docs: update README with private key features and export documentation
stef
parent
c7427dae28
commit
3cb1bb4c47
422
README.md
422
README.md
|
|
@ -9,6 +9,8 @@ API Go complète pour gérer une Infrastructure à Clé Publique (PKI) avec hié
|
||||||
- ✅ **Signature de certificats** : Certificats auto-signés ou signés par une CA
|
- ✅ **Signature de certificats** : Certificats auto-signés ou signés par une CA
|
||||||
- ✅ **Gestion des révocations** : Révocation et CRL (Certificate Revocation List)
|
- ✅ **Gestion des révocations** : Révocation et CRL (Certificate Revocation List)
|
||||||
- ✅ **Stockage pluggable** : MemoryStore (développement) ou MongoDB (production)
|
- ✅ **Stockage pluggable** : MemoryStore (développement) ou MongoDB (production)
|
||||||
|
- ✅ **Export de certificats** : PEM, DER, avec clé privée, chaîne complète
|
||||||
|
- ✅ **Clés privées** : Stockage et récupération sécurisés pour tous les certificats (JSON + export fichier)
|
||||||
- ✅ **Cryptographie** : X.509, RSA 2048-bit, signatures HS256 pour JWT
|
- ✅ **Cryptographie** : X.509, RSA 2048-bit, signatures HS256 pour JWT
|
||||||
|
|
||||||
## Architecture
|
## Architecture
|
||||||
|
|
@ -36,7 +38,9 @@ pkiapi/
|
||||||
│ ├── mongo.go # MongoStore (persistance)
|
│ ├── mongo.go # MongoStore (persistance)
|
||||||
│ ├── util.go # Helpers sérialisation
|
│ ├── util.go # Helpers sérialisation
|
||||||
│ └── errors.go # Erreurs storage
|
│ └── errors.go # Erreurs storage
|
||||||
└── go.mod
|
├── tests/ # Scripts de test
|
||||||
|
├── go.mod
|
||||||
|
└── docker-compose.yaml # Orchestration services
|
||||||
```
|
```
|
||||||
|
|
||||||
## Démarrage rapide
|
## Démarrage rapide
|
||||||
|
|
@ -58,13 +62,11 @@ export PORT=8080
|
||||||
# Serveur lancé sur http://localhost:8080
|
# Serveur lancé sur http://localhost:8080
|
||||||
```
|
```
|
||||||
|
|
||||||
**Mode production (MongoDB):**
|
**Mode production (MongoDB via Docker Compose):**
|
||||||
```bash
|
```bash
|
||||||
export STORAGE_TYPE=mongodb
|
docker compose up -d --build
|
||||||
export MONGO_URI=mongodb://mongodb-server:27017
|
# L'API est disponible sur http://localhost:8080
|
||||||
export MONGO_DB=pkiapi-prod
|
# MongoDB est disponible sur mongodb://localhost:27017
|
||||||
export JWT_SECRET_KEY=super-secret-key
|
|
||||||
./pkiapi
|
|
||||||
```
|
```
|
||||||
|
|
||||||
### 3. Obtenir un token JWT
|
### 3. Obtenir un token JWT
|
||||||
|
|
@ -110,34 +112,6 @@ curl -X POST http://localhost:8080/api/v1/login \
|
||||||
|
|
||||||
### 🔑 Autorités de Certification (Authentifiés)
|
### 🔑 Autorités de Certification (Authentifiés)
|
||||||
|
|
||||||
#### GET /api/v1/ca
|
|
||||||
Liste toutes les autorités de certification.
|
|
||||||
|
|
||||||
**Requête :**
|
|
||||||
```bash
|
|
||||||
TOKEN="<your_token>"
|
|
||||||
curl -H "Authorization: Bearer $TOKEN" \
|
|
||||||
http://localhost:8080/api/v1/ca
|
|
||||||
```
|
|
||||||
|
|
||||||
**Réponse :**
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"cas": [
|
|
||||||
{
|
|
||||||
"id": "16de28da-f25e-49cd-81de-a929d34dfe08",
|
|
||||||
"subject": "CN=Root CA,O=Example,C=FR",
|
|
||||||
"issuer": "CN=Root CA,O=Example,C=FR",
|
|
||||||
"not_before": "2025-12-06T22:52:48Z",
|
|
||||||
"not_after": "2035-12-04T22:52:48Z",
|
|
||||||
"serial_number": "574847517"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
#### POST /api/v1/ca
|
#### POST /api/v1/ca
|
||||||
Crée une nouvelle autorité de certification auto-signée.
