Commit a40ced59 authored by Alex Kakiris's avatar Alex Kakiris
Browse files

make certificate subject fields configurable

parent 8091e113

README.md

+1 −0
Changes for README.md: 1 added line, 0 removed lines.
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ Notes: 
- If you use the default local OpenCAPIF deployment, no value changes are usually needed.

- If any of those service names are changed in your OpenCAPIF deployment, you must update docker-compose.yml accordingly (for example CAPIF_HOSTNAME, REGISTER_HOSTNAME, VAULT_HOSTNAME, and extra_hosts). This will be improved in future versions.

- CCF_ONBOARDING_URL, CCF_API_ONBOARDING_URL, CCF_PUBLISH_URL, CCF_DISCOVER_URL, and CCF_SECURITY_URL are static per deployment and must match the ccf_* paths returned by CAPIF's /getauth response; a mismatch is logged as a WARNING on login.

- The certificate subject fields can be overridden via `CERT_ORGANIZATION` (default `Telefonica I+D`), `CERT_ORGANIZATIONAL_UNIT` (`Innovation`), `CERT_LOCALITY` (`Madrid`), `CERT_STATE` (`Madrid`), `CERT_COUNTRY` (`ES`, must be a 2-letter code) and `CERT_EMAIL` (`inno@tid.es`). These have defaults, so unlike the `CCF_*` vars they don't need to be set in `docker-compose.yml`.



Example /etc/hosts entries for a default local setup:

capif_backend/backoffice_service/utils/certs.py

+7 −6
Changes for capif_backend/backoffice_service/utils/certs.py: 7 added lines, 6 removed lines.
Original line number Diff line number Diff line 
import os

from cryptography import x509

from cryptography.hazmat.primitives import hashes, serialization

from cryptography.hazmat.primitives.asymmetric import rsa
@@ -9,12 +10,12 @@ def generate_keypair_and_csr(): 


    # Generate CSR

    subject = x509.Name([

        x509.NameAttribute(NameOID.ORGANIZATION_NAME, 'Telefonica I+D'),

        x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, 'Innovation'),

        x509.NameAttribute(NameOID.LOCALITY_NAME, 'Madrid'),

        x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, 'Madrid'),

        x509.NameAttribute(NameOID.COUNTRY_NAME, 'ES'),

        x509.NameAttribute(NameOID.EMAIL_ADDRESS, 'inno@tid.es'),

        x509.NameAttribute(NameOID.ORGANIZATION_NAME, os.getenv('CERT_ORGANIZATION', 'Telefonica I+D')),

        x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, os.getenv('CERT_ORGANIZATIONAL_UNIT', 'Innovation')),

        x509.NameAttribute(NameOID.LOCALITY_NAME, os.getenv('CERT_LOCALITY', 'Madrid')),

        x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, os.getenv('CERT_STATE', 'Madrid')),

        x509.NameAttribute(NameOID.COUNTRY_NAME, os.getenv('CERT_COUNTRY', 'ES')), # Country name must be exactly 2 characters

        x509.NameAttribute(NameOID.EMAIL_ADDRESS, os.getenv('CERT_EMAIL', 'inno@tid.es')),

    ])

    csr_request = (

        x509.CertificateSigningRequestBuilder()