Skip to content

Story #15211: Cleaning PKI. #3509

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
GiooDev wants to merge 18 commits into
base: develop
Choose a base branch
from
+959 −1,017
Draft

Story #15211: Cleaning PKI. #3509

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
53c93f3
Story #15211: Cleaning PKI.
GiooDev Jan 23, 2026
fc64afb
Story #15211: Cleaning truststore and configuration.
GiooDev Jan 26, 2026
cdafda1
Story #15211: Keep cleaning.
GiooDev Jan 26, 2026
38d4d90
Story #15211: Adding consul DNS resolution for UI and Updating upstre…
GiooDev Jan 26, 2026
e501137
Story #15211: Trying to update nginx configuration without upstream.
GiooDev Jan 26, 2026
281920f
Story #15211: Keep trying with more ssl configuration.
GiooDev Jan 26, 2026
059c208
Story #15211: Try with dedicated client and server certificates confi…
GiooDev Jan 26, 2026
1a03e66
Story #15211: Disable pass for client certificates.
GiooDev Jan 26, 2026
216205d
Story #15211: Do not generate keystores for ui components.
GiooDev Jan 26, 2026
80edf60
Story #15211: Switch back to previous upstream configuration.
GiooDev Jan 27, 2026
8d9a0f2
Story #15211: Fixing cas-server resolution while starting.
GiooDev Jan 27, 2026
3773517
Story #15211: Trying without upstream.
GiooDev Jan 27, 2026
250c029
Story #15211: Rollback to upstream.
GiooDev Jan 27, 2026
a57e703
Story #15211: Keep elements commented for testing secured UI without …
GiooDev Jan 28, 2026
3fc50b4
Story #15211: Cleaning PKI scripts.
GiooDev Jan 28, 2026
e57457e
Story #15211: Migrate keystores and truststores from proprietary JKS …
GiooDev Jan 28, 2026
1dcff27
Story #15211: Renaming variables for keystores and truststores.
GiooDev Jan 28, 2026
cc8cc65
Story #15211: Remove useless keystores for UI components in dev-deplo…
GiooDev Jan 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions deployment/ansible-vitamui/app_api_gateway.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
vars:
vitamui_struct: "{{ vitamui.api_gateway }}"
vitamui_certificate_type: external
password_keystore_server: "{{ keystores_server_vitamui_services_api_gateway }}"
password_keystore_client: "{{ keystores_client_vitamui_services_api_gateway }}"
password_truststore: "{{ truststores_client_external }}"
password_keystore_server: "{{ keystore_server_vitamui_services_api_gateway }}"
password_keystore_client: "{{ keystore_client_vitamui_services_api_gateway }}"
password_truststore: "{{ truststore_client_external }}"
vitam_cert: "{{ vitam_certs.vitamui }}"
6 changes: 3 additions & 3 deletions deployment/ansible-vitamui/app_archive_search.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
vars:
vitamui_struct: "{{ vitamui.archive_search }}"
vitamui_certificate_type: external
password_keystore_server: "{{ keystores_server_vitamui_services_archive_search }}"
password_keystore_client: "{{ keystores_client_vitamui_services_archive_search }}"
password_truststore: "{{ truststores_client_external }}"
password_keystore_server: "{{ keystore_server_vitamui_services_archive_search }}"
password_keystore_client: "{{ keystore_client_vitamui_services_archive_search }}"
password_truststore: "{{ truststore_client_external }}"
vitam_cert: "{{ vitam_certs.vitamui }}"
6 changes: 3 additions & 3 deletions deployment/ansible-vitamui/app_collect.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
vars:
vitamui_struct: "{{ vitamui.collect }}"
vitamui_certificate_type: external
password_keystore_server: "{{ keystores_server_vitamui_services_collect }}"
password_keystore_client: "{{ keystores_client_vitamui_services_collect }}"
password_truststore: "{{ truststores_client_external }}"
password_keystore_server: "{{ keystore_server_vitamui_services_collect }}"
password_keystore_client: "{{ keystore_client_vitamui_services_collect }}"
password_truststore: "{{ truststore_client_external }}"
vitam_cert: "{{ vitam_certs.vitamui }}"
6 changes: 3 additions & 3 deletions deployment/ansible-vitamui/app_ingest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
vars:
vitamui_struct: "{{ vitamui.ingest }}"
vitamui_certificate_type: external
password_keystore_server: "{{ keystores_server_vitamui_services_ingest }}"
password_keystore_client: "{{ keystores_client_vitamui_services_ingest }}"
password_truststore: "{{ truststores_client_external }}"
password_keystore_server: "{{ keystore_server_vitamui_services_ingest }}"
password_keystore_client: "{{ keystore_client_vitamui_services_ingest }}"
password_truststore: "{{ truststore_client_external }}"
vitam_cert: "{{ vitam_certs.vitamui }}"
6 changes: 3 additions & 3 deletions deployment/ansible-vitamui/app_pastis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
vars:
vitamui_struct: "{{ vitamui.pastis }}"
vitamui_certificate_type: external
password_keystore_server: "{{ keystores_server_vitamui_services_pastis }}"
password_keystore_client: "{{ keystores_client_vitamui_services_pastis }}"
password_truststore: "{{ truststores_client_external }}"
password_keystore_server: "{{ keystore_server_vitamui_services_pastis }}"
password_keystore_client: "{{ keystore_client_vitamui_services_pastis }}"
password_truststore: "{{ truststore_client_external }}"
vitam_cert: "{{ vitam_certs.vitamui }}"
6 changes: 3 additions & 3 deletions deployment/ansible-vitamui/app_referential.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
vars:
vitamui_struct: "{{ vitamui.referential }}"
vitamui_certificate_type: external
password_keystore_server: "{{ keystores_server_vitamui_services_referential }}"
password_keystore_client: "{{ keystores_client_vitamui_services_referential }}"
password_truststore: "{{ truststores_client_external }}"
password_keystore_server: "{{ keystore_server_vitamui_services_referential }}"
password_keystore_client: "{{ keystore_client_vitamui_services_referential }}"
password_truststore: "{{ truststore_client_external }}"
vitam_cert: "{{ vitam_certs.vitamui }}"
16 changes: 8 additions & 8 deletions deployment/ansible-vitamui/vitamui_apps.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@
vars:
vitamui_struct: "{{ vitamui.security }}"
vitamui_certificate_type: server
password_keystore_server: "{{ keystores_server_vitamui_services_security }}"
password_truststore: "{{ truststores_vitamui }}"
password_keystore_server: "{{ keystore_server_vitamui_services_security }}"
password_truststore: "{{ truststore_vitamui }}"
tags: security

# External apps
Expand All @@ -22,9 +22,9 @@
vars:
vitamui_struct: "{{ vitamui.iam }}"
vitamui_certificate_type: external
password_keystore_server: "{{ keystores_server_vitamui_services_iam }}"
password_keystore_client: "{{ keystores_client_vitamui_services_iam }}"
password_truststore: "{{ truststores_client_external }}"
password_keystore_server: "{{ keystore_server_vitamui_services_iam }}"
password_keystore_client: "{{ keystore_client_vitamui_services_iam }}"
password_truststore: "{{ truststore_client_external }}"
vitam_cert: "{{ vitam_certs.vitamui }}"
tags: iam

Expand All @@ -37,7 +37,7 @@
vars:
vitamui_struct: "{{ vitamui.cas_server }}"
vitamui_certificate_type: external
password_keystore_server: "{{ keystores_server_vitamui_services_cas_server }}"
password_keystore_client: "{{ keystores_client_vitamui_services_cas_server }}"
password_truststore: "{{ truststores_client_external }}"
password_keystore_server: "{{ keystore_server_vitamui_services_cas_server }}"
password_keystore_client: "{{ keystore_client_vitamui_services_cas_server }}"
password_truststore: "{{ truststore_client_external }}"
tags: cas-server
10 changes: 5 additions & 5 deletions deployment/environments/group_vars/all/vitam_vars.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,18 +45,18 @@ vitam_vars:
vitam_certs:
vitamui:
filename: keystore_vitamui.p12
password: "{{ keystores_client_vitam_vitamui }}"
truststore_filename: truststore_vitam.jks
password_truststore: "{{ truststores_client_vitam }}"
password: "{{ keystore_client_vitam_vitamui }}"
truststore_filename: truststore_vitam.p12
password_truststore: "{{ truststore_client_vitam }}"