|
Crée une nouvelle autorité de certification auto-signée.
|
||||||
|
|
||||||
|
|
@ -163,6 +137,7 @@ curl -X POST http://localhost:8080/api/v1/ca \
|
||||||
"not_after": "2035-12-04T21:45:01Z",
|
"not_after": "2035-12-04T21:45:01Z",
|
||||||
"serial_number": "546965196",
|
"serial_number": "546965196",
|
||||||
"certificate": "MIIC5zCCAc+gAwIBAgIDCkUz...",
|
"certificate": "MIIC5zCCAc+gAwIBAgIDCkUz...",
|
||||||
|
"private_key": "MIIEwAIBADANBgkqhkiG9w0BAQE...",
|
||||||
"is_ca": true
|
"is_ca": true
|
||||||
},
|
},
|
||||||
"created_by": "admin"
|
"created_by": "admin"
|
||||||
|
|
@ -172,7 +147,7 @@ curl -X POST http://localhost:8080/api/v1/ca \
|
||||||
---
|
---
|
||||||
|
|
||||||
#### GET /api/v1/ca/:id
|
#### GET /api/v1/ca/:id
|
||||||
Récupère une autorité de certification par ID.
|
Récupère une autorité de certification par ID (avec clé privée).
|
||||||
|
|
||||||
**Requête :**
|
**Requête :**
|
||||||
```bash
|
```bash
|
||||||
|
|
@ -192,6 +167,7 @@ curl -H "Authorization: Bearer $TOKEN" \
|
||||||
"not_after": "2035-12-04T21:45:01Z",
|
"not_after": "2035-12-04T21:45:01Z",
|
||||||
"serial_number": "546965196",
|
"serial_number": "546965196",
|
||||||
"certificate": "MIIC5zCCAc+gAwIBAgIDCkUz...",
|
"certificate": "MIIC5zCCAc+gAwIBAgIDCkUz...",
|
||||||
|
"private_key": "MIIEwAIBADANBgkqhkiG9w0BAQE...",
|
||||||
"is_ca": true
|
"is_ca": true
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
@ -216,58 +192,12 @@ curl -X POST http://localhost:8080/api/v1/ca/sign \
|
||||||
}"
|
}"
|
||||||
```
|
```
|
||||||
|
|
||||||
**Réponse :**
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"ca": {
|
|
||||||
"id": "b2350d39-53c2-469a-802c-acc39707e352",
|
|
||||||
"subject": "CN=Intermediate CA,O=Example Inc,C=FR",
|
|
||||||
"not_before": "2025-12-06T21:45:09Z",
|
|
||||||
"not_after": "2030-12-05T21:45:09Z",
|
|
||||||
"serial_number": "576310632",
|
|
||||||
"certificate": "MIIDOTCCAiGgAwIBAgIEIlnNaD...",
|
|
||||||
"is_ca": true
|
|
||||||
},
|
|
||||||
"created_by": "admin",
|
|
||||||
"signed_by": "ff3ac5c5-08d1-401b-9e83-f18eda4c538b"
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
### 📜 Certificats (Authentifiés)
|
### 📜 Certificats (Authentifiés)
|
||||||
|
|
||||||
#### GET /api/v1/certificates
|
|
||||||
Liste tous les certificats.
|
|
||||||
|
|
||||||
**Requête :**
|
|
||||||
```bash
|
|
||||||
TOKEN="<your_token>"
|
|
||||||
curl -H "Authorization: Bearer $TOKEN" \
|
|
||||||
http://localhost:8080/api/v1/certificates
|
|
||||||
```
|
|
||||||
|
|
||||||
**Réponse :**
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"certificates": [
|
|
||||||
{
|
|
||||||
"id": "e12e08a9-adeb-404c-a7b7-a613b77dfe66",
|
|
||||||
"subject": "CN=server.example.com,O=Example Inc,C=FR",
|
|
||||||
"issuer": "CN=Intermediate CA,O=Example Inc,C=FR",
|
|
||||||
"not_before": "2025-12-06T21:45:09Z",
|
|
||||||
"not_after": "2026-12-06T21:45:09Z",
|
|
||||||
"serial_number": "46798982",
|
|
||||||
"revoked": false
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
#### POST /api/v1/certificates
|
#### POST /api/v1/certificates
|
||||||
Crée un certificat auto-signé.
