1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
|
package ca
import (
"crypto/tls"
"encoding/pem"
"fmt"
"net/http"
"github.com/pkg/errors"
"github.com/smallstep/certificates/ca"
"github.com/smallstep/cli/command"
"github.com/smallstep/cli/crypto/pemutil"
"github.com/smallstep/cli/errs"
"github.com/smallstep/cli/flags"
"github.com/smallstep/cli/ui"
"github.com/urfave/cli"
)
func rootComand() cli.Command {
return cli.Command{
Name: "root",
Action: command.ActionFunc(rootAction),
Usage: "download and validate the root certificate",
UsageText: `**step ca root** [<root-file>]
[**--ca-url**=<uri>] [**--fingerprint**=<fingerprint>]`,
Description: `**step ca root** downloads and validates the root certificate from the
certificate authority.
## POSITIONAL ARGUMENTS
<root-file>
: File to write root certificate (PEM format)
## EXAMPLES
Get the root fingerprint in the CA:
'''
$ step certificate fingerprint /path/to/root_ca.crt
0d7d3834cf187726cf331c40a31aa7ef6b29ba4df601416c9788f6ee01058cf3
'''
Download the root certificate from the configured certificate authority:
'''
$ step ca root root_ca.crt \
--fingerprint 0d7d3834cf187726cf331c40a31aa7ef6b29ba4df601416c9788f6ee01058cf3
'''
Download the root certificate using a given certificate authority:
'''
$ step ca root root_ca.crt \
--ca-url https://ca.smallstep.com:9000 \
--fingerprint 0d7d3834cf187726cf331c40a31aa7ef6b29ba4df601416c9788f6ee01058cf3
'''
Print the root certificate using the flags set by <step ca bootstrap>:
'''
$ step ca root
'''`,
Flags: []cli.Flag{
flags.CaURL,
flags.Force,
fingerprintFlag,
},
}
}
func rootAction(ctx *cli.Context) error {
if err := errs.MinMaxNumberOfArguments(ctx, 0, 1); err != nil {
return err
}
caURL, err := flags.ParseCaURL(ctx)
if err != nil {
return err
}
fingerprint := ctx.String("fingerprint")
if len(fingerprint) == 0 {
return errs.RequiredFlag(ctx, "fingerprint")
}
tr := getInsecureTransport()
client, err := ca.NewClient(caURL, ca.WithTransport(tr))
if err != nil {
return err
}
// Root already validates the certificate
resp, err := client.Root(fingerprint)
if err != nil {
return errors.Wrap(err, "error downloading root certificate")
}
if rootFile := ctx.Args().Get(0); rootFile != "" {
if _, err := pemutil.Serialize(resp.RootPEM.Certificate, pemutil.ToFile(rootFile, 0600)); err != nil {
return err
}
ui.Printf("The root certificate has been saved in %s.\n", rootFile)
} else {
block, err := pemutil.Serialize(resp.RootPEM.Certificate)
if err != nil {
return err
}
fmt.Print(string(pem.EncodeToMemory(block)))
}
return nil
}
func getInsecureTransport() *http.Transport {
return &http.Transport{
Proxy: http.ProxyFromEnvironment,
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
}
}
|
