|
|
Post by AMI_alvin on Sept 14, 2021 3:27:30 GMT
Hi,
If the BMC Web Server have the Certificate Chain information, is there any suggestion to classify the Root CA certificate and Intermediate CA certificate to the proper Certificate resource URI?
For example, the "cert-A", which is used for https protocol, will be classified to "/redfish/v1/Managers/{ManagerId}/NetworkProtocol/HTTPS/Certificates" , but I'm not sure how to classify its imtermediate CA certificate which signed the "cert-A".
Thanks,
Alvin
|
|
|
|
Post by mraineri on Oct 15, 2021 18:58:20 GMT
You can show those intermediate and CA certificates as additional members in that same collection. As part of the recent 2021.2 schema bundle, the Certificate resource was updated so it's possible to express the signing chain in each of the Certificate resources with the new "Subjects" and "Issuer" properties found inside of "Links".
|
|
|
|
Post by AMI_alvin on Oct 21, 2021 6:28:01 GMT
Thank you mraineri for your information. |
|
|
|
Post by lyeager on Feb 10, 2023 21:32:11 GMT
mraineri can you give an example of how to use '{"Links":{"Issuer":""}}' to setup the relationships between the root, intermediate, and "leaf" certificates? I'm trying the following command with a redfish server with a RootService RedfishVersion of 1.11.0, which [if I'm reading the Resource and Schema Guide correctly] means that this is redfish release 2021.2, and so the Certificate schema would be v1.4, which supports the Links property. $ curl -k -u "${USER}:${PASSWORD}" 'https://MYHOST/redfish/v1/Managers/BMC/NetworkProtocol/HTTPS/Certificates' -H 'Content-Type: application/json' --data "{\"CertificateString\":\"$(cat cert_intermediate.pem)\",\"CertificateType\":\"PEM\",\"Links\":{\"Subjects\":[{\"@odata.id\":\"/redfish/v1/Managers/BMC/NetworkProtocol/HTTPS/Certificates/1\"}]}}" -s | jq . { "error": { "@message.ExtendedInfo": [ { "@odata.type": "#Message.v1_0_8.Message", "Message": "The property Links is not in the list of valid properties for the resource.", "MessageArgs": [ "Links" ], "MessageId": "Base.1.12.PropertyUnknown", "RelatedProperties": [ "#/Links" ], "Resolution": "Remove the unknown property from the request body and resubmit the request if the operation failed.", "Severity": "Warning" } ], "code": "Base.1.12.PropertyUnknown", "message": "The property Links is not in the list of valid properties for the resource." } }
|
|
|
|
Post by mraineri on Feb 11, 2023 20:18:35 GMT
That is the proper format, but based on the error message coming back, it doesn't appear the service you're using supports the Subject and Issuer properties in Links. I'm not sure how widely supported those properties are at this time.
|
|