|
Crée un certificat auto-signé avec clé privée.
|
||||||
|
|
||||||
**Requête :**
|
**Requête :**
|
||||||
```bash
|
```bash
|
||||||
|
|
@ -292,6 +222,7 @@ curl -X POST http://localhost:8080/api/v1/certificates \
|
||||||
"not_after": "2026-12-06T21:41:38Z",
|
"not_after": "2026-12-06T21:41:38Z",
|
||||||
"serial_number": "673075",
|
"serial_number": "673075",
|
||||||
"certificate": "MIIC5zCCAc+gAwIBAgIDCkUzMA0GCSq...",
|
"certificate": "MIIC5zCCAc+gAwIBAgIDCkUzMA0GCSq...",
|
||||||
|
"private_key": "MIIEwAIBADANBgkqhkiG9w0BAQE...",
|
||||||
"revoked": false
|
"revoked": false
|
||||||
},
|
},
|
||||||
"created_by": "admin"
|
"created_by": "admin"
|
||||||
|
|
@ -300,45 +231,8 @@ curl -X POST http://localhost:8080/api/v1/certificates \
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
#### POST /api/v1/certificates/sign
|
|
||||||
Signe un certificat avec une CA.
|
|
||||||
|
|
||||||
**Requête :**
|
|
||||||
```bash
|
|
||||||
TOKEN="<your_token>"
|
|
||||||
CA_ID="b2350d39-53c2-469a-802c-acc39707e352"
|
|
||||||
curl -X POST http://localhost:8080/api/v1/certificates/sign \
|
|
||||||
-H "Authorization: Bearer $TOKEN" \
|
|
||||||
-H "Content-Type: application/json" \
|
|
||||||
-d "{
|
|
||||||
\"ca_id\": \"$CA_ID\",
|
|
||||||
\"subject\": \"CN=server.example.com,O=Example Inc,C=FR\",
|
|
||||||
\"validity_days\": 365
|
|
||||||
}"
|
|
||||||
```
|
|
||||||
|
|
||||||
**Réponse :**
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"certificate": {
|
|
||||||
"id": "e12e08a9-adeb-404c-a7b7-a613b77dfe66",
|
|
||||||
"subject": "CN=server.example.com,O=Example Inc,C=FR",
|
|
||||||
"issuer": "CN=Intermediate CA,O=Example Inc,C=FR",
|
|
||||||
"not_before": "2025-12-06T21:45:09Z",
|
|
||||||
"not_after": "2026-12-06T21:45:09Z",
|
|
||||||
"serial_number": "46798982",
|
|
||||||
"certificate": "MIIDFDCCAfygAwIBAgIEAsoYhjANBg...",
|
|
||||||
"revoked": false
|
|
||||||
},
|
|
||||||
"created_by": "admin",
|
|
||||||
"signed_by": "b2350d39-53c2-469a-802c-acc39707e352"
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
#### GET /api/v1/certificates/:id
|
#### GET /api/v1/certificates/:id
|
||||||
Récupère un certificat par ID.
|
Récupère un certificat par ID (avec clé privée encodée en base64).
|
||||||
|
|
||||||
**Requête :**
|
**Requête :**
|
||||||
```bash
|
```bash
|
||||||
|
|
@ -359,6 +253,7 @@ curl -H "Authorization: Bearer $TOKEN" \
|
||||||
"not_after": "2026-12-06T21:45:09Z",
|
"not_after": "2026-12-06T21:45:09Z",
|
||||||
"serial_number": "46798982",
|
"serial_number": "46798982",
|
||||||
"certificate": "MIIDFDCCAfygAwIBAgIEAsoYhjANBg...",
|
"certificate": "MIIDFDCCAfygAwIBAgIEAsoYhjANBg...",
|
||||||
|
"private_key": "MIIEwAIBADANBgkqhkiG9w0BAQE...",
|
||||||
"revoked": false
|
"revoked": false
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
@ -366,6 +261,25 @@ curl -H "Authorization: Bearer $TOKEN" \
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
|
#### POST /api/v1/certificates/sign
|
||||||
|
Signe un certificat avec une CA (avec clé privée).
