Require explicit key manager TLS credentials

.github/workflows/make-test.yml

@@ -58,10 +58,30 @@ jobs:
         run: sudo make install
       - name: wolfKeyMgr make dist
         run: make dist
+      - name: verify release credential generation
+        run: |
+          mkdir dist-test
+          tar xzf wolfkeymanager-*.tar.gz -C dist-test --strip-components=1
+          cd dist-test
+          ./certs/gen-certs.sh
+          test -s certs/ca-key.pem
+          test -s certs/ca-cert.pem
+          test -s certs/client-key.pem
+          test -s certs/client-cert.pem
+          test -s certs/server-key.pem
+          test -s certs/server-cert.pem
+          test -s certs/server-rsa-key.pem
+          test -s certs/server-rsa-cert.pem
+          test -s certs/demo-password.txt
 
         # wolfKeyMgr examples
+      - name: generate demo credentials
+        run: ./certs/gen-certs.sh
       - name: start key manager service
-        run: sudo ./src/wolfkeymgr &
+        run: |
+          sudo ./src/wolfkeymgr \
+            -k ./certs/server-rsa-key.pem -W ./certs/demo-password.txt \
+            -c ./certs/server-rsa-cert.pem -A ./certs/ca-cert.pem &
       - name: run https server
         run: sudo ./examples/https/server &
       - name: run the middle box decryptor

.gitignore

@@ -60,6 +60,7 @@ certs/server-*.der
 certs/server-*.pem
 certs/client-*.der
 certs/client-*.pem
+certs/demo-password.txt
 certs/serial.old
 certs/1*.pem
 tracefile.txt

ChangeLog.md

@@ -1,3 +1,6 @@
+# wolfKeyMgr v1.2
+* Require explicit TLS credentials and generate demo credentials locally.
+
 # wolfKeyMgr v1.1 (Nov 9, 2021)
 * Added support for x448 (curve448).
 * Added argument support to HTTP server.

README.md

@@ -129,14 +129,16 @@ wolfKeyManager 1.1
 -r <num>    Key renewal timeout, default 3600
 -u <num>    Key renewal max use count, default 100
 -t <num>    Thread pool size, default  16
--k <pem>    TLS Server TLS Key, default ./certs/server-rsa-key.pem
--w <pass>   TLS Server Key Password, default wolfssl
--c <pem>    TLS Server Certificate, default ./certs/server-rsa-cert.pem
--A <pem>    TLS CA Certificate, default ./certs/ca-cert.pem
+-k <pem>    TLS Server Key (required)
+-W <file>   TLS Server Key Password File (required)
+-c <pem>    TLS Server Certificate (required)
+-A <pem>    TLS CA Certificate (required)
 -K <keyt>   Key Type: SECP256R1, FFDHE_2048, X25519 or X448 (default SECP256R1)
 -v <file>   Vault file for key storage, default ./wolfkeymgr.vault
 ```
 
+The key manager refuses to start unless all four TLS credential options are
+provided. The password file must be non-empty and accessible only by its owner.
 To exit the key manager use ctrl+c.
 
 ### ETS Test client
@@ -242,11 +244,18 @@ password     Private Key Password if required
 
 ## Demo Usage
 
-1. Start the key manager: `./src/wolfkeymgr`
-2. Run the HTTPS server `./examples/https/server`
-3. Run the middle-box decryption `./examples/middlebox/decrypt` and use the default parameters.
-4. Open a web browser to `https://localhost` or run the HTTP client example `./examples/https/client`.
-5. In the middle-box decryption window you will see the decrypted HTTPS traffic.
+1. Generate credentials for this demo: `./certs/gen-certs.sh`
+2. Start the key manager: `./src/wolfkeymgr -k ./certs/server-rsa-key.pem -W ./certs/demo-password.txt -c ./certs/server-rsa-cert.pem -A ./certs/ca-cert.pem`
+3. Run the HTTPS server `./examples/https/server`
+4. Run the middle-box decryption `./examples/middlebox/decrypt` and use the default parameters.
+5. Open a web browser to `https://localhost` or run the HTTP client example `./examples/https/client`.
+6. In the middle-box decryption window you will see the decrypted HTTPS traffic.
+
+The generated credentials are for local demonstration only. Deployments must
+use a private CA and unique server and client credentials. Credentials from
+older wolfKeyMgr releases must be considered compromised and rotated.
+For an existing demo directory, run `./certs/gen-certs.sh clean` before
+generating replacement credentials.
 
 Notes:
 
@@ -265,7 +274,7 @@ Notes:
 ### Demo example output
 
 ```
-% ./src/wolfkeymgr
+% ./src/wolfkeymgr -k ./certs/server-rsa-key.pem -W ./certs/demo-password.txt -c ./certs/server-rsa-cert.pem -A ./certs/ca-cert.pem
 Aug 03 15:05:21 2021: [INFO] Starting Key Manager
 Aug 03 15:05:21 2021: [INFO] 	To exit use ctrl+c
 Aug 03 15:05:21 2021: [INFO] loaded CA certificate file ./certs/ca-cert.pem

certs/gen-certs.sh

@@ -1,7 +1,36 @@
 #!/bin/bash
 
+set -euo pipefail
+umask 077
+
 echo "Run from wolfkeymgr root"
 
