kipuka/config/
cmp.rs

1//! CMP v3 configuration (RFC 9810).
2//!
3//! The `[cmp]` section enables the Certificate Management Protocol
4//! endpoint at `/.well-known/cmp`.  CMP provides a comprehensive
5//! certificate lifecycle protocol with its own ASN.1 message format.
6
7use serde::Deserialize;
8
9/// `[cmp]` section — CMP v3 certificate management endpoint.
10///
11/// ```toml
12/// [cmp]
13/// enabled = true
14/// allow_ir = true
15/// allow_cr = true
16/// allow_kur = true
17/// allow_rr = false
18/// allow_mac_protection = true
19/// mac_algorithm = "hmac-sha256"
20///
21/// [[cmp.mac_secrets]]
22/// reference = "client-ref-01"
23/// secret_hex = "deadbeef01020304"
24/// ```
25#[derive(Debug, Clone, Deserialize)]
26#[serde(deny_unknown_fields)]
27pub struct CmpConfig {
28    /// Enable the CMP endpoint.
29    #[serde(default)]
30    pub enabled: bool,
31
32    /// Allow initialization requests (new enrollment).
33    #[serde(default = "default_true")]
34    pub allow_ir: bool,
35
36    /// Allow certification requests.
37    #[serde(default = "default_true")]
38    pub allow_cr: bool,
39
40    /// Allow key update requests.
41    #[serde(default = "default_true")]
42    pub allow_kur: bool,
43
44    /// Allow revocation requests via CMP.
45    #[serde(default)]
46    pub allow_rr: bool,
47
48    /// Allow MAC-based protection for initial enrollment.
49    #[serde(default = "default_true")]
50    pub allow_mac_protection: bool,
51
52    /// MAC algorithm for shared-secret protection.
53    #[serde(default = "default_mac_algorithm")]
54    pub mac_algorithm: String,
55
56    /// Certificate profile for cross-certification requests.
57    #[serde(default)]
58    pub reference_cert_profile: Option<String>,
59
60    /// Shared secrets for CMP MAC-based protection (RFC 4210 §5.1.3.1).
61    /// Each entry maps a reference number to a shared secret.
62    #[serde(default)]
63    pub mac_secrets: Vec<CmpMacSecret>,
64}
65
66/// A shared secret entry for CMP MAC-based protection.
67///
68/// The reference number identifies the secret and is matched against the
69/// CMP sender field.  The secret is hex-encoded for safe storage in TOML.
70#[derive(Debug, Clone, Deserialize)]
71pub struct CmpMacSecret {
72    /// Reference number identifying this secret (matched against CMP sender field).
73    pub reference: String,
74    /// Hex-encoded shared secret bytes. Supports secret prefixes:
75    /// `env:VAR`, `file:/path`, `prompt:Label`, `keyring:name`, `systemd-creds:name`.
76    pub secret_hex: super::SecretRef,
77}
78
79fn default_true() -> bool {
80    true
81}
82
83fn default_mac_algorithm() -> String {
84    "hmac-sha256".to_string()
85}
86
87impl Default for CmpConfig {
88    fn default() -> Self {
89        Self {
90            enabled: false,
91            allow_ir: true,
92            allow_cr: true,
93            allow_kur: true,
94            allow_rr: false,
95            allow_mac_protection: true,
96            mac_algorithm: default_mac_algorithm(),
97            reference_cert_profile: None,
98            mac_secrets: Vec::new(),
99        }
100    }
101}
kipuka/config/cmp.rs

kipuka/config/
cmp.rs
