQgSXNzdWVyIENBIC0gR1IgMDExDjAMBgNVBAoMBUdSTkVU
6+
MQswCQYDVQQGEwJHUjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMBTTPCMhKdb
7+
NLc4HQ0DJ8r7peXQpJOohCdrIhy5Yi8XEypjRR2j8zEbZVztzU3vyxrQHoF6vAU3
8+
0lgK0ZFKjSujggEfMIIBGzASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSa
9+
hjchdcXwuEb6Rr8ELeS3+ZyONjBiBgNVHSMEWzBZoUGkPzA9MR4wHAYDVQQDDBVQ
10+
SUQgSXNzdWVyIENBIC0gR1IgMDExDjAMBgNVBAoMBUdSTkVUMQswCQYDVQQGEwJH
11+
UoIUFE0Dgl2yQ3/sGNmTsq68RepL8icwPgYDVR0lAQH/BDQwMgYIK4ECAgAAAQcG
12+
CCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEMDIGA1UdHwQr
13+
MCkwJ6AloCOGIWh0dHA6Ly84My4yMTIuNzIuMTE0OjgwODIvY3JsLnBlbTAOBgNV
14+
HQ8BAf8EBAMCAfYwCgYIKoZIzj0EAwIDSQAwRgIhAKK820GxcGVoj1Fe0ewMFK6j
15+
zSdjvEuJhBfpUqTA+Xj1AiEAiKS/fZ8lfDH1aUs1pSGnlmBe+IXhcXbohroLq/Ql
16+
ckc=
17+
-----END CERTIFICATE-----

‎run-issuer.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
HOST_IP=$(<.config.ip)
44

55
source .venv/bin/activate
6-
export REQUESTS_CA_BUNDLE=$(realpath cert.pem)
6+
export REQUESTS_CA_BUNDLE=$(realpath iaca.pem)
77
export SERVICE_URL="https://${HOST_IP}:5000/"
88
export EIDAS_NODE_URL="https://TODO1/"
99
export DYNAMIC_PRESENTATION_URL="https://TODO2/"

‎scripts/create-iaca.sh

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#!/usr/bin/env bash
2+
#
3+
# This file demonstrates creation of IACA certificates. Notes:
4+
#
5+
# * This is not complete; a .crl distribution server should also
6+
# be set up (see "crlDistributionPoints" property below).
7+
#
8+
# * The generated certificate is self-signed.
9+
#
10+
# * For convenience, the generated certificate can also sign
11+
# SSL server certificates.
12+
#
13+
14+
echo Creating root certificate...
15+
openssl ecparam -name prime256v1 -genkey -noout -out iaca.key
16+
17+
echo '[ req ]
18+
distinguished_name = req_distinguished_name
19+
x509_extensions = v3_ca # Section to use for cert extensions
20+
21+
[ req_distinguished_name ]
22+
CN = PID Issuer CA - GR 01
23+
O = GRNET
24+
C = GR
25+
26+
[ v3_ca ]
27+
basicConstraints = critical, CA:TRUE, pathlen:0
28+
subjectKeyIdentifier = hash
29+
authorityKeyIdentifier = keyid,issuer:always
30+
extendedKeyUsage = critical, 1.3.130.2.0.0.1.7, serverAuth, clientAuth, codeSigning, emailProtection
31+
crlDistributionPoints = URI:http://83.212.72.114:8082/crl.pem
32+
keyUsage = critical, keyCertSign, cRLSign, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
33+
' > eudi-cert.conf
34+
35+
IACA=iaca.pem
36+
openssl req -new -key iaca.key -x509 -nodes -days 365 \
37+
-subj "/CN=PID Issuer CA - GR 01/O=GRNET/C=GR" \
38+
-out ${IACA} \
39+
-config eudi-cert.conf \
40+
-extensions v3_ca
41+
42+
openssl x509 -in ${IACA} -noout -text
43+
echo "Created: ${IACA}"
44+
45+
# We check that this IACA can also be used to issue SSL server
46+
# certificates (required key usages: https://www.ietf.org/rfc/rfc3280.txt, p.41)
47+
echo "Checking validity for SSL server purposes"
48+
openssl verify -CAfile iaca.pem -purpose sslserver ${IACA}

