Skip to content

ca: unsplit issuance flow #8014

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 11 commits into from
Feb 24, 2025
Merged

ca: unsplit issuance flow #8014

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
e9ed283
connect the dots
jsha Feb 12, 2025
f9616ea
more dots
jsha Feb 14, 2025
1914c23
Restore some of ra.go and turn on feature
jsha Feb 14, 2025
ff6c898
fix tests
jsha Feb 14, 2025
54b7ec2
small updates
jsha Feb 14, 2025
f05e215
Update test
jsha Feb 14, 2025
95afcf2
Revert startservers.py
jsha Feb 15, 2025
f29453e
Review feedback
jsha Feb 18, 2025
8d0db46
Review feedback
jsha Feb 19, 2025
97dab3d
Split out sct-provider service
jsha Feb 19, 2025
33e4a61
Two backends and a dependency
jsha Feb 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 40 additions & 1 deletion ca/ca.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ import (
"github.com/letsencrypt/boulder/issuance"
"github.com/letsencrypt/boulder/linter"
blog "github.com/letsencrypt/boulder/log"
rapb "github.com/letsencrypt/boulder/ra/proto"
sapb "github.com/letsencrypt/boulder/sa/proto"
)

Expand Down Expand Up @@ -99,6 +100,7 @@ type caMetrics struct {
signatureCount *prometheus.CounterVec
signErrorCount *prometheus.CounterVec
lintErrorCount prometheus.Counter
certificates *prometheus.CounterVec
}

func NewCAMetrics(stats prometheus.Registerer) *caMetrics {
Expand All @@ -123,7 +125,15 @@ func NewCAMetrics(stats prometheus.Registerer) *caMetrics {
})
stats.MustRegister(lintErrorCount)

return &caMetrics{signatureCount, signErrorCount, lintErrorCount}
certificates := prometheus.NewCounterVec(
prometheus.CounterOpts{
Name: "certificates",
Help: "Number of certificates issued",
},
[]string{"profile"})
stats.MustRegister(certificates)

return &caMetrics{signatureCount, signErrorCount, lintErrorCount, certificates}
}

func (m *caMetrics) noteSignError(err error) {
Expand All @@ -138,6 +148,7 @@ func (m *caMetrics) noteSignError(err error) {
type certificateAuthorityImpl struct {
capb.UnsafeCertificateAuthorityServer
sa sapb.StorageAuthorityCertificateClient
sctClient rapb.SCTProviderClient
pa core.PolicyAuthority
issuers issuerMaps
certProfiles certProfilesMaps
Expand Down Expand Up @@ -227,6 +238,7 @@ func makeCertificateProfilesMap(profiles map[string]*issuance.ProfileConfigNew)
// OCSP (via delegation to an ocspImpl and its issuers).
func NewCertificateAuthorityImpl(
sa sapb.StorageAuthorityCertificateClient,
sctService rapb.SCTProviderClient,
pa core.PolicyAuthority,
boulderIssuers []*issuance.Issuer,
certificateProfiles map[string]*issuance.ProfileConfigNew,
Expand Down Expand Up @@ -261,6 +273,7 @@ func NewCertificateAuthorityImpl(

ca = &certificateAuthorityImpl{
sa: sa,
sctClient: sctService,
pa: pa,
issuers: issuers,
certProfiles: certProfiles,
Expand Down Expand Up @@ -343,6 +356,31 @@ func (ca *certificateAuthorityImpl) IssuePrecertificate(ctx context.Context, iss
}, nil
}

func (ca *certificateAuthorityImpl) IssueCertificate(ctx context.Context, issueReq *capb.IssueCertificateRequest) (*capb.IssueCertificateResponse, error) {
if ca.sctClient == nil {
return nil, errors.New("IssueCertificate called with a nil SCT service")
}
precert, err := ca.IssuePrecertificate(ctx, issueReq)
if err != nil {
return nil, err
}
scts, err := ca.sctClient.GetSCTs(ctx, &rapb.SCTRequest{PrecertDER: precert.DER})
if err != nil {
return nil, err
}
cert, err := ca.IssueCertificateForPrecertificate(ctx, &capb.IssueCertificateForPrecertificateRequest{
DER: precert.DER,
SCTs: scts.SctDER,
RegistrationID: issueReq.RegistrationID,
OrderID: issueReq.OrderID,
CertProfileHash: precert.CertProfileHash,
})
if err != nil {
return nil, err
}
return &capb.IssueCertificateResponse{DER: cert.Der}, nil
}

// IssueCertificateForPrecertificate final step in the [issuance cycle].
//
// Given a precertificate and a set of SCTs for that precertificate, it generates
Expand Down Expand Up @@ -453,6 +491,7 @@ func (ca *certificateAuthorityImpl) IssueCertificateForPrecertificate(ctx contex
}

ca.metrics.signatureCount.With(prometheus.Labels{"purpose": string(certType), "issuer": issuer.Name()}).Inc()
ca.metrics.certificates.With(prometheus.Labels{"profile": certProfile.name}).Inc()
logEvent.Result.Certificate = hex.EncodeToString(certDER)
ca.log.AuditObject("Signing cert success", logEvent)