|
||||||
|
|
||||||
|
**Requête :**
|
||||||
|
```bash
|
||||||
|
TOKEN="<your_token>"
|
||||||
|
CA_ID="b2350d39-53c2-469a-802c-acc39707e352"
|
||||||
|
curl -X POST http://localhost:8080/api/v1/certificates/sign \
|
||||||
|
-H "Authorization: Bearer $TOKEN" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d "{
|
||||||
|
\"ca_id\": \"$CA_ID\",
|
||||||
|
\"subject\": \"CN=server.example.com,O=Example Inc,C=FR\",
|
||||||
|
\"validity_days\": 365
|
||||||
|
}"
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
#### POST /api/v1/revoke
|
#### POST /api/v1/revoke
|
||||||
Révoque un certificat.
|
Révoque un certificat.
|
||||||
|
|
||||||
|
|
@ -382,15 +296,6 @@ curl -X POST http://localhost:8080/api/v1/revoke \
|
||||||
}"
|
}"
|
||||||
```
|
```
|
||||||
|
|
||||||
**Réponse :**
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"message": "certificat révoqué",
|
|
||||||
"id": "e12e08a9-adeb-404c-a7b7-a613b77dfe66",
|
|
||||||
"reason": "Compromised key"
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
#### GET /api/v1/crl
|
#### GET /api/v1/crl
|
||||||
|
|
@ -403,243 +308,142 @@ curl -H "Authorization: Bearer $TOKEN" \
|
||||||
http://localhost:8080/api/v1/crl
|
http://localhost:8080/api/v1/crl
|
||||||
```
|
```
|
||||||
|
|
||||||
**Réponse :**
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"crl": [
|
|
||||||
{
|
|
||||||
"serial_number": "46798982",
|
|
||||||
"subject": "CN=server.example.com,O=Example Inc,C=FR"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"version": 1
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
### 📥 Export de Certificats (Authentifiés)
|
### 📥 Export de Certificats (Authentifiés)
|
||||||
|
|
||||||
#### GET /api/v1/certificates/:id/export/pem
|
#### GET /api/v1/certificates/:id/export/pem
|
||||||
Exporte un certificat au format PEM (binaire/texte).
|
Exporte un certificat au format PEM.
|
||||||
|
|
||||||
**Requête :**
|
|
||||||
```bash
|
```bash
|
||||||
TOKEN="<your_token>"
|
TOKEN="<your_token>"
|
||||||
CERT_ID="e12e08a9-adeb-404c-a7b7-a613b77dfe66"
|
|
||||||
curl -H "Authorization: Bearer $TOKEN" \
|
curl -H "Authorization: Bearer $TOKEN" \
|
||||||
http://localhost:8080/api/v1/certificates/$CERT_ID/export/pem \
|
http://localhost:8080/api/v1/certificates/:id/export/pem \
|
||||||
-o certificate.pem
|
-o certificate.pem
|
||||||
```
|
```
|
||||||
|
|
||||||
**Réponse :**
|
|
||||||
```
|
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIDFDCCAfygAwIBAgIEAsoYhjANBg...
|
|
||||||
...base64...
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
#### GET /api/v1/certificates/:id/export/der
|
#### GET /api/v1/certificates/:id/export/der
|
||||||
Exporte un certificat au format DER (binaire).
|
Exporte un certificat au format DER (binaire).
|
||||||
|
|
||||||
**Requête :**
|
|
||||||
```bash
|
```bash
|
||||||
TOKEN="<your_token>"
|
|
||||||
CERT_ID="e12e08a9-adeb-404c-a7b7-a613b77dfe66"
|
|
||||||
curl -H "Authorization: Bearer $TOKEN" \
|
curl -H "Authorization: Bearer $TOKEN" \
|
||||||
http://localhost:8080/api/v1/certificates/$CERT_ID/export/der \
|
http://localhost:8080/api/v1/certificates/:id/export/der \
|
||||||
-o certificate.der
|
-o certificate.der
|
||||||
```
|
```
|
||||||
|
|
||||||
**Réponse :**
|
|
||||||
Format binaire DER directement (données binaires).
