ASWI - Pokročilé softwarové inženýrství » ASWI 2021 » Aplikace pro správu X.509 certifikátů (Yoso Czech s.r.o.) - JMSD

h1. Iteration 4

*Target:* CRL/OCSP, certificate detailed view

h2. Tasks

h3. Implement certificate revocation, add CRL distribution point and OCSP endpoint to certificate extensions

* One Rest API endpoint: POST /certificates/{id}/revoke body =  { reason: "<reason for revocation>"} 

with reason: [unspecified, keyCompromise, cACompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold, removeFromCRL, privilegeWithdrawn, aACompromise].

The reason will be optional and if not present, unspecified is used. 

* Controller will call a method revoke_certificate(id) of CertificateService.

* Certificate service will call a CertificateRepository set_certificate_revoked(id, timestamp, reason) to set the certificate revoked.

* Database must be extended with the following data: revocation date (Unix timestamp, generated automatically by the CertificateService), bool flag if is revoked, the reason for revocation(may be implemented as a second table with revocation reason values).

* CertificateRepository shall expose the following method get_all_revoked_by(id) that returns all certificates that were issued by the given CA and are now revoked.

h3. Implement certificate deletion endpoint

* One Rest API endpoint: DELETE /certificates/{id} that deletes the certificate

* Controller calls CertificateService delete_certificate(id) that must be extended to delete the whole subtree of certificates

* To extend delete_certificate(id) a CertificateRepository must implement get_all_issued_by(id) that returns all certificates that were issued by the given CA

h3. Implement endpoint for retrieving public/private key for each certificate

* Two endpoints GET /certificates/{id}/publickey and GET /certificates/{id}/privatekey

* The first endpoint just queries the certificate using CertificateService, gets a private key ID, queries private key from the KeyService and returns its data.

* The second endpoint will do the same, except at the end it calls a new method of KeyService get_public_key(private_key) that utilizes OpenSSL via CryptographyService to get a public key out of the private key provided

h3. Implement endpoint for retrieving all certificates issued by a given CA

* Extend existing endpoint GET /certificates with another filtering option {issuedby: <id>}

* Controller can use new function of CertificateService get_certificates_issued_by(id) that calls CertificateRepository -> get_all_issued_by(id) (described previously)

h3. Implement creation OpenSSL index file

* Probably new service for CRL/OCSP

* One method create_revoked_index(ca_id) that queries revoked certificates of the given CA using get_all_revoked_by(id) of the CertificateRepository and creates index file based on the following link 

https://pki-tutorial.readthedocs.io/en/latest/cadb.html

h3. Implement CRL service and corresponding endpoint 

h3. Implement OCSP service and corresponding endpoint

h3. Logging

h3. Application initialization and DI

h3. Database initialization

h3. Dependency injection

h3. Certificate detailed view