‎scripts/create-issuer-mdl-cert.sh

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#!/usr/bin/env bash
2+
set -e
3+
4+
if [ "$1" == "" ]; then
5+
echo "Usage: ./create-issuer-mdl-cert.sh <DOMAIN>"
6+
echo "Creates a certificate for mDL issuance"
7+
exit
8+
fi
9+
10+
echo "== Creating key =="
11+
KEY="$1.key"
12+
openssl ecparam -name prime256v1 -genkey -noout -out ${KEY}
13+
14+
echo "== Creating certificate signing request =="
15+
CSR="$1.csr"
16+
rm -f ${CSR}
17+
echo "[ req ]
18+
distinguished_name = req_distinguished_name
19+
x509_extensions = v3_ca # Section to use for cert extensions
20+
21+
[ req_distinguished_name ]
22+
CN = $1
23+
O = GRNET
24+
C = GR
25+
26+
[ v3_ca ]
27+
basicConstraints = CA:FALSE
28+
subjectKeyIdentifier = hash
29+
authorityKeyIdentifier = keyid,issuer:always
30+
extendedKeyUsage = 1.0.18013.5.1.2
31+
crlDistributionPoints = URI:http://83.212.72.114:8082/crl.pem
32+
keyUsage = digitalSignature
33+
" > eudi-mdl-cert.conf
34+
35+
openssl req -new -sha256 -key ${KEY} \
36+
-subj "/CN=$1/O=GRNET/C=GR" \
37+
-out ${CSR}
38+
39+
echo "== Verifying the request =="
40+
openssl req -in ${CSR} -noout -text
41+
42+
echo "== Generating the certificate =="
43+
rm -f iaca.srl
44+
CRT="$1.crt"
45+
openssl x509 -req -in ${CSR} -CA iaca.pem -CAkey iaca.key -CAcreateserial -out ${CRT} -days 500 -sha256 -extfile eudi-mdl-cert.conf -extensions v3_ca
46+
openssl x509 -in ${CRT} -noout -text
47+
rm -f eudi-mdl-cert.conf
48+
49+
PUB_JWK="$1.jwk.pub.json"
50+
JWK="$1.jwk.json"
51+
step crypto jwk create ${PUB_JWK} ${JWK} --from-pem ${KEY} --insecure --no-password --force
52+
DER="${CRT}.der"
53+
openssl x509 -in ${CRT} -out ${DER} -outform DER
54+
55+
echo "== Files created =="
56+
echo ${CRT}
57+
echo ${DER}
58+
echo ${KEY}
59+
echo ${PUB_JWK}
60+
echo ${JWK}

