Skip to content

Commit 02a2cd7

Browse files
bill-buchangithub-actions[bot]
bill-buchan
and
github-actions[bot]
authored
Replace Self-Signed Certs for TCPS with ACM Certs (#526)
* Revised version to use ACM * Go to the new client wallet directory * Put the wallet into /tmp * Missing trailing slash * Find files locally * Fix typo * Debug skip standby * Add verbose option * Match variable name * Only put the intermediate certificate in the client wallet * Tidy up at end * Commit changes made by code formatters --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent 4b90144 commit 02a2cd7

11 files changed

+267
-302
lines changed

‎.github/workflows/oracle-db-ssl-wallet.yml

+10-1
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,15 @@ on:
2424
type: choice
2525
options:
2626
- "delius_dbs"
27+
Verbose:
28+
description: "Verbose Output level"
29+
type: choice
30+
options:
31+
- ""
32+
- "-v"
33+
- "-vv"
34+
- "-vvv"
35+
- "-vvvv"
2736
SourceCodeVersion:
2837
description: "Source version for the hmpps-delius-operation-automation. Enter a pull request, branch, commit ID, tag, or reference."
2938
type: string
@@ -106,4 +115,4 @@ jobs:
106115
run: |
107116
export ANSIBLE_CONFIG=$ansible_config
108117
$command -i $inventory -e ansible_aws_ssm_bucket_name=${{ vars.ANSIBLE_AWS_SSM_BUCKET_NAME }} \
109-
-e target_hosts=${{ steps.prepareinventorynames.outputs.hosts }}
118+
-e target_hosts=${{ steps.prepareinventorynames.outputs.hosts }} ${{ github.event.inputs.Verbose }}

‎playbooks/oracle_ssl_wallet/oracle_ssl_wallet/tasks/configure_client_wallet.yml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# We only need to create the Client Wallet once - we then upload it to the DMS instance.
2+
# It only needs to contain the Subordinate CA Certificate.
3+
# We perform the creation on the primary host.
4+
- name: Create Client Wallet
5+
when: database_primary_sid is defined
6+
block:
7+
# Ensure we are starting fresh by removing any existing client wallet
8+
- name: Remove SSL Wallet Directory
9+
file:
10+
path: "{{ client_wallet_directory }}"
11+
state: absent
12+
13+
# The Client Wallet should NOT contain the Private Key
14+
- name: Create Client SSL Wallet Directory
15+
file:
16+
path: "{{ client_wallet_directory }}"
17+
state: directory
18+
19+
- name: Create Oracle Wallet
20+
shell: |
21+
. ~/.bash_profile
22+
orapki wallet create -wallet {{ client_wallet_directory }} -auto_login_only
23+
24+
- name: Import Subordinate CA Certificate into Oracle Wallet as Trusted Certificate
25+
shell: |
26+
. ~/.bash_profile
27+
orapki wallet add -wallet {{ client_wallet_directory }} -trusted_cert -cert {{ wallet_working_directory }}/certificatechain.pem -auto_login_only

‎playbooks/oracle_ssl_wallet/oracle_ssl_wallet/tasks/configure_listener.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@
6969
(SOURCE =
7070
(METHOD = FILE)
7171
(METHOD_DATA =
72-
(DIRECTORY = {{ wallet_directory }})
72+
(DIRECTORY = {{ listener_wallet_directory }})
7373
)
7474
)
7575
SSL_CLIENT_AUTHENTICATION = FALSE

‎playbooks/oracle_ssl_wallet/oracle_ssl_wallet/tasks/configure_listener_wallet.yml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
- name: Create Listener SSL Wallet Parent Directory
2+
file:
3+
path: "{{ listener_wallet_directory | dirname }}"
4+
state: directory
5+
6+
- name: Create Listener SSL Wallet Directory
7+
file:
8+
path: "{{ listener_wallet_directory }}"
9+
state: directory
10+
11+
# We remove any existing wallet as we will be importing a new certificate and if it has the same DN value
12+
# as one already in the wallet this may result in a failure for the correct certificate to be used
13+
- name: Remove Any Existing Wallet and Lock File
14+
file:
15+
path: "{{ listener_wallet_directory }}/{{ item }}"
16+
state: absent
17+
loop:
18+
- cwallet.sso
19+
- cwallet.sso.lck
20+
21+
- name: Create Oracle Wallet
22+
shell: |
23+
. ~/.bash_profile
24+
orapki wallet create -wallet {{ listener_wallet_directory }} -auto_login_only
25+
26+
- name: Import PKCS12 File into Oracle Wallet
27+
shell: |
28+
. ~/.bash_profile
29+
orapki wallet import_pkcs12 -wallet {{ listener_wallet_directory }} -pkcs12file {{ wallet_working_directory }}/listener.p12 -auto_login_only -pkcs12pwd ${PKCS12PASSWORD}
30+
environment:
31+
PKCS12PASSWORD: "{{ pkcs12password }}"

‎playbooks/oracle_ssl_wallet/oracle_ssl_wallet/tasks/configure_wallet.yml

-96
This file was deleted.