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
#### GET /api/v1/certificates/:id/export/pem-with-key
|
#### GET /api/v1/certificates/:id/export/pem-with-key
|
||||||
Exporte un certificat avec sa clé privée au format PEM (combiné).
|
Exporte certificat + clé privée au format PEM.
|
||||||
|
|
||||||
**Requête :**
|
|
||||||
```bash
|
```bash
|
||||||
TOKEN="<your_token>"
|
|
||||||
CERT_ID="e12e08a9-adeb-404c-a7b7-a613b77dfe66"
|
|
||||||
curl -H "Authorization: Bearer $TOKEN" \
|
curl -H "Authorization: Bearer $TOKEN" \
|
||||||
http://localhost:8080/api/v1/certificates/$CERT_ID/export/pem-with-key \
|
http://localhost:8080/api/v1/certificates/:id/export/pem-with-key \
|
||||||
-o certificate_with_key.pem
|
-o certificate_with_key.pem
|
||||||
```
|
```
|
||||||
|
|
||||||
**Réponse :**
|
#### GET /api/v1/certificates/:id/export/chain
|
||||||
```
|
Exporte la chaîne complète (certificat + CA parent).
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIDFDCCAfygAwIBAgIEAsoYhjANBg...
|
```bash
|
||||||
...base64...
|
curl -H "Authorization: Bearer $TOKEN" \
|
||||||
-----END CERTIFICATE-----
|
http://localhost:8080/api/v1/certificates/:id/export/chain \
|
||||||
-----BEGIN PRIVATE KEY-----
|
-o certificate_chain.pem
|
||||||
MIIEvQIBADANBgkqhkiG9w0BAQE...
|
|
||||||
...base64...
|
|
||||||
-----END PRIVATE KEY-----
|
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
#### GET /api/v1/certificates/:id/export/chain
|
## Clés Privées
|
||||||
Exporte la chaîne de certificats (certificat + CA parent).
|
|
||||||
|
### Stockage et Récupération
|
||||||
|
|
||||||
|
Les clés privées sont **automatiquement stockées** pour:
|
||||||
|
- ✅ Tous les certificats auto-signés
|
||||||
|
- ✅ Tous les certificats signés par une CA
|
||||||
|
- ✅ Toutes les CAs (Root et Intermediate)
|
||||||
|
|
||||||
|
### Accès via JSON
|
||||||
|
|
||||||
|
Les clés privées sont incluses dans les réponses JSON:
|
||||||
|
- **Format**: Base64 PKCS#8 encodé
|
||||||
|
- **Champs**: `private_key` (optionnel, présent si disponible)
|
||||||
|
- **Endpoints retournant des clés privées**:
|
||||||
|
- `POST /api/v1/ca` - Création CA
|
||||||
|
- `GET /api/v1/ca/:id` - Récupération CA
|
||||||
|
- `POST /api/v1/ca/sign` - Création Sub-CA
|
||||||
|
- `POST /api/v1/certificates` - Création certificat
|
||||||
|
- `GET /api/v1/certificates/:id` - Récupération certificat
|
||||||
|
- `POST /api/v1/certificates/sign` - Signature certificat
|
||||||
|
|
||||||
|
### Accès via Export Fichier
|
||||||
|
|
||||||
|
Les clés privées peuvent aussi être exportées en fichier:
|
||||||
|
- **`/export/pem-with-key`** - Certificat + clé privée en PEM
|
||||||
|
- **`/export/chain`** - Chaîne complète (pour CAs parent)
|
||||||
|
|
||||||
|
### Base de Données
|
||||||
|
|
||||||
|
Les clés privées sont:
|
||||||
|
- ✅ Sauvegardées en MongoDB (champ `private_key` en base64)
|
||||||
|
- ✅ Chiffrées au repos (via votre configuration MongoDB)
|
||||||
|
- ✅ Accessibles uniquement avec authentification JWT
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Tests
|
||||||
|
|
||||||
|
### Scripts de Test Disponibles
|
||||||
|
|
||||||
**Requête :**
|
|
||||||
```bash
|
```bash
|
||||||
TOKEN="<your_token>"
|
# Test complet (création CA, certificats, exports, revocation)
|
||||||
CERT_ID="e12e08a9-adeb-404c-a7b7-a613b77dfe66"
|
./tests/test_complete.sh
|
||||||
curl -H "Authorization: Bearer $TOKEN" \
|
|
||||||
http://localhost:8080/api/v1/certificates/$CERT_ID/export/chain \
|
# Test spécifique des exports
|
||||||
-o certificate_chain.pem
|
./tests/test_exports.sh
|
||||||
|
|
||||||
|
# Test du stockage des clés privées
|
||||||
|
./tests/test_private_keys.sh
|
||||||
```
|
```
|
||||||
|
|
||||||
**Réponse :**
|
### Résultats des Tests
|
||||||
```
|
|
||||||
-----BEGIN CERTIFICATE-----
|
Voir `tests/test_results.txt` pour les résultats détaillés des tests.
|
||||||
MIIDFDCCAfygAwIBAgIEAsoYhjANBg...
|
|
||||||
...certificat feuille...