# Define connection settings for external / third-party Vitam instances (for COLLECT)
external_archiving_systems:

## Every external archiving system must have a unique id (only used alphanumeric chars, "_" or "-").
## Please ensure corresponding keystore/truststore files are provided :
## > environments/external_archiving_systems_keystores/keystore_<archiving_system_id>.jks
## > environments/external_archiving_systems_keystores/truststore_<archiving_system_id>.jks
## > environments/external_archiving_systems_keystores/keystore_<archiving_system_id>.p12
## > environments/external_archiving_systems_keystores/truststore_<archiving_system_id>.p12
## Please ensure keystore/truststore passwords are defined (in an ansible vault file):
## > external_archiving_systems.keystore_password.<archiving_system_id>: <changeme>
## > external_archiving_systems.truststore_password.<archiving_system_id>: <changeme>
Expand Down
9 changes: 9 additions & 0 deletions deployment/environments/group_vars/all/vitamui_vars.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,37 +66,46 @@ vitamui:
ui_identity:
vitamui_component: ui-identity
port_service: 8002
secure: false
Copy link
Contributor Author

@GiooDev GiooDev Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Si on laisse toutes les UI en secure: false (config par défaut, voir non configurable), on pourrait même se passer de leur générer un certificat server.

En effet, elles n'auraient plus besoin que d'un certificat client.

ui_identity_admin:
vitamui_component: ui-identity-admin
port_service: 8401
secure: false
package_name: vitamui-ui-identity-rsc
ui_referential:
vitamui_component: ui-referential
port_service: 8005
secure: false
ui_portal:
vitamui_component: ui-portal
port_service: 8003
secure: false
has_tenant_list: true
has_lang_selection: true
has_site_selection: false
ui_ingest:
vitamui_component: ui-ingest
port_service: 8008
secure: false
ui_archive_search:
vitamui_component: ui-archive-search
port_service: 8009
secure: false
ui_collect:
vitamui_component: ui-collect
port_service: 8010
secure: false
# offline_services: # Disables online search engines in collect
# - agencies
# - archive-unit-profiles
ui_pastis:
vitamui_component: ui-pastis
port_service: 9015
secure: false
ui_design_system:
vitamui_component: ui-design-system
port_service: 9016
secure: false

# Applications
api_gateway:
Expand Down
3 changes: 1 addition & 2 deletions deployment/pki/config/ca-config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ default_ca = ca_root

[ ca_root ]
dir = ./pki
certs = $dir/ca/client-external
certs = $dir/ca/${ENV::OPENSSL_CA_DIR}
new_certs_dir = $dir/tempcerts
database = $dir/config/${ENV::OPENSSL_CA_DIR}/index.txt
certificate = $dir/ca/${ENV::OPENSSL_CA_DIR}/ca-root.crt
Expand Down Expand Up @@ -44,7 +44,6 @@ O = vitamui
OU = authorities
CN = ${ENV::OPENSSL_CN}


# Certificates creation parameters : extensions

[ extension_ca_root ]
Expand Down
13 changes: 1 addition & 12 deletions deployment/pki/config/crt-config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ unique_subject = no
[ policy_match ]
countryName = match
stateOrProvinceName = match
localityName = match
localityName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
Expand All @@ -43,7 +43,6 @@ L = paris
O = vitamui
CN = ${ENV::OPENSSL_CN}


# Certificates creation parameters : extensions

[ extension_server ]
Expand All @@ -66,13 +65,3 @@ basicConstraints = critical,CA:FALSE
keyUsage = digitalSignature
nsCertType = client
extendedKeyUsage = clientAuth

[ extension_timestamping ]
nsComment = "Certificat Serveur SSL"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
issuerAltName = issuer:copy
basicConstraints = critical,CA:FALSE
keyUsage = digitalSignature, nonRepudiation
nsCertType = server
extendedKeyUsage = critical,timeStamping
5 changes: 2 additions & 3 deletions deployment/pki/scripts/generate_certs.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@ function generateCerts {
pki_logger "Génération des certificats serveurs"
# Zone interne
generateServerCertAndStorePassphrase security vitamui-services
generateServerAndClientCertAndStorePassphrase api-gateway vitamui-services

#Zone externe
generateServerAndClientCertAndStorePassphrase iam vitamui-services
Expand All @@ -33,6 +32,7 @@ function generateCerts {
generateServerAndClientCertAndStorePassphrase archive-search vitamui-services
generateServerAndClientCertAndStorePassphrase collect vitamui-services
generateServerAndClientCertAndStorePassphrase pastis vitamui-services
generateServerAndClientCertAndStorePassphrase api-gateway vitamui-services

#Zone UI
generateServerAndClientCertAndStorePassphrase ui-portal vitamui-services
Expand All @@ -43,10 +43,9 @@ function generateCerts {
generateServerAndClientCertAndStorePassphrase ui-archive-search vitamui-services
generateServerAndClientCertAndStorePassphrase ui-collect vitamui-services
generateServerAndClientCertAndStorePassphrase ui-pastis vitamui-services
generateServerCertAndStorePassphrase ui-design-system vitamui-services
Copy link
Contributor Author

@GiooDev GiooDev Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pas besoin de certificat pour ui-design-system, c'est juste une page de demo des composants UI. On le laisse en http sans possibilité de le passer en https.


#Reverse
generateServerCertAndStorePassphrase reverse hosts_vitamui_reverseproxy vitamui-services
generateServerCertAndStorePassphrase reverse vitamui-services

# Example of generated client cert for a customer allowing to perform request on external APIs
# generateClientCertAndStorePassphrase customer_x client-external
Expand Down
9 changes: 5 additions & 4 deletions deployment/pki/scripts/generate_certs_dev.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,11 @@ set -e

REPERTOIRE_ROOT="$( cd "$( readlink -f $(dirname ${BASH_SOURCE[0]}) )/../../../dev-deployment" ; pwd )"

function getHostCertificateCn {
function getComponentCertificateCn {
echo "dev.vitamui.com"
}

function getHostCertificateSan {
function getComponentCertificateSan {
echo "DNS:dev.vitamui.com,DNS:localhost"
}

Expand All @@ -33,6 +33,7 @@ function generateCerts {
pki_logger "Génération des certificats serveurs"
# Zone interne
generateServerCertAndStorePassphrase security vitamui-services

#Zone externe
generateServerAndClientCertAndStorePassphrase iam vitamui-services
generateServerAndClientCertAndStorePassphrase cas-server vitamui-services
Expand All @@ -42,6 +43,7 @@ function generateCerts {
generateServerAndClientCertAndStorePassphrase collect vitamui-services
generateServerAndClientCertAndStorePassphrase pastis vitamui-services
generateServerAndClientCertAndStorePassphrase api-gateway vitamui-services

#Zone UI
generateServerAndClientCertAndStorePassphrase ui-portal vitamui-services
generateServerAndClientCertAndStorePassphrase ui-identity vitamui-services
Expand All @@ -51,10 +53,9 @@ function generateCerts {
generateServerAndClientCertAndStorePassphrase ui-archive-search vitamui-services
generateServerAndClientCertAndStorePassphrase ui-pastis vitamui-services
generateServerAndClientCertAndStorePassphrase ui-collect vitamui-services
generateServerCertAndStorePassphrase ui-design-system vitamui-services

#Reverse
generateServerCertAndStorePassphrase reverse hosts_vitamui_reverseproxy vitamui-services
generateServerCertAndStorePassphrase reverse vitamui-services

# Example of generated client cert for a customer allowing to perform request on external APIs
generateClientCertAndStorePassphrase customer_x client-external
Expand Down
Loading
Loading