ocsp-standalone-test.yml

name: Standalone OCSP

on: workflow_call

env:
  DS_IMAGE: ${{ vars.DS_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  # https://github.com/dogtagpki/pki/wiki/Installing-Standalone-OCSP
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve PKI images
        uses: actions/cache@v4
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up DS container
        run: |
          tests/bin/ds-create.sh \
              --image=${{ env.DS_IMAGE }} \
              --hostname=ds.example.com \
              --password=Secret.123 \
              ds

      - name: Connect DS container to network
        run: docker network connect example ds --alias ds.example.com

      - name: Set up CA container
        run: |
          tests/bin/runner-init.sh ca
        env:
          HOSTNAME: ca.example.com

      - name: Connect CA container to network
        run: docker network connect example ca --alias ca.example.com

      - name: Install standalone CA
        run: |
          docker exec ca pkispawn \
              -f /usr/share/pki/server/examples/installation/ca.cfg \
              -s CA \
              -D pki_ds_url=ldap://ds.example.com:3389 \
              -D pki_security_domain_setup=False \
              -v

          docker exec ca pki-server cert-find

      - name: Check CA security domain
        run: |
          # security domain should be disabled
          docker exec ca pki-server ca-config-find | grep ^securitydomain. | sort | tee actual
          diff /dev/null actual

          docker exec ca pki-server cert-export ca_signing --cert-file ${SHARED}/ca_signing.crt

          docker exec ca pki nss-cert-import \
              --cert $SHARED/ca_signing.crt \
              --trust CT,C,C \
              ca_signing

          docker exec ca pki securitydomain-show \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          # REST API should not return security domain info
          echo "PKIException: Not Found" > expected
          diff expected stderr

      - name: Check CA admin
        run: |
          docker exec ca pki pkcs12-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password Secret.123
          docker exec ca pki -n caadmin ca-user-show caadmin

      - name: Set up OCSP container
        run: |
          tests/bin/runner-init.sh ocsp
        env:
          HOSTNAME: ocsp.example.com

      - name: Connect OCSP container to network
        run: docker network connect example ocsp --alias ocsp.example.com

      - name: Install standalone OCSP (step 1)
        run: |
          docker exec ocsp pkispawn \
              -f /usr/share/pki/server/examples/installation/ocsp-standalone-step1.cfg \
              -s OCSP \
              -D pki_cert_chain_path=${SHARED}/ca_signing.crt \
              -D pki_ds_url=ldap://ds.example.com:3389 \
              -D pki_ocsp_signing_csr_path=${SHARED}/ocsp_signing.csr \
              -D pki_subsystem_csr_path=${SHARED}/subsystem.csr \
              -D pki_sslserver_csr_path=${SHARED}/sslserver.csr \
              -D pki_audit_signing_csr_path=${SHARED}/ocsp_audit_signing.csr \
              -D pki_admin_csr_path=${SHARED}/ocsp_admin.csr \
              -v

      - name: Issue OCSP signing cert
        run: |
          docker exec ca openssl req -text -noout -in ${SHARED}/ocsp_signing.csr
          docker exec ca pki \
              -n caadmin \
              ca-cert-issue \
              --profile caOCSPCert \
              --csr-file ${SHARED}/ocsp_signing.csr \
              --output-file ${SHARED}/ocsp_signing.crt
          docker exec ca openssl x509 -text -noout -in ${SHARED}/ocsp_signing.crt

      - name: Issue subsystem cert
        run: |
          docker exec ca openssl req -text -noout -in ${SHARED}/subsystem.csr
          docker exec ca pki \
              -n caadmin \
              ca-cert-issue \
              --profile caSubsystemCert \
              --csr-file ${SHARED}/subsystem.csr \
              --output-file ${SHARED}/subsystem.crt
          docker exec ca openssl x509 -text -noout -in ${SHARED}/subsystem.crt

      - name: Issue SSL server cert
        run: |
          docker exec ca openssl req -text -noout -in ${SHARED}/sslserver.csr
          docker exec ca pki \
              -n caadmin \
              ca-cert-issue \
              --profile caServerCert \
              --csr-file ${SHARED}/sslserver.csr \
              --output-file ${SHARED}/sslserver.crt
          docker exec ca openssl x509 -text -noout -in ${SHARED}/sslserver.crt

      - name: Issue OCSP audit signing cert
        run: |
          docker exec ca openssl req -text -noout -in ${SHARED}/ocsp_audit_signing.csr
          docker exec ca pki \
              -n caadmin \
              ca-cert-issue \
              --profile caAuditSigningCert \
              --csr-file ${SHARED}/ocsp_audit_signing.csr \
              --output-file ${SHARED}/ocsp_audit_signing.crt
          docker exec ca openssl x509 -text -noout -in ${SHARED}/ocsp_audit_signing.crt

      - name: Issue OCSP admin cert
        run: |
          docker exec ca openssl req -text -noout -in ${SHARED}/ocsp_admin.csr
          docker exec ca pki \
              -n caadmin \
              ca-cert-issue \
              --profile AdminCert \
              --csr-file ${SHARED}/ocsp_admin.csr \
              --output-file ${SHARED}/ocsp_admin.crt
          docker exec ca openssl x509 -text -noout -in ${SHARED}/ocsp_admin.crt

