Skip to content

Commit f18d190

Browse files
phbnfphbnf
authored
Instructions to send test certificates (#24)
* Add testdata files * add instructions to run the hammer * add instructions to generate chains manually * add hammer instrucitons to dump log * typo * fix comments * typo * typo2
1 parent a1e95a6 commit f18d190

File tree

4 files changed

+149
-2
lines changed

4 files changed

+149
-2
lines changed

‎deployment/live/gcp/test/README.md

Lines changed: 83 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
## Prerequisites
44
You'll need to have a VM running in the same GCP project that you can SSH to,
5-
with Go installed.
5+
with Go installed, and your favourite terminal multiplexer.
66

77
## Overview
88

@@ -35,8 +35,89 @@ Terraforming the project can be done by:
3535
2. Run `terragrunt apply`
3636

3737
## Run the SCTFE
38+
### With fake chains
3839

39-
On the VM, run the following command:
40+
On the VM, run the following command to bring up the SCTFE:
4041
```bash
4142
go run ./cmd/gcp/ --project_id=${GOOGLE_PROJECT} --bucket=${GOOGLE_PROJECT}-${TESSERA_BASE_NAME}-bucket --spanner_db_path=projects/${GOOGLE_PROJECT}/instances/${TESSERA_BASE_NAME}/databases/${TESSERA_BASE_NAME}-db --spanner_db_path=projects/${GOOGLE_PROJECT}/instances/${TESSERA_BASE_NAME}/databases/${TESSERA_BASE_NAME}-dedup-db --private_key=./testdata/ct-http-server.privkey.pem --password=dirk --roots_pem_file=./testdata/fake-ca.cert --origin=${TESSERA_BASE_NAME}
4243
```
44+
45+
In a different terminal you can either mint and submit certificates manually, or
46+
use the [ct_hammer
47+
tool](https://github.com/google/certificate-transparency-go/blob/master/trillian/integration/ct_hammer/main.go)
48+
to do this.
49+
50+
#### Generate chains manually
51+
First, save the SCTFE repo's path:
52+
53+
```bash
54+
export SCTFE_REPO=$(pwd)
55+
```
56+
57+
Clone the [certificate-transparency-go](https://github.com/google/certificate-transparency-go) repo.
58+
Then, generate a chain manually. The password for the private key is `gently`:
59+
60+
```bash
61+
mkdir -p /tmp/httpschain
62+
openssl genrsa -out /tmp/httpschain/cert.key 2048
63+
openssl req -new -key /tmp/httpschain/cert.key -out /tmp/httpschain/cert.csr -config=${SCTFE_REPO}/testdata/fake-ca.cfg
64+
openssl x509 -req -days 3650 -in /tmp/httpschain/cert.csr -CAkey ${SCTFE_REPO}/testdata/fake-ca.privkey.pem -CA ${SCTFE_REPO}/testdata/fake-ca.cert -outform pem -out /tmp/httpschain/chain.pem -provider legacy -provider default
65+
cat ${SCTFE_REPO}/testdata/fake-ca.cert >> /tmp/httpschain/chain.pem
66+
```
67+
68+
Finally, submit the chain to the SCTFE:
69+
70+
```bash
71+
go run ./client/ctclient upload --cert_chain=/tmp/httpschain/chain.pem --skip_https_verify --log_uri=http://localhost:6962/${TESSERA_BASE_NAME}
72+
```
73+
74+
#### Automatically generate chains
75+
Save the SCTFE repo's path:
76+
77+
```bash
78+
export SCTFE_REPO=$(pwd)
79+
```
80+
81+
Clone the [certificate-transparency-go](https://github.com/google/certificate-transparency-go) repo, and from there run:
82+
83+
```bash
84+
go run ./trillian/integration/ct_hammer/ --ct_http_servers=localhost:6962/${TESSERA_BASE_NAME} --max_retry=2m --invalid_chance=0 --get_sth=0 --get_sth_consistency=0 --get_proof_by_hash=0 --get_entries=0 --get_roots=0 --get_entry_and_proof=0 --max_parallel_chains=4 --skip_https_verify=true --operations=10000 --rate_limit=150 --log_config=${SCTFE_REPO}/testdata/hammer.cfg --testdata_dir=./trillian/testdata/
85+
```
86+
87+
### With real HTTPS certificates
88+
We'll run a SCTFE and copy certificates from an existing RFC6962 log to it.
89+
It uses the [ct_hammer tool from certificate-transparency-go](https://github.com/google/certificate-transparency-go/tree/aceb1d4481907b00c087020a3930c7bd691a0110/trillian/integration/ct_hammer).
90+
91+
First, set a few environment variables:
92+
93+
```bash
94+
export SCTFE_REPO=$(pwd)
95+
export SRC_LOG_URI=https://ct.googleapis.com/logs/xenon2022
96+
```
97+
98+
Then, get fetch the roots the source logs accepts, and edit configs accordingly.
99+
To do so, clone the [certificate-transparency-go](https://github.com/google/certificate-transparency-go) repo, and from there run:
100+
101+
```bash
102+
export CTGO_REPO=$(pwd)
103+
mkdir -p /tmp/hammercfg
104+
cp ${SCTFE_REPO}/testdata/hammer.cfg /tmp/hammercfg
105+
go run ./client/ctclient get-roots --log_uri=${SRC_LOG_URI} --text=false > /tmp/hammercfg/roots.pem
106+
sed -i 's-""-"/tmp/hammercfg/roots.pem"-g' /tmp/hammercfg/hammer.cfg
107+
```
108+
109+
110+
Run the SCTFE with the same roots:
111+
112+
```bash
113+
cd ${SCTFE_REPO}
114+
go run ./cmd/gcp/ --project_id=${GOOGLE_PROJECT} --bucket=${GOOGLE_PROJECT}-${TESSERA_BASE_NAME}-bucket --spanner_db_path=projects/${GOOGLE_PROJECT}/instances/${TESSERA_BASE_NAME}/databases/${TESSERA_BASE_NAME}-db --private_key=./testdata/ct-http-server.privkey.pem --password=dirk --roots_pem_file=/tmp/hammercfg/roots.pem --origin=${TESSERA_BASE_NAME} --spanner_dedup_db_path=projects/${GOOGLE_PROJECT}/instances/${TESSERA_BASE_NAME}/databases/${TESSERA_BASE_NAME}-dedup-db -v=3
115+
```
116+
117+
Run `ct_hammer` in a different terminal:
118+
119+
```bash
120+
cd ${CTGO_REPO}
121+
go run ./trillian/integration/ct_hammer/ --ct_http_servers=localhost:6962/${TESSERA_BASE_NAME} --max_retry=2m --invalid_chance=0 --get_sth=0 --get_sth_consistency=0 --get_proof_by_hash=0 --get_entries=0 --get_roots=0 --get_entry_and_proof=0 --max_parallel_chains=4 --skip_https_verify=true --operations=10000 --rate_limit=150 --log_config=/tmp/hammercfg/hammer.cfg --src_log_uri=${SRC_LOG_URI}
122+
```
123+