+reject_shipped_key() {
+    key_file="$1"
+    shipped_fingerprint="$2"
+
+    if [ -f "$key_file" ]; then
+        if ! key_fingerprint=$(openssl pkey -in "$key_file" \
+                -passin pass:'wolfssl' -pubout -outform DER 2>/dev/null | \
+                openssl dgst -sha256 -r | awk '{print $1}'); then
+            echo "Refusing an existing key that could not be fingerprinted:" \
+                "$key_file" >&2
+            exit 1
+        fi
+        if [ -z "$key_fingerprint" ]; then
+            echo "Refusing an existing key with an empty fingerprint:" \
+                "$key_file" >&2
+            exit 1
+        fi
+        if [ "$key_fingerprint" = "$shipped_fingerprint" ]; then
+            echo "Refusing to reuse a credential shipped in an older release:" \
+                "$key_file" >&2
+            echo "Rotate the demo credentials with: ./certs/gen-certs.sh clean" >&2
+            exit 1
+        fi
+    fi
+}
+
 # Make sure required CA files exist and are populated
 rm -f ./certs/index.*
 touch ./certs/index.txt 
@@ -12,26 +41,41 @@ if [ ! -f ./certs/crlnumber ]; then
 	echo 2000 > ./certs/crlnumber
 fi
 
-if [ "$1" == "clean" ]; then
+if [ "${1:-}" == "clean" ]; then
 	rm -f ./certs/1*.pem
 	rm -f ./certs/ca-*.pem
 	rm -f ./certs/client-*.pem
 	rm -f ./certs/client-*.der
 	rm -f ./certs/server-*.pem
 	rm -f ./certs/server-*.der
+	rm -f ./certs/demo-password.txt
 	rm -f ./certs/*.old
 
 	exit 0
 fi
 
+reject_shipped_key ./certs/ca-key.pem \
+    e69c343c84239413663520f8ccf82635b1b8954b9e7a793f2ed3b2b5fd774e5c
+reject_shipped_key ./certs/client-key.pem \
+    9ccdf5657ad96c0c14657937e012486ee0c8db8f735b1abcd28c875dd71c5d2e
+reject_shipped_key ./certs/server-key.pem \
+    27dea57285ac6798c1c47ad6da9501da76073d54524760450bc5a6001d521d38
+reject_shipped_key ./certs/server-rsa-key.pem \
+    637b068c61c194f740b93dc0828de708f5f8efb87e7ee8e7822f6b158c5a7744
+
+printf '%s\n' 'wolfssl' > ./certs/demo-password.txt
+chmod 600 ./certs/demo-password.txt
+
 # Script to generated a TLS server and client certificates
 
 # Keys use ECC and PKCS8 with password "wolfssl"
 
 # Generate ECC 256-bit CA
 if [ ! -f ./certs/ca-key.pem ]; then
 	echo "Creating CA Key (SECP256R1)"
-    openssl ecparam -name prime256v1 -genkey -noout | openssl pkcs8 -topk8 -v2 aes-128-cbc -outform pem -out ./certs/ca-key.pem
+    openssl ecparam -name prime256v1 -genkey -noout | openssl pkcs8 \
+        -topk8 -v2 aes-128-cbc -passout pass:'wolfssl' -outform pem \
+        -out ./certs/ca-key.pem
 fi
 echo "Creating self signed root CA certificate"
 openssl req -config ./certs/ca-ecc.cnf -extensions v3_ca -x509 -nodes -key ./certs/ca-key.pem -passin pass:'wolfssl' \
@@ -41,7 +85,9 @@ openssl req -config ./certs/ca-ecc.cnf -extensions v3_ca -x509 -nodes -key ./cer
 # Client Key
 if [ ! -f ./certs/client-key.pem ]; then
 	echo "Creating Client Key (SECP256R1)"
-    openssl ecparam -name prime256v1 -genkey -noout | openssl pkcs8 -topk8 -v2 aes-128-cbc -outform pem -out ./certs/client-key.pem
+    openssl ecparam -name prime256v1 -genkey -noout | openssl pkcs8 \
+        -topk8 -v2 aes-128-cbc -passout pass:'wolfssl' -outform pem \
+        -out ./certs/client-key.pem
 fi
 
 # Client Cert
@@ -56,7 +102,9 @@ rm ./certs/client-cert.csr
 # Server Key
 if [ ! -f ./certs/server-key.pem ]; then
 	echo "Creating Server Key (SECP256R1)"
-    openssl ecparam -name prime256v1 -genkey -noout | openssl pkcs8 -topk8 -v2 aes-128-cbc -outform pem -out ./certs/server-key.pem
+    openssl ecparam -name prime256v1 -genkey -noout | openssl pkcs8 \
+        -topk8 -v2 aes-128-cbc -passout pass:'wolfssl' -outform pem \
+        -out ./certs/server-key.pem
 fi
 
 # Server Cert

certs/include.am

@@ -4,15 +4,6 @@
 
 
 EXTRA_DIST += certs/gen-certs.sh
-EXTRA_DIST += certs/ca-key.pem
-EXTRA_DIST += certs/ca-cert.pem
-EXTRA_DIST += certs/client-key.pem
-EXTRA_DIST += certs/client-cert.pem
-EXTRA_DIST += certs/server-key.pem
-EXTRA_DIST += certs/server-cert.pem
+EXTRA_DIST += certs/ca-ecc.cnf
 EXTRA_DIST += certs/test-cert.pem
 EXTRA_DIST += certs/test-key.pem
-
-# RSA
-EXTRA_DIST += certs/server-rsa-key.pem
-EXTRA_DIST += certs/server-rsa-cert.pem