kipuka_dogtag/
config.rs

1//! Configuration types for Dogtag PKI client.
2//!
3//! Provides strongly-typed configuration for connecting to Dogtag CA and KRA
4//! subsystems, including mTLS agent credentials and retry policy.
5
6use serde::Deserialize;
7use url::Url;
8
9/// Configuration for connecting to a Dogtag PKI instance.
10///
11/// Supports deserialization from TOML configuration files. The agent certificate
12/// and key are used for mTLS authentication to the Dogtag REST API, which requires
13/// an agent-level certificate for enrollment and revocation operations.
14///
15/// # Example TOML
16///
17/// ```toml
18/// [dogtag]
19/// ca_url = "https://ca.example.com:8443"
20/// kra_url = "https://kra.example.com:8443"
21/// agent_cert_file = "/etc/kipuka/agent.pem"
22/// agent_key_file = "/etc/kipuka/agent.key"
23/// ca_cert_file = "/etc/pki/tls/certs/ca-bundle.crt"
24/// profile_id = "caServerCert"
25/// timeout_secs = 30
26/// retry_max = 3
27/// retry_delay_ms = 1000
28/// ```
29#[derive(Debug, Clone, Deserialize)]
30pub struct DogtagConfig {
31    /// Base URL of the Dogtag CA subsystem