PKI Made Easy: Managing Certificates with Dogtag. Ade Lee Sr. Software Engineer Red Hat, Inc

Transcription

1 2013 PKI Made Easy: Managing Certificates with Dogtag Ade Lee Sr. Software Engineer Red Hat, Inc

2 Agenda What is PKI? What is Dogtag? Installing Dogtag Interacting with Dogtag using REST Future directions Questions 2 SouthEast LinuxFest

3 Agenda What is PKI? 3 SouthEast LinuxFest

4 Mission #1: Buying Beer 4 SouthEast LinuxFest

5 Need ID? 5 SouthEast LinuxFest

6 Digital Certificate 6 SouthEast LinuxFest

7 Public/Private Keys In certificates, the identifier is the public key in a public/private key pair. Messages encrypted with a public key can only be decrypted using the private key, and visa versa. Being able to decrypt proves possession of the private key and hence, identity. We can use private/public key pairs to identify: Servers (eg. bankofamerica.com) Individuals Devices (routers, locomotives etc.) 7 SouthEast LinuxFest

8 Use Case: Secure Web Browsing A client initiates contact with the secure web server (using https). The server returns a digital certificate. The client checks the validity of the certificate through a trusted certificate authority. The client generates a symmetric key, encrypts it with the server's public key, and sends it to the server. The server decrypts the symmetric key using its private key. The server and client can exchange details using the symmetric key. 8 SouthEast LinuxFest

9 Use Case: Client Authentication User contacts server application using a browser and establishes SSL connection. Server requests client certificate for authentication. User selects certificate for which he has the private key from browser certificate database. Server checks whether the client certificate is valid, and trusted. Cert is used to establish identity. Server uses authorization checks to provide access to applications. 9 SouthEast LinuxFest

10 Use Case: Encryption User requests an encryption cert. The client optionally encrypts the private key and sends it in a CRMF request to the server for escrow. User imports private key and encryption cert into the client. User sends recipient a signed containing his public key. Recipient encrypts a secret message with the public key and sends to the user. Only the user can read the encrypted message. If private key is lost / employee leaves company, encryption key can be recovered from escrow. 10 SouthEast LinuxFest

11 What about portability? Private key is stored in your browser's certificate database. What if you want to use a different machine? Can't put a certificate database in your wallet... Or can you? 11 SouthEast LinuxFest

12 What do we need to manage Driver's Licenses? Registration Authorities that issue licenses after verifying proof of identification. Mechanism to revoke, reinstate, renew license. Mechanism for reissuing licenses after licenses are lost/stolen. Mechanism to check license status. 12 SouthEast LinuxFest

13 Is this License valid? 13 SouthEast LinuxFest

14 What do we need for PKI? A community of entities with public/private keys Registration Authorities that accept cert requests and confirm the requestors' identities Certificate Authorities that issue certificates to certify the validity of public keys Certificate repositories that store public keys Certificate revocation lists and online certificate status managers to verify certificate status Key recovery authorities to recover lost encryption keys Token management system 14 SouthEast LinuxFest

15 Agenda What is PKI? What is Dogtag? 15 SouthEast LinuxFest

16 Dogtag Certificate System Security framework to handle full life cycle of X.509 certificates including issuance, renewal, revocation, publishing, private key escrow, and token management. Red Hat Certificate System is based on Dogtag. RHCS is Common Criteria (EAL4) certified, FIPS Level 2 security libraries with Level 3 validated HSM hardware. RHCS is deployed by largest PKI deployments in the world. Scales to millions of certs and keys. Latest version (10.0.4) is currently available on Fedora 18 and SouthEast LinuxFest

17 Dogtag History Netscape Certificate Server 1.0 [1997] Netscape Certificate Management System 4.1 [1999] Netscape/iPlanet Certificate Management System 4.2 [2000] Sun ONE Certificate Server 4.7 [2002] Netscape Certificate Management System 6.1 SP1 [2003] Red Hat Certificate System 7.3 [2007] Dogtag Certificate Server [2008] Dogtag Certificate Server 9.0 [2011] Red Hat Certificate Server 8.1 [2012] Dogtag Certificate Server 10.0 [2013] 17 SouthEast LinuxFest

18 Features Ability to create and manage certificates Easily deployable and maintainable Highly scalable Cloning for high availability and disaster recovery Based on open standards and protocols. Hence, able to interoperate with other certificate systems (not just Red Hat's) 18 SouthEast LinuxFest

19 Features continued.. Single CA can support multiple registration authorities Root or Subordinate CA, cross-certified CAs, and CA cloning Interfaces: Administration, Agent, and End Entity Signed Auditing Self tests Certificate Issuance, Profiles Plugin Framework for customization 19 SouthEast LinuxFest

20 Features continued.. Publishing, Notifications, and Jobs CRLs and OCSP Encryption Key escrow and recovery Support for hardware tokens Smart Cards and Crypto Accelerators SCEP Interfaces : web UI, RESTful interface, command line utilities, console (graphical client) 20 SouthEast LinuxFest