‎playbooks/oracle_ssl_wallet/oracle_ssl_wallet/tasks/create_certificates.yml

-59
This file was deleted.

‎playbooks/oracle_ssl_wallet/oracle_ssl_wallet/tasks/download_certificates.yml

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
- name: Create a working directory for the certificate
3+
ansible.builtin.file:
4+
path: "{{ wallet_working_directory }}"
5+
state: directory
6+
mode: "0755"
7+
8+
# We always clear out the working directory before we begin
9+
# to ensure that we create a fresh private key and certificates
10+
# which are consistent with it.
11+
- name: Find all files in the working directory
12+
find:
13+
paths: "{{ wallet_working_directory }}"
14+
file_type: file
15+
register: files_to_delete
16+
17+
- name: Delete files found in the working directory
18+
file:
19+
path: "{{ item.path }}"
20+
state: absent
21+
loop: "{{ files_to_delete.files }}"
22+
23+
# We use a different certificate for each instance which we download from
24+
# AWS Certificate Manager (ACM).
25+
26+
# Download the Certificate (Note that there is an Ansible ACM module but
27+
# it does not currently support downloading certificates so we need
28+
# to use the AWS CLI).
29+
30+
- name: Get ARN of Certificate for this Host
31+
shell: |
32+
aws acm list-certificates --query "CertificateSummaryList" --output json | \
33+
jq -r --arg hostname "$(hostname)" ' map(select(.SubjectAlternativeNameSummaries[]? | contains($hostname))) | .[].CertificateArn'
34+
register: get_certificate_arn
35+
changed_when: false
36+
37+
# Ensure the passphrase file does not contain a line terminator.
38+
# See: https://docs.aws.amazon.com/acm/latest/userguide/export-private.html
39+
- name: Create a Random Passphrase
40+
shell: |
41+
openssl rand -base64 32 | tr -d '\n' > {{ wallet_working_directory }}/passphrase.txt
42+
43+
- name: Download Certificate from ACM
44+
shell: |
45+
aws acm export-certificate \
46+
--certificate-arn {{ get_certificate_arn.stdout | trim }} \
47+
--passphrase fileb://{{ wallet_working_directory }}/passphrase.txt > {{ wallet_working_directory }}/certificate.json
48+
49+
- name: Extract PEM Files from Downloaded Certificate
50+
shell: |
51+
jq -r '.Certificate' {{ wallet_working_directory }}/certificate.json > {{ wallet_working_directory }}/certificate.pem
52+
jq -r '.CertificateChain' {{ wallet_working_directory }}/certificate.json > {{ wallet_working_directory }}/certificatechain.pem
53+
jq -r '.PrivateKey' {{ wallet_working_directory }}/certificate.json > {{ wallet_working_directory }}/privatekey.pem
54+
55+
- name: Create PKCS12 File for Use with Listener
56+
shell: |
57+
openssl pkcs12 -export -in {{ wallet_working_directory }}/certificate.pem \
58+
-certfile {{ wallet_working_directory }}/certificatechain.pem \
59+
-inkey {{ wallet_working_directory }}/privatekey.pem \
60+
-out {{ wallet_working_directory }}/listener.p12 \
61+
-passout env:PKCS12PASSWORD \
62+
-passin file:{{ wallet_working_directory }}/passphrase.txt
63+
environment:
64+
PKCS12PASSWORD: "{{ pkcs12password }}"

‎playbooks/oracle_ssl_wallet/oracle_ssl_wallet/tasks/main.yml

+30-12
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,33 @@
1-
- name: Create CA Certificate
2-
include_tasks: create_certificates.yml
3-
tags: create
1+
- name: Generate Random Password for PKCS12 File
2+
set_fact:
3+
pkcs12password: "{{ lookup('password', '/dev/null', length=16) }}"
44

5-
- name: Configure Wallet
6-
include_tasks: configure_wallet.yml
7-
tags: wallet
5+
- block:
6+
- name: Download CA Certificate from ACM
7+
include_tasks: download_certificates.yml
8+
tags: create
89

9-
- name: Configure Listener
10-
include_tasks: configure_listener.yml
11-
tags: listener
10+
- name: Configure Listener Wallet
11+
include_tasks: configure_listener_wallet.yml
12+
tags: wallet
1213

13-
- name: Upload Certificate
14-
include_tasks: upload_certificate.yml
15-
tags: upload
14+
- name: Configure Listener
15+
include_tasks: configure_listener.yml
16+
tags: listener
17+
18+
- name: Configure Client Wallet
19+
include_tasks: configure_client_wallet.yml
20+
tags: wallet
21+
22+
# The Client Wallet is prepared on the primary database host so
23+
# we only need to upload it from there
24+
- name: Upload Certificate to DMS
25+
include_tasks: upload_certificate.yml
26+
when: database_primary_sid is defined
27+
tags: upload
28+
29+
always:
30+
- name: Clean Up Working Directory
31+
file:
32+
path: "{{ wallet_working_directory }}"
33+
state: absent

‎playbooks/oracle_ssl_wallet/oracle_ssl_wallet/tasks/test.yml

-8
This file was deleted.

0 commit comments

Comments
 (0)