‎testdata/fake-ca.cfg

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# OpenSSL configuration file.
2+
3+
[ req ]
4+
# Options for the `req` tool (`man req`).
5+
default_bits = 2048
6+
distinguished_name = req_distinguished_name
7+
prompt = no
8+
# SHA-1 is deprecated, so use SHA-2 instead.
9+
default_md = sha256
10+
# Extension to add when the -x509 option is used.
11+
x509_extensions = v3_ca
12+
# Try to force use of PrintableString throughout
13+
string_mask = pkix
14+
15+
[ req_distinguished_name ]
16+
C=GB
17+
ST=London
18+
L=London
19+
O=Google
20+
OU=Eng
21+
CN=FakeCertificateAuthority
22+
23+
[ v3_ca ]
24+
subjectKeyIdentifier = 01020304
25+
authorityKeyIdentifier = keyid:always,issuer
26+
basicConstraints = critical, CA:true, pathlen:10
27+
keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly
28+
29+
[ v3_int_ca ]
30+
subjectKeyIdentifier = 05060708
31+
authorityKeyIdentifier = keyid:always,issuer
32+
basicConstraints = critical, CA:true, pathlen:0
33+
keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly
34+
extendedKeyUsage = serverAuth,clientAuth
35+
36+
[ v3_int_ca_pair ]
37+
subjectKeyIdentifier = 0a0b0c0d
38+
authorityKeyIdentifier = keyid:always,issuer
39+
basicConstraints = critical, CA:true
40+
keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly
41+
extendedKeyUsage = serverAuth,clientAuth
42+
43+
[ v3_ca1 ]
44+
subjectKeyIdentifier = 11121314
45+
authorityKeyIdentifier = keyid:always,issuer
46+
basicConstraints = critical, CA:true, pathlen:10
47+
keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly
48+
49+
[ v3_user ]
50+
subjectKeyIdentifier = hash
51+
authorityKeyIdentifier = keyid:always,issuer
52+
keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, encipherOnly, decipherOnly

‎testdata/fake-ca.privkey.pem

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
-----BEGIN EC PRIVATE KEY-----
2+
Proc-Type: 4,ENCRYPTED
3+
DEK-Info: DES-CBC,53C67AA311B73ED1
4+
5+
UgdxD/ThmtBjRklM1aU8qxCM3yvVYrl4NzudKE4NCQjYR7u0OhE3OD6XShPghtRU
6+
RM8ekP81zIPEUS6H/V5ysbwDtwibQ4/kw85lOVEoNdqDCMV++M3aEFiV8RA0hj+q
7+
x8ANosBgtEVsbC1LwOk0/yrvUFucrp5FuHSxJ3//9iI=
8+
-----END EC PRIVATE KEY-----

‎testdata/hammer.cfg

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
config {
2+
roots_pem_file: ""
3+
public_key: {
4+
der: "0Y0\x13\x06\x07*\x86H\xce=\x02\x01\x06\b*\x86H\xce=\x03\x01\x07\x03B\0\x04\x07\xf8Q\xaf\xaa\x8cV\x83\x901\xb7\x80\xe3\xd6\x1a\xf7/6\x06q\xec\xdd;\xbe~6o\r\x1c\x1c`\x0b\x7f\xf5\x9f\xff\xe5$I4V\xf2K\x10_\xbf\b\x1f\xf9\x0e\xcf5\xb5\x8a\x8a\x8b0\nT\xb7\xbf\x1dM\xb9"
5+
}
6+
}

0 commit comments

Comments
 (0)