21 Dogtag in IPA FreeIPA Core NTP Dogtag CA Kerberos KDC Directory Server DNS Authentication Users, Groups, Netgroups, HBAC Managed host (client) SSSD Configures Name lookups and service discovery Cert tracking & provisioning ipa-client Configures Certmonger nss_ldap Other maps Enrollment & un-enrollment Management Station Management framework CLI Management 21 WEBUI Browser SouthEast LinuxFest

22 Dogtag Components 22 SouthEast LinuxFest

23 Dogtag Token Management 23 SouthEast LinuxFest

24 Agenda What is PKI? What is Dogtag? Installing Dogtag 24 SouthEast LinuxFest

25 Installing Dogtag Subsystems Movie demonstrating how to install a Dogtag 10 instance with a CA and KRA using pkispawn. In this case, the CA and KRA are in the same instance See the man pages for more advanced usage. 25 SouthEast LinuxFest

26 Enrollment with Key Archival 26 SouthEast LinuxFest

27 Enrollment with Key Archival Movie showing admin and agent interfaces, and key archival SouthEast LinuxFest

28 Agenda What is PKI? What is Dogtag? Installing Dogtag Interacting with Dogtag using REST 28 SouthEast LinuxFest

29 Dogtag Java Architecture 29 SouthEast LinuxFest

30 Why a new RESTful Interface? We have battle-tested software that has been deployed in the largest public key infrastructures worldwide. We want to become the default PKI implementation for application developers. This means: Simplifying installation and configuration Standard interfaces 30 SouthEast LinuxFest

31 Why a new RESTful interface? Old interface consists of servlet calls with name-value parameter pairs. In new interface, application is presented as a collection of resources More intuitive URLs. POST /profilesubmitservletsslclient vs. POST /certrequests Standard operations and return codes Framework to automatically handle serialization to XML/JSON, crafting HTTP responses etc. on server and client 31 SouthEast LinuxFest

32 REST Resources on the CA certs, certrequests, users, groups, profiles Example invocations: GET /certs - list certificates GET /certs/{id} get specific cert by serial number POST /certs/search search for certs with criteria POST /agent/certs/{id}/revoke revoke a cert POST /certrequests create a new cert request GET /certrequests/{id} get cert request POST /agent/certrequests/{id}/approve approve a cert request POST /admin/users create a new user 32 SouthEast LinuxFest

33 REST Resources on the CA certs, certrequests, users, groups, profiles Example invocations: GET /certs - list certificates GET /certs/{id} get specific cert by serial number POST /certs/search search for certs with criteria POST /agent/certs/{id}/revoke revoke a cert POST /certrequests create a new cert request GET /certrequests/{id} get cert request POST /agent/certrequests/{id}/approve approve a cert request POST /admin/users create a new user 33 SouthEast LinuxFest

34 RESTEasy Client Proxy Framework RESTEasy client proxy framework is a way to use JAX-RS annotations on the client side. Server and client share a Java annotated interfaces which define REST resource objects and method calls. Client instantiates the REST resource objects, and makes method calls. Client framework converts the method call into HTTP requests, handling all data marshalling to JSON or XML. Server error codes handled through exceptions. Used by new CLI code ( pki ). 34 SouthEast LinuxFest

35 Writing client code for REST Interface Very easy in Java using the client proxy framework. Movie to provide some details: Some python support available as well. To be enhanced. REST interface documented at : SouthEast LinuxFest

36 REST Resources on the DRM keys, keyrequests, users, groups, some system resources. GET /agent/keyrequests list key requests GET /agent/keyrequests/{id} get a key request POST /agent/keyrequets/archive submit an archival request POST /agent/keyrequests/recover submit recovery request POST /agent/keyrequests/{id}/approve approve request POST /agent/keyrequests/{id}/reject reject request POST /agent/keyrequests/{id}/cancel cancel request 36 SouthEast LinuxFest

37 DRM Enhancements in Dogtag 10 The DRM has traditionally been used to store X.509 private keys only, with public key as an identifier. With the REST interface, the client provides an identifier client_id The interface can therefore be used to securely archive just about anything, as long as it is packaged in a CRMF package. We have sample code (DRMTest.java) that stores symmetric keys, passphrases. On recovery, these are wrapped with a symmetric key or passphrase. Being investigated as a back-end for CloudKeep. 37 SouthEast LinuxFest

38 Agenda What is PKI? What is Dogtag? Installing Dogtag Interacting with Dogtag using REST Future directions 38 SouthEast LinuxFest

39 Whats next? Dogtag 10.1 scheduled for Fedora 20 (Jan 2014) Extend the REST interface to manage certificate profiles. This will be consumed by FreeIPA. Enhance the python client framework to the REST interface. Rewrite TPS as a Java component residing in a Tomcat instance. And more SouthEast LinuxFest

40 Resources Dogtag Project wiki: Project trac: Code: Mailing lists: IRC (freenode #dogtag-pki) 40 SouthEast LinuxFest

41 Questions? 41 SouthEast LinuxFest