      - name: Install standalone OCSP (step 2)
        run: |
          docker exec ocsp pkispawn \
              -f /usr/share/pki/server/examples/installation/ocsp-standalone-step2.cfg \
              -s OCSP \
              -D pki_cert_chain_path=${SHARED}/ca_signing.crt \
              -D pki_ds_url=ldap://ds.example.com:3389 \
              -D pki_ocsp_signing_csr_path=${SHARED}/ocsp_signing.csr \
              -D pki_subsystem_csr_path=${SHARED}/subsystem.csr \
              -D pki_sslserver_csr_path=${SHARED}/sslserver.csr \
              -D pki_audit_signing_csr_path=${SHARED}/ocsp_audit_signing.csr \
              -D pki_admin_csr_path=${SHARED}/ocsp_admin.csr \
              -D pki_ocsp_signing_cert_path=${SHARED}/ocsp_signing.crt \
              -D pki_subsystem_cert_path=${SHARED}/subsystem.crt \
              -D pki_sslserver_cert_path=${SHARED}/sslserver.crt \
              -D pki_audit_signing_cert_path=${SHARED}/ocsp_audit_signing.crt \
              -D pki_admin_cert_path=${SHARED}/ocsp_admin.crt \
              -v

      - name: Check OCSP server status
        run: |
          docker exec ocsp pki-server status | tee output

          # standalone OCSP should be a domain manager
          echo "True" > expected
          sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
          diff expected actual

      - name: Check OCSP system certs
        run: |
          docker exec ocsp pki-server cert-find

      # TODO: Fix DogtagOCSPConnectivityCheck to work without CA
      # - name: Run PKI healthcheck
      #   run: docker exec ocsp pki-healthcheck --failures-only

      - name: Check OCSP admin cert
        run: |
          docker exec ocsp pki nss-cert-import \
              --cert $SHARED/ca_signing.crt \
              --trust CT,C,C \
              ca_signing

          docker exec ocsp pki pkcs12-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ocsp_admin_cert.p12 \
              --pkcs12-password Secret.123
          docker exec ocsp pki -n ocspadmin ocsp-user-show ocspadmin

      - name: Check OCSP users
        run: |
          docker exec ocsp pki -n ocspadmin ocsp-user-find

          docker exec ocsp pki -n ocspadmin ocsp-user-show CA-ca.example.com-8443 \
              > >(tee stdout) 2> >(tee stderr >&2) || true

          # standalone OCSP should not have CA user
          echo "UserNotFoundException: User CA-ca.example.com-8443 not found" > expected
          diff expected stderr

      - name: Check OCSP security domain
        run: |
          # security domain should be enabled (i.e. securitydomain.select=new)
          cat > expected << EOF
          securitydomain.checkIP=false
          securitydomain.checkinterval=300000
          securitydomain.flushinterval=86400000
          securitydomain.host=ocsp.example.com
          securitydomain.httpport=8080
          securitydomain.httpsadminport=8443
          securitydomain.name=example.com Security Domain
          securitydomain.select=new
          securitydomain.source=ldap
          EOF

          docker exec ocsp pki-server ocsp-config-find | grep ^securitydomain. | sort | tee actual
          diff expected actual

          # TODO: Fix pki securitydomain-show to work with standalone OCSP
          # docker exec ocsp pki securitydomain-show \
          #     > >(tee stdout) 2> >(tee stderr >&2) || true

          # standalone OCSP should return security domain info

      - name: Check OCSP publishing in CA
        run: |
          # OCSP publishing should not be configured
          docker exec ca pki-server ca-config-find | grep ^ca.publish. > output

          echo -n > expected
          sed -n '/^ca.publish.enable=/p' output | tee actual
          diff expected actual

          echo -n > expected
          sed -n '/^ca.publish.publisher.instance.OCSPPublisher-/p' output | tee actual
          diff expected actual

          echo -n > expected
          sed -n '/^ca.publish.rule.instance.ocsprule-/p' output | tee actual
          diff expected actual

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh ds
          tests/bin/pki-artifacts-save.sh ca
          tests/bin/pki-artifacts-save.sh ocsp
        continue-on-error: true

      - name: Remove OCSP
        run: docker exec ocsp pkidestroy -s OCSP -v

      - name: Remove CA
        run: docker exec ca pkidestroy -s CA -v

      - name: Check DS server systemd journal
        if: always()
        run: |
          docker exec ds journalctl -x --no-pager -u dirsrv@localhost.service

      - name: Check DS container logs
        if: always()
        run: |
          docker logs ds

      - name: Check CA systemd journal
        if: always()
        run: |
          docker exec ca journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check CA debug log
        if: always()
        run: |
          docker exec ca find /var/lib/pki/pki-tomcat/logs/ca -name "debug.*" -exec cat {} \;

      - name: Check OCSP systemd journal
        if: always()
        run: |
          docker exec ocsp journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check OCSP debug log
        if: always()
        run: |
          docker exec ocsp find /var/lib/pki/pki-tomcat/logs/ocsp -name "debug.*" -exec cat {} \;

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ocsp-standalone
          path: /tmp/artifacts