Expand Down
26 changes: 25 additions & 1 deletion ca/ca_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ import (
"github.com/letsencrypt/boulder/metrics"
"github.com/letsencrypt/boulder/must"
"github.com/letsencrypt/boulder/policy"
rapb "github.com/letsencrypt/boulder/ra/proto"
sapb "github.com/letsencrypt/boulder/sa/proto"
"github.com/letsencrypt/boulder/test"
)
Expand Down Expand Up @@ -204,7 +205,12 @@ func setup(t *testing.T) *testCtx {
Name: "lint_errors",
Help: "Number of issuances that were halted by linting errors",
})
cametrics := &caMetrics{signatureCount, signErrorCount, lintErrorCount}
certificatesCount := prometheus.NewCounterVec(
prometheus.CounterOpts{
Name: "certificates",
Help: "Number of certificates issued",
}, []string{"profile"})
cametrics := &caMetrics{signatureCount, signErrorCount, lintErrorCount, certificatesCount}

ocsp, err := NewOCSPImpl(
boulderIssuers,
Expand Down Expand Up @@ -254,6 +260,7 @@ func TestSerialPrefix(t *testing.T) {
nil,
nil,
nil,
nil,
0x00,
testCtx.maxNames,
testCtx.keyPolicy,
Expand All @@ -267,6 +274,7 @@ func TestSerialPrefix(t *testing.T) {
nil,
nil,
nil,
nil,
0x80,
testCtx.maxNames,
testCtx.keyPolicy,
Expand Down Expand Up @@ -354,11 +362,18 @@ func TestIssuePrecertificate(t *testing.T) {
}
}

type mockSCTService struct{}

func (m mockSCTService) GetSCTs(ctx context.Context, sctRequest *rapb.SCTRequest, _ ...grpc.CallOption) (*rapb.SCTResponse, error) {
return &rapb.SCTResponse{}, nil
}

func issueCertificateSubTestSetup(t *testing.T) (*certificateAuthorityImpl, *mockSA) {
testCtx := setup(t)
sa := &mockSA{}
ca, err := NewCertificateAuthorityImpl(
sa,
mockSCTService{},
testCtx.pa,
testCtx.boulderIssuers,
testCtx.certProfiles,
Expand Down Expand Up @@ -397,6 +412,7 @@ func TestNoIssuers(t *testing.T) {
sa := &mockSA{}
_, err := NewCertificateAuthorityImpl(
sa,
mockSCTService{},
testCtx.pa,
nil, // No issuers
testCtx.certProfiles,
Expand All @@ -417,6 +433,7 @@ func TestMultipleIssuers(t *testing.T) {
sa := &mockSA{}
ca, err := NewCertificateAuthorityImpl(
sa,
mockSCTService{},
testCtx.pa,
testCtx.boulderIssuers,
testCtx.certProfiles,
Expand Down Expand Up @@ -486,6 +503,7 @@ func TestUnpredictableIssuance(t *testing.T) {

ca, err := NewCertificateAuthorityImpl(
sa,
mockSCTService{},
testCtx.pa,
boulderIssuers,
testCtx.certProfiles,
Expand Down Expand Up @@ -678,6 +696,7 @@ func TestInvalidCSRs(t *testing.T) {
sa := &mockSA{}
ca, err := NewCertificateAuthorityImpl(
sa,
mockSCTService{},
testCtx.pa,
testCtx.boulderIssuers,
testCtx.certProfiles,
Expand Down Expand Up @@ -716,6 +735,7 @@ func TestRejectValidityTooLong(t *testing.T) {

ca, err := NewCertificateAuthorityImpl(
&mockSA{},
mockSCTService{},
testCtx.pa,
testCtx.boulderIssuers,
testCtx.certProfiles,
Expand Down Expand Up @@ -808,6 +828,7 @@ func TestIssueCertificateForPrecertificate(t *testing.T) {
sa := &mockSA{}
ca, err := NewCertificateAuthorityImpl(
sa,
mockSCTService{},
testCtx.pa,
testCtx.boulderIssuers,
testCtx.certProfiles,
Expand Down Expand Up @@ -869,6 +890,7 @@ func TestIssueCertificateForPrecertificateWithSpecificCertificateProfile(t *test
sa := &mockSA{}
ca, err := NewCertificateAuthorityImpl(
sa,
mockSCTService{},
testCtx.pa,
testCtx.boulderIssuers,
testCtx.certProfiles,
Expand Down Expand Up @@ -984,6 +1006,7 @@ func TestIssueCertificateForPrecertificateDuplicateSerial(t *testing.T) {
sa := &dupeSA{}
ca, err := NewCertificateAuthorityImpl(
sa,
mockSCTService{},
testCtx.pa,
testCtx.boulderIssuers,
testCtx.certProfiles,
Expand Down Expand Up @@ -1026,6 +1049,7 @@ func TestIssueCertificateForPrecertificateDuplicateSerial(t *testing.T) {
errorsa := &getCertErrorSA{}
errorca, err := NewCertificateAuthorityImpl(
errorsa,
mockSCTService{},
testCtx.pa,
testCtx.boulderIssuers,
testCtx.certProfiles,
Expand Down
1 change: 1 addition & 0 deletions ca/ocsp_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ func TestOCSP(t *testing.T) {
testCtx := setup(t)
ca, err := NewCertificateAuthorityImpl(
&mockSA{},
mockSCTService{},
testCtx.pa,
testCtx.boulderIssuers,
testCtx.certProfiles,
Expand Down
Loading
Loading