‎scripts/setup-cert.sh

+143
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
#!/usr/bin/env bash
2+
3+
LOCAL_ROOT_CA="iaca.pem"
4+
LOCAL_ROOT_CA_KEY="iaca.key"
5+
6+
function install_certificates() {
7+
echo Installing keys/certificates...
8+
PRIVKEY_DIR=/etc/eudiw/pid-issuer/privKey/
9+
CERT_DIR=/etc/eudiw/pid-issuer/cert/
10+
sudo mkdir -p ${PRIVKEY_DIR}
11+
sudo mkdir -p ${CERT_DIR}
12+
sudo chmod +rx /etc/eudiw
13+
sudo chmod +rx /etc/eudiw/pid-issuer
14+
sudo chmod +rx ${PRIVKEY_DIR}
15+
sudo chmod +rx ${CERT_DIR}
16+
17+
echo Copying signing certificates...
18+
sudo unzip -o api_docs/test_tokens/DS-token/PID-DS-0002.zip -d ${PRIVKEY_DIR}
19+
sudo mv ${PRIVKEY_DIR}/PID-DS-0002.cert.der ${CERT_DIR}/
20+
sudo chmod +r ${PRIVKEY_DIR}*
21+
sudo cp ${LOCAL_ADDR}.crt.der ${CERT_DIR}/
22+
sudo chmod +r ${CERT_DIR}/${LOCAL_ADDR}.crt.der
23+
sudo cp ${LOCAL_ADDR}.key ${PRIVKEY_DIR}/
24+
sudo chmod +r ${PRIVKEY_DIR}/${LOCAL_ADDR}.key
25+
26+
echo Copying IACA files...
27+
gunzip -f -k api_docs/test_tokens/IACA-token/PIDIssuerCAUT01.pem.gz
28+
sudo mkdir -p /etc/eudiw/pid-issuer/cert/
29+
sudo chmod +rx /etc/eudiw/pid-issuer/cert/
30+
sudo cp api_docs/test_tokens/IACA-token/PIDIssuerCAUT01.pem /etc/eudiw/pid-issuer/cert/
31+
if [ -f "${LOCAL_ROOT_CA}" ]; then
32+
sudo cp "${LOCAL_ROOT_CA}" /etc/eudiw/pid-issuer/cert/
33+
fi
34+
}
35+
36+
function generate_config_file()
37+
{
38+
cat << EOF
39+
[req]
40+
default_bits = 2048
41+
distinguished_name = req_distinguished_name
42+
req_extensions = req_ext
43+
x509_extensions = v3_req
44+
prompt = no
45+
46+
[req_ext]
47+
subjectAltName = @alt_names
48+
49+
[req_distinguished_name]
50+
countryName = GR
51+
stateOrProvinceName = Attica
52+
localityName = N/A
53+
organizationName = GRNET
54+
commonName = GRNET-Issuer
55+
56+
[v3_ca]
57+
authorityKeyIdentifier=keyid,issuer:always
58+
basicConstraints=critical,CA:FALSE
59+
keyUsage = critical,digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
60+
extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
61+
62+
[v3_req]
63+
subjectAltName = @alt_names
64+
65+
[alt_names]
66+
IP.1 = ${LOCAL_ADDR}
67+
EOF
68+
}
69+
70+
function generate_ssl_certificate() {
71+
echo "== Generating SSL certificate configuration =="
72+
config_file=$(mktemp)
73+
echo "Using temporary configuration in ${config_file}"
74+
generate_config_file > ${config_file}
75+
cat ${config_file}
76+
77+
if [ -f "${LOCAL_ROOT_CA}" ] && [ -f "${LOCAL_ROOT_CA_KEY}" ]; then
78+
CUSTOM_ROOT_CA=1
79+
else
80+
CUSTOM_ROOT_CA=0
81+
fi
82+
83+
# No local root CA available, create a simple self-signed certificate
84+
if [ $CUSTOM_ROOT_CA -eq 0 ]; then
85+
openssl req -x509 -nodes -days 730 \
86+
-newkey rsa:2048 \
87+
-keyout ${KEY} \
88+
-out ${CRT} \
89+
-config "$config_file"
90+
return
91+
fi
92+
93+
# Local root CA available, create a certificate signed by it
94+
echo "== Creating key =="
95+
KEY="key.pem"
96+
openssl genrsa -out ${KEY} 2048
97+
98+
echo "== Creating SSL certificate signing request =="
99+
CSR="cert.csr"
100+
rm -f ${CSR}
101+
openssl req -new -sha256 -key ${KEY} \
102+
-subj "/CN=${LOCAL_ADDR}/O=GRNET/C=GR" \
103+
-out ${CSR}
104+
105+
echo "== Verifying the request =="
106+
openssl req -in ${CSR} -noout -text
107+
108+
echo "== Generating the SSL certificate =="
109+
CRT="cert.pem"
110+
openssl x509 -req -in ${CSR} -CA ${LOCAL_ROOT_CA} -CAkey ${LOCAL_ROOT_CA_KEY} -out ${CRT} -days 400 -sha256 -extfile "${config_file}" -extensions v3_req
111+
rm -f ${config_file}
112+
113+
114+
if [ $CUSTOM_ROOT_CA -eq 1 ]; then
115+
echo "== Verifying the certificate using root CA ${LOCAL_ROOT_CA} =="
116+
openssl verify -CAfile ${LOCAL_ROOT_CA} -purpose sslserver -verify_ip ${LOCAL_ADDR} ${CRT}
117+
fi
118+
}
119+
120+
if [ "$1" == "-h" ]; then
121+
echo "Set up the certificate of the issuer"
122+
echo "Usage: setup-cert.sh [LOCAL_IP]"
123+
exit
124+
elif [ "$1" == "" ]; then
125+
echo $(./resolve-ip.sh) > .config.ip
126+
else
127+
echo $1 > .config.ip
128+
fi
129+
130+
LOCAL_ADDR=$(cat .config.ip)
131+
echo "Using local address: ${LOCAL_ADDR}"
132+
133+
generate_ssl_certificate
134+
scripts/create-issuer-mdl-cert.sh ${LOCAL_ADDR}
135+
136+
install_certificates
137+
138+
echo
139+
echo "mdoc certificate created, set the following options in app/app_config/config_countries.py:"
140+
echo '"pid_mdoc_privkey": "/etc/eudiw/pid-issuer/privKey/'${LOCAL_ADDR}'.key"'
141+
echo '"pid_mdoc_privkey_passwd": None'
142+
echo '"pid_mdoc_cert": "/etc/eudiw/pid-issuer/cert/'${LOCAL_ADDR}'.crt.der"'
143+
echo

‎scripts/setup-issuer-metadata.sh

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/usr/bin/env bash
2+
3+
if [ "$1" == "-h" ]; then
4+
echo "Usage: setup-issuer-metadata.sh [IP]"
5+
echo
6+
echo "IP the local IP of the issuer, empty for autodetection"
7+
exit
8+
elif [ "$1" == "" ]; then
9+
IP=$(cat .config.ip)
10+
else
11+
IP=$1
12+
fi
13+
14+
git restore app/metadata_config/metadata_config.json app/metadata_config/oauth-authorization-server.json app/metadata_config/openid-configuration.json
15+
git grep issuer.eudiw.dev | fgrep --color=none .json | cut -d ':' -f 1 | sort -u | xargs sed -i -e "s/https:\/\/issuer.eudiw.dev/https:\/\/${IP}:5000/g"

‎setup-cert.sh

-63
This file was deleted.

0 commit comments

Comments
 (0)