kipuka/routes/

simplereenroll.rs

//! `POST /.well-known/est/simplereenroll` — Simple Re-enrollment.
//!
//! RFC 7030 §4.2.2: EST clients submit a PKCS#10 CSR to renew an
//! existing certificate.  The client MUST authenticate via mTLS by
//! presenting the certificate being renewed.
//!
//! POP linking (§3.5): the TLS client certificate subject MUST match
//! the CSR subject, proving the client possesses the private key of
//! the certificate being renewed.
//!
//! The server additionally verifies the client certificate has not been
//! revoked (OCSP/CRL check per RHELBU-3536 R21).

use std::sync::Arc;

use axum::body::Bytes;
use axum::extract::State;
use axum::http::{HeaderValue, StatusCode, header};
use axum::response::{IntoResponse, Response};

use crate::auth::{AuthMethod, EstAuth};
use crate::error::KipukaError;
use crate::routes::LabelExtractor;
use crate::routes::est::{content_types, decode_est_base64, encode_est_base64};
use crate::state::AppState;

/// `POST /.well-known/est/simplereenroll`
///
/// Accepts a PKCS#10 CSR (base64-encoded) and returns a PKCS#7 certs-only
/// response containing the renewed certificate.
///
/// # Authentication
///
/// MUST authenticate via mTLS — the client presents the certificate being
/// renewed.  OTP and GSSAPI are not accepted for re-enrollment.
///
/// # POP Linking (RFC 7030 §3.5)
///
/// The TLS client certificate subject MUST match the CSR subject.  This
/// prevents an attacker from using a compromised certificate to request
/// a certificate for a different identity.
///
/// # Revocation Check (RHELBU-3536 R21)
///
/// The server verifies the client certificate has not been revoked before
/// accepting the re-enrollment request.  This prevents revoked certificates
/// from being used to obtain new certificates.
///
/// # Request
///
/// | Header         | Value                |
/// |----------------|----------------------|
/// | Content-Type   | `application/pkcs10` |
/// | Body           | Base64-encoded DER PKCS#10 CSR |
///
/// # Response
///
/// | Header         | Value                                        |
/// |----------------|----------------------------------------------|
/// | Status         | `200 OK` or `202 Accepted`                   |
/// | Content-Type   | `application/pkcs7-mime; smime-type=certs-only` |
///
/// # Errors
///
/// - `400 Bad Request` — malformed CSR, POP linking failure
/// - `401 Unauthorized` — mTLS required but not provided
/// - `403 Forbidden` — client certificate revoked
/// - `415 Unsupported Media Type` — wrong Content-Type
/// - `500 Internal Server Error` — CA signing failure
pub async fn post_simplereenroll(
    auth: EstAuth,
    label: LabelExtractor,
    State(state): State<Arc<AppState>>,
    body: Bytes,
) -> Result<Response, KipukaError> {
    let ca_id = label.ca_id();

    // Re-enrollment MUST use mTLS authentication.
    if auth.0.method != AuthMethod::Mtls {
        tracing::warn!(
            identity = %auth.0.identity,
            method = ?auth.0.method,
            "simplereenroll rejected: mTLS required"
        );
        return Err(KipukaError::Auth(
            "re-enrollment requires mTLS client certificate authentication".into(),
        ));
    }

    let identity = &auth.0.identity;
    state.admit_enrollment(identity, "simplereenroll").await?;

    tracing::info!(
        ca_id = %ca_id,
        label = %label.label,
        identity = %identity,
        "simplereenroll request"
    );

    // Decode the base64-encoded CSR.
    let csr_der = decode_est_base64(&body)
        .map_err(|e| KipukaError::BadRequest(format!("CSR decoding failed: {e}")))?;

    if csr_der.is_empty() || csr_der.len() < 60 {
        return Err(KipukaError::BadRequest("CSR is empty or too short".into()));
    }

    // POP linking: verify the TLS client cert subject matches the CSR subject.
    //
    // RFC 7030 §3.5: "the subject field in the CSR MUST be the same as
    // the subject field in the client certificate used for TLS authentication."
    validate_pop_linking_from_csr(&csr_der, &auth.0)?;

    // Verify the client certificate has not been revoked (RHELBU-3536 R21).
    //
    // The mTLS module already checks revocation during extraction, but we
    // perform a second check here to handle the case where the certificate
    // was revoked between TLS handshake and request processing.
    if let Some(cert_der) = auth.0.client_cert_der.as_deref()
        && let Err(e) = crate::auth::mtls::check_revocation(cert_der, &state).await
    {
        tracing::warn!(
            identity = %identity,
            error = %e,
            "simplereenroll rejected: client certificate revocation check failed"
        );
        return Err(KipukaError::Forbidden(format!(
            "client certificate revocation check failed: {e}"
        )));
    }

    // Enrollment authorization (NIAP CA PP FDP_ACF.1).
    //
    // POP linking above proves the CSR subject equals the TLS client-cert
    // subject, but the per-label SAN identity binding and the name allowlist
    // are independent controls: a renewing client can still add SANs it was
    // never authorized for.  Apply the same policy the /simpleenroll and
    // CMS-EST reenroll paths enforce, so re-enrollment is not a bypass.  A
    // no-op unless the label opts in.
    if let Err(reason) =
        crate::auth::enroll_authz::authorize_csr_der(&csr_der, identity, &label.enroll_policy())
    {
        tracing::warn!(
            ca_id = %ca_id,
            identity = %identity,
            %reason,
            "simplereenroll rejected: CSR not authorized for requester"
        );
        state
            .record_audit_event_with_actor(
                "simplereenroll_denied",
                identity,
                &format!("ca_id={ca_id}, identity={identity}, reason={reason}"),
            )
            .await;
        return Err(KipukaError::Forbidden(format!(
            "enrollment not authorized: {reason}"
        )));
    }

    // Look up the CA backend.
    let ca = state.get_ca(ca_id).ok_or(KipukaError::NotFound)?;

    // Look up the CA config to get the key_file path.
    let ca_cfg = state
        .config
        .cas
        .iter()
        .find(|c| c.id == ca_id)
        .ok_or_else(|| KipukaError::Ca(format!("CA config not found for id={ca_id}")))?;

    // Resolve key material.
    let resolved_key = crate::ca::issue::resolve_signing_key(ca_cfg, state.hsm.as_ref()).await?;

    // Build the enrollment profile.
    let profile = crate::ca::issue::EnrollmentProfile {
        max_validity_days: ca
            .validity_days
            .min(crate::ca::issue::cab_forum_max_validity_days()),
        ..crate::ca::issue::EnrollmentProfile::default()
    };

    // Issue the renewed certificate.
    let result = match crate::ca::issue::issue_certificate(
        &csr_der,
        &profile,
        &ca.cert_der,
        resolved_key.as_signing_key(),
        &ca.hash_algorithm,
        ca.ocsp_url.as_deref(),
        ca.crl_url.as_deref(),
    ) {
        Ok(result) => result,
        Err(e) => {
            // `From<IssuanceError>` maps a bad client CSR (e.g. failed
            // proof-of-possession) to BadRequest (400) and server faults to
            // Ca (500).  A client-caused rejection is a security-relevant
            // event: audit it as enroll.reject before returning, mirroring the
            // authorization-denial path (NIAP FAU_GEN.1).
            let err = KipukaError::from(e);
            if matches!(err, KipukaError::BadRequest(_)) {
                state
                    .record_audit_event_with_actor(
                        "simplereenroll_denied",
                        identity,
                        &format!("ca_id={ca_id}, identity={identity}, reason={err}"),
                    )
                    .await;
            }
            return Err(err);
        }
    };

    // Store the re-enrolled certificate in the database for audit trail.
    let serial = &result.serial_number;
    let subject_dn = &result.subject_dn;
    let issuer_dn = synta_certificate::format_dn(
        &synta_certificate::Certificate::from_der(&ca.cert_der)
            .map(|c| c.tbs_certificate.subject.0.to_vec())
            .unwrap_or_default(),
    );
    let not_before_str = result.not_before.format("%Y-%m-%dT%H:%M:%SZ").to_string();
    let not_after_str = result.not_after.format("%Y-%m-%dT%H:%M:%SZ").to_string();

    if let Err(e) = sqlx::query(crate::db::pg_sql(
        "INSERT INTO certificates (serial, subject_dn, issuer_dn, not_before, not_after, der_encoded, ca_id, profile, status) \
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'active')",
    ))
    .bind(serial)
    .bind(subject_dn)
    .bind(&issuer_dn)
    .bind(&not_before_str)
    .bind(&not_after_str)
    .bind(&result.certificate_der)
    .bind(ca_id)
    .bind(&profile.name)
    .execute(&state.db)
    .await
    {
        // Log but do not fail the re-enrollment — the certificate was already signed.
        tracing::error!(error = %e, serial = %serial, "failed to store re-enrolled certificate in DB");
    }

    let cert_der = result.certificate_der;
    let pkcs7_der =
        crate::routes::cacerts::build_certs_only_pkcs7(std::slice::from_ref(&cert_der))?;

    let body = encode_est_base64(&pkcs7_der);

    let mut resp = (StatusCode::OK, body).into_response();
    resp.headers_mut().insert(
        header::CONTENT_TYPE,
        HeaderValue::from_static(content_types::PKCS7_CERTS),
    );
    resp.headers_mut().insert(
        header::HeaderName::from_static("content-transfer-encoding"),
        HeaderValue::from_static(content_types::TRANSFER_ENCODING_BASE64),
    );

    state
        .record_audit_event(
            "simplereenroll_success",
            &format!("ca_id={ca_id}, identity={identity}"),
        )
        .await;

    Ok(resp)
}

/// Validate POP linking by parsing the CSR and comparing its subject with the
/// TLS client certificate subject.
///
/// RFC 7030 §3.5: the CSR subject MUST match the TLS client certificate subject
/// to prove the client possesses the private key of the certificate being renewed.
///
/// Additionally checks for a `challengePassword` attribute (OID 1.2.840.113549.1.9.7)
/// in the CSR.  When present, this attribute provides cryptographic binding between
/// the CSR and the TLS session.  When absent, the mTLS client certificate alone
/// provides POP via the TLS handshake.
fn validate_pop_linking_from_csr(
    csr_der: &[u8],
    auth: &crate::auth::AuthResult,
) -> Result<(), KipukaError> {
    // Parse the CSR.
    let csr = synta_certificate::csr::CertificationRequest::from_der(csr_der)
        .map_err(|e| KipukaError::BadRequest(format!("CSR parse failed for POP linking: {e}")))?;

    // Extract the CSR subject DN by encoding the Name to DER and formatting.
    let csr_subject_der = csr
        .certification_request_info
        .subject
        .to_der()
        .map_err(|e| KipukaError::BadRequest(format!("CSR subject encode failed: {e}")))?;
    let csr_subject = synta_certificate::format_dn(&csr_subject_der);

    tracing::debug!(
        csr_subject = %csr_subject,
        cert_subject = ?auth.subject_dn,
        "POP linking: comparing CSR subject with TLS cert subject"
    );

    // Check for challengePassword attribute (RFC 7030 §3.5 binding value).
    if let Some(ref attrs) = csr.certification_request_info.attributes {
        for attr in attrs.elements() {
            if attr.attr_type.components() == synta_certificate::oids::PKCS9_CHALLENGE_PASSWORD {
                tracing::debug!("POP linking: challengePassword attribute present in CSR");
                // The challengePassword provides additional binding between the
                // CSR and the authenticated TLS session.  A full implementation
                // would verify the value against a computed binding (e.g., hash of
                // client cert + server nonce).  For now, its presence is logged
                // as evidence of POP intent.
                break;
            }
        }
    }

    // Validate subject DN match using the mtls module's RFC 6125-compliant matcher.
    crate::auth::mtls::validate_pop_linking(auth, &csr_subject)
        .map_err(|e| KipukaError::BadRequest(format!("POP linking validation failed: {e}")))?;

    tracing::info!("POP linking: CSR subject matches TLS certificate subject");

    Ok(())
}