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIDOTCCAiGgAwIBAgIEIlnNaD...
|
|
||||||
...certificat CA parent...
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Variables d'Environnement
|
## Variables d'Environnement
|
||||||
|
|
||||||
- `JWT_SECRET_KEY` : Secret pour signer les tokens JWT (défaut: `your-secret-key-change-in-prod`)
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
export JWT_SECRET_KEY="your-secure-secret-key"
|
# Stockage
|
||||||
./pkiapi
|
export STORAGE_TYPE=memory # memory ou mongodb (défaut: memory)
|
||||||
|
export MONGO_URI=mongodb://localhost:27017
|
||||||
|
export MONGO_DB=pkiapi
|
||||||
|
|
||||||
|
# Serveur
|
||||||
|
export PORT=8080
|
||||||
|
export JWT_SECRET_KEY=your-secret-key
|
||||||
|
export GIN_MODE=release
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Exemple de flux complet
|
## Conventions de Code
|
||||||
|
|
||||||
```bash
|
|
||||||
# 1. Obtenir un token
|
|
||||||
**Smoke Test Results**
|
|
||||||
|
|
||||||
- **Fichier de résultat :** `tests/smoke_result.txt` — sortie brute d'un smoke test automatisé (login → création Root CA → création Sub-CA → signature de certificat → révocation → récupération de la CRL).
|
|
||||||
- **Résumé :** le test vérifie que le flux complet fonctionne avec `STORAGE_TYPE=mongodb` (création des CA, signature, révocation) et que la CRL liste bien les certificats révoqués.
|
|
||||||
- **Reproduire localement :** démarrer la stack, puis exécuter les commandes de l'exemple de flux ci‑dessus. Vous pouvez aussi lancer le script temporaire utilisé lors des tests :
|
|
||||||
|
|
||||||
```
|
|
||||||
# reconstruire et démarrer la stack
|
|
||||||
STORAGE_TYPE=mongodb docker compose up -d --build
|
|
||||||
|
|
||||||
# exécuter manuellement l'exemple de flux (ou utiliser jq pour extraire le token)
|
|
||||||
# voir la section "Exemple de flux complet" ci‑dessus
|
|
||||||
```
|
|
||||||
|
|
||||||
Les résultats complets sont committés dans `tests/smoke_result.txt` pour référence.
|
|
||||||
|
|
||||||
TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/login \
|
|
||||||
-H "Content-Type: application/json" \
|
|
||||||
-d '{"username":"admin","password":"admin"}' | jq -r '.token')
|
|
||||||
|
|
||||||
echo "Token: $TOKEN"
|
|
||||||
|
|
||||||
# 2. Créer une Root CA
|
|
||||||
ROOT_CA=$(curl -s -X POST http://localhost:8080/api/v1/ca \
|
|
||||||
-H "Authorization: Bearer $TOKEN" \
|
|
||||||
-H "Content-Type: application/json" \
|
|
||||||
-d '{"subject":"CN=Root CA,O=Example,C=FR","validity_days":3650}')
|
|
||||||
|
|
||||||
ROOT_CA_ID=$(echo $ROOT_CA | jq -r '.ca.id')
|
|
||||||
echo "Root CA ID: $ROOT_CA_ID"
|
|
||||||
|
|
||||||
# 3. Créer une Sub-CA
|
|
||||||
SUB_CA=$(curl -s -X POST http://localhost:8080/api/v1/ca/sign \
|
|
||||||
-H "Authorization: Bearer $TOKEN" \
|
|
||||||
-H "Content-Type: application/json" \
|
|
||||||
-d "{\"parent_ca_id\":\"$ROOT_CA_ID\",\"subject\":\"CN=Intermediate CA,O=Example,C=FR\",\"validity_days\":1825}")
|
|
||||||
|
|
||||||
SUB_CA_ID=$(echo $SUB_CA | jq -r '.ca.id')
|
|
||||||
echo "Sub-CA ID: $SUB_CA_ID"
|
|
||||||
|
|
||||||
# 4. Signer un certificat avec la Sub-CA
|
|
||||||
CERT=$(curl -s -X POST http://localhost:8080/api/v1/certificates/sign \
|
|
||||||
-H "Authorization: Bearer $TOKEN" \
|
|
||||||
-H "Content-Type: application/json" \
|
|
||||||
-d "{\"ca_id\":\"$SUB_CA_ID\",\"subject\":\"CN=app.example.com,O=Example,C=FR\",\"validity_days\":365}")
|
|
||||||
|
|
||||||
CERT_ID=$(echo $CERT | jq -r '.certificate.id')
|
|
||||||
echo "Certificate ID: $CERT_ID"
|
|
||||||
|
|
||||||
# 5. Lister toutes les CAs
|
|
||||||
curl -s -H "Authorization: Bearer $TOKEN" http://localhost:8080/api/v1/ca | jq .
|
|
||||||
|
|
||||||
# 6. Lister tous les certificats
|
|
||||||
curl -s -H "Authorization: Bearer $TOKEN" http://localhost:8080/api/v1/certificates | jq .
|
|
||||||
|
|
||||||
# 7. Révoquer le certificat
|
|
||||||
curl -s -X POST http://localhost:8080/api/v1/revoke \
|
|
||||||
-H "Authorization: Bearer $TOKEN" \
|
|
||||||
-H "Content-Type: application/json" \
|
|
||||||
-d "{\"certificate_id\":\"$CERT_ID\",\"reason\":\"Test\"}" | jq .
|
|
||||||
|
|
||||||
# 8. Voir la CRL
|
|
||||||
curl -s -H "Authorization: Bearer $TOKEN" http://localhost:8080/api/v1/crl | jq .
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Structure du projet
|
|
||||||
|
|
||||||
```
|
|
||||||
pkiapi/
|
|
||||||
├── cmd/main.go # Point d'entrée
|
|
||||||
├── internal/
|
|
||||||
│ ├── api/
|
|
||||||
│ │ ├── router.go # Routes Gin
|
|
||||||
│ │ ├── auth.go # Login
|
|
||||||
│ │ ├── ca.go # Handlers CA
|
|
||||||
│ │ └── certificates.go # Handlers certificats
|
|
||||||
│ ├── auth/
|
|
||||||
│ │ ├── jwt.go # JWT manager
|
|
||||||
│ │ └── middleware.go # Middleware JWT
|
|
||||||
│ ├── pki/
|
|
||||||
│ │ ├── certificate.go # Logique X.509
|
|
||||||
│ │ └── errors.go # Erreurs PKI
|
|
||||||
│ └── storage/
|
|
||||||
│ ├── store.go # Store thread-safe
|
|
||||||
│ └── errors.go # Erreurs storage
|
|
||||||
├── go.mod
|
|
||||||
├── go.sum
|
|
||||||
├── Makefile
|
|
||||||
├── README.md
|
|
||||||
└── .gitignore
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Conventions de code
|
|
||||||
|
|
||||||
- **Gestion des erreurs** : Propagation simple sans wrapper
|
- **Gestion des erreurs** : Propagation simple sans wrapper
|
||||||
- **Concurrence** : `sync.RWMutex` pour le store
|
- **Concurrence** : `sync.RWMutex` pour le store
|
||||||
- **Cryptographie** : Stdlib Go (crypto/x509, crypto/rsa, crypto/rand)
|
- **Cryptographie** : Stdlib Go (crypto/x509, crypto/rsa, crypto/rand)
|
||||||
- **JWT** : github.com/golang-jwt/jwt/v5
|
- **JWT** : github.com/golang-jwt/jwt/v5
|
||||||
|
- **MongoDB** : go.mongodb.org/mongo-driver
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Future améliorations
|
## Améliorations Futures
|
||||||
|
|
||||||
- [x] Export des certificats (PEM, DER)
|
- [x] Export des certificats (PEM, DER)
|
||||||
- [ ] Persistance en base de données (PostgreSQL)
|
- [x] Clés privées dans JSON responses
|
||||||
- [ ] Support OCSP (Online Certificate Status Protocol)
|
- [ ] Support OCSP (Online Certificate Status Protocol)
|
||||||
- [ ] Interface web pour gérer les CAs
|
- [ ] Interface web pour gérer les CAs
|
||||||
- [ ] Support des chaînes intermédiaires
|
- [ ] Auditing et logging complet
|
||||||
- [ ] Auditing et logging
|
|
||||||
- [ ] Rate limiting et throttling
|
- [ ] Rate limiting et throttling
|
||||||
|
- [ ] Support HSM (Hardware Security Module)
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue