5 Commits

Author	SHA1	Message	Date
shankar0123	8bc9f4eed8	EST RFC 7030 hardening master bundle Phases 5-7: end-to-end serverkeygen ... + profile-driven csrattrs + admin observability with per-status counters + reload-trust endpoint. Phase 5 — RFC 7030 §4.4 server-driven key generation: - internal/pkcs7/envelopeddata_builder.go is the inverse of the existing parser/decryptor: AES-256-CBC content cipher + RSA PKCS#1 v1.5 keyTrans + per-call random IV. Round-trip pinned in test (BuildEnvelopedData → ParseEnvelopedData → Decrypt returns the original plaintext byte-for-byte). - ESTService.SimpleServerKeygen runs the full §4.4 flow: parse client CSR → require RSA pubkey for keyTrans → resolve per-profile algorithm (RSA-2048 default; honors AllowedKeyAlgorithms) → in- memory keygen → re-build CSR with server pubkey → run existing issuer pipeline → marshal PKCS#8 → CMS-EnvelopedData wrap to a synthetic recipient cert wrapping the device's CSR-supplied pubkey → zeroize plaintext + PKCS#8 bytes → return CertPEM + ChainPEM + EncryptedKey. Typed sentinels ErrServerKeygenRequiresKey- Encipherment / ErrServerKeygenUnsupportedAlgorithm / ErrServerKeygenDisabled. - ESTHandler.ServerKeygen + ServerKeygenMTLS emit RFC 7030 §4.4.2 multipart/mixed with random per-response boundary; per-profile SetServerKeygenEnabled gate returns 404 when off (defense in depth even if the route was registered). - New routes POST /.well-known/est/[<PathID>/]serverkeygen + /.well-known/est-mtls/<PathID>/serverkeygen; openapi.yaml + openapi-parity guard updated. Phase 6 — Real csrattrs implementation: - New CertificateProfile.RequiredCSRAttributes []string + migration 000022_certificate_profiles_csrattrs.up.sql. The migration also lands the previously-unwired must_staple column (closes the 5.6 follow-up loop where the field shipped at the domain + service layer but the postgres scan/insert/update never persisted it). - domain.EKUStringToOID + AttributeStringToOID lookup tables: id-kp-* EKUs (RFC 5280 §4.2.1.12) + RFC 5280 DN attributes + RFC 2985 PKCS#10 attributes + Microsoft Intune device-serial OID. - ESTService.GetCSRAttrs replaces the v2.0.x nil/204 stub with a profile-derived SEQUENCE OF OID ASN.1 marshal. Unknown EKU / attribute strings dropped + warning-logged so a typo doesn't take down the entire endpoint. Phase 7 — Admin observability + counters + reload-trust: - internal/service/est_counters.go: estCounterTab (sync/atomic; 12 named labels) + ESTStatsSnapshot per-profile shape + ESTService.Stats(now) zero-allocation accessor + ReloadTrust() SIGHUP-equivalent + SetESTAdminMetadata setter. - Counter ticks wired into processEnrollment + SimpleServerKeygen at every success/failure leg. - internal/api/handler/admin_est.go mirrors AdminSCEPIntune verbatim: Profiles + ReloadTrust handlers + AdminESTServiceImpl. Both endpoints admin-gated (M-008 triplet pinned + admin_est.go added to AdminGatedHandlers). - New routes GET /api/v1/admin/est/profiles + POST /api/v1/admin/ est/reload-trust; openapi.yaml documented; openapi-parity guard reproduced clean. - cmd/server/main.go grows estServices map populated by the per- profile EST loop + handed to AdminEST. New MTLSTrust() + HasMTLSTrust() accessors on ESTHandler so main.go can pull the trust holder for the admin-metadata wire-up. - Per-profile counter isolation regression test (internal/service/est_profile_counter_isolation_test.go) proves a future shared-counter refactor would fail at compile-time pointer-identity check. Pre-commit verification (sandbox): gofmt clean, go vet clean (excluding repository/postgres which the sandbox can't build — disk-space testcontainers download), staticcheck clean across cms/trustanchor/api/handler/api/router/scep/intune/ratelimit/ service/pkcs7/domain/cmd/server, go test -short -count=1 green for every non-postgres package. G-3 docs-drift guard reproduced locally clean (Phases 5-7 added zero new env vars; Phase 1 already documented per-profile SERVER_KEYGEN_ENABLED). Spec preserved at cowork/est-rfc7030-hardening-prompt.md. Phases 8-13 (GUI ESTAdminPage / CLI+MCP / libest e2e / bulk revocation / docs/est.md / release prep) remain — post-2.1.0 work.	2026-04-29 23:57:45 +00:00
certctl-copilot	28797b1cbb	feat(scep): plumb CertificateProfile.MustStaple end-to-end through service layer ... SCEP RFC 8894 + Intune master bundle Phase 5.6 follow-up. Closes the 'lying field' gap from the original Phase 5.6 commit (35fcfa7). That commit shipped CertificateProfile.MustStaple as a domain field + IssuanceRequest.MustStaple as the issuer-interface field + the local issuer's RFC 7633 extension generation + byte-exact tests against the spec — but the service layer (SCEP + EST + agent + renewal) never read profile.MustStaple and never set IssuanceRequest.MustStaple. Operators who set the field got: a stored value, an API that returned it, docs that promised it worked, and a cert with no extension. Worse than not having the field at all. Per the new operating rule landed in cowork/CLAUDE.md::Operating Rules ('Always take the complete path, not the easy path'), this commit closes the wire end-to-end. internal/service/renewal.go * IssuerConnector interface signature gains a mustStaple bool param on IssueCertificate + RenewCertificate. The original 'this is a wider refactor' framing was overstated — it's one extra arg threaded through six call sites, not a structural change. internal/service/issuer_adapter.go * IssuerConnectorAdapter.IssueCertificate + RenewCertificate accept the new param + populate IssuanceRequest.MustStaple / RenewalRequest.MustStaple. Connectors that don't honor extension injection (Vault, EJBCA, ACME, etc.) silently ignore the field — the Phase 5.6 commit's docblock already noted this. internal/service/scep.go * processEnrollment now reads profile.MustStaple alongside profile.MaxTTLSeconds and threads it through the IssueCertificate call. The SCEP path was the load-bearing one — the original Phase 5.6 docs example showed exactly this code shape but the wire was never landed. internal/service/est.go * Same pattern as SCEP: read profile.MustStaple + thread to IssueCertificate. Defense in depth so a deploy that mounts the same profile across SCEP + EST gets consistent extension behavior. internal/service/agent.go * The fallback direct-issuer signing path in heartbeatPipeline reads profile + threads MustStaple through. Server-mode keygen + ad-hoc CSR submission paths both go through this. internal/service/renewal.go (the renewal-loop side, not the interface) * Both renewal call sites (server-CSR-generated + agent-CSR-submitted) read profile.MustStaple + thread it through RenewCertificate. Renewed certs match their initial-issuance extension set when the bound profile changes mid-lifetime. internal/service/scep_must_staple_test.go (new) * TestSCEPService_PKCSReq_PlumbsMustStapleToIssuer — end-to-end integration test: profile.MustStaple=true → SCEP service → mock IssuerConnector saw mustStaple=true. This is the test the original Phase 5.6 commit should have shipped — proves the wire reaches the connector. * TestSCEPService_PKCSReq_NoMustStaplePropagatesFalse — companion pinning the symmetric contract; the mock pre-sets LastMustStaple=true so a stuck-at-true bug surfaces. internal/service/testutil_test.go + internal/service/m11c_crypto_enforcement_test.go + internal/service/issuer_adapter_test.go + cmd/server/preflight_test.go * Mock + fake IssuerConnector implementations gain the new mustStaple bool param. mockIssuerConnector + capturingIssuerConnector also gain a LastMustStaple / lastMustStaple field used by the new integration tests to assert the wire reached the connector. * Existing test call sites for adapter.IssueCertificate / adapter.RenewCertificate gain a trailing 'false' arg (mechanical bulk edit, no behavior change). Verification: * gofmt + go vet + staticcheck clean for all touched paths. * go test -short -count=1 green across cmd/agent / cmd/cli / cmd/mcp-server / cmd/server / api/handler / api/middleware / api/router / service / scheduler / pkcs7 / connector/issuer/local / every connector subpackage / domain / crypto / mcp / repository. * The new TestSCEPService_PKCSReq_PlumbsMustStapleToIssuer test passes, proving the wire works end-to-end. The follow-up rule from cowork/CLAUDE.md::Operating Rules — 'can an operator flip the configurable bit and observe the behavior change end-to-end with no further code changes?' — is now YES for must-staple on the SCEP + EST + agent + renewal paths.	2026-04-29 13:36:30 +00:00
Shankar	ff223e2586	feat(M11c): crypto policy enforcement — CSR validation, MaxTTL caps, key metadata ... Enforce certificate profile crypto constraints across all 5 issuance paths (renewal, agent CSR, EST, SCEP). ValidateCSRAgainstProfile() rejects CSRs with key algorithm/size that don't match profile rules. MaxTTL enforcement caps certificate validity per issuer connector (Local CA, Vault, step-ca enforce directly; ACME/DigiCert/Sectigo pass through). Key algorithm and size are now persisted in certificate_versions for audit compliance. 16 new tests (12 service-layer + 4 Local CA connector). Removes hardcoded version number from GUI sidebar. Documentation updated across architecture, features, connectors, and README. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-15 21:05:14 -04:00
Shankar	c014c17cc6	feat(m27): certificate export (PEM/PKCS#12) and S/MIME EKU support ... Add certificate export in PEM (JSON or file download) and PKCS#12 formats. Private keys are never included — they stay on agents. Add EKU-aware issuance threading profile EKUs (serverAuth, clientAuth, codeSigning, emailProtection, timeStamping) through the full issuance pipeline. Fix agent CSR SAN splitting for email addresses, adaptive KeyUsage flags for S/MIME vs TLS, and a pre-existing generateID collision bug in deployment job creation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-28 16:16:19 -04:00
Shankar	e4ba8d4de2	feat: add EST server (RFC 7030) for device certificate enrollment (M23) ... Implement Enrollment over Secure Transport protocol with 4 endpoints under /.well-known/est/ — cacerts (CA chain distribution), simpleenroll (initial enrollment), simplereenroll (certificate renewal), and csrattrs (CSR attributes). PKCS#7 certs-only wire format with hand-rolled ASN.1, accepts both PEM and base64-encoded DER CSRs, configurable issuer and profile binding, full audit trail. 28 new tests (18 handler + 10 service). Also includes: - GetCACertPEM added to issuer connector interface (all 4 issuers updated) - EST integration tests wired into e2e test suite (13 test cases) - QA testing guide Part 26 (15 manual EST test cases) - All docs updated: README, features, architecture, concepts, connectors, quickstart, demo-advanced (endpoint counts, MCP wording, agent IDs, issuer interface, resource lists, OpenSSL status) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-25 15:31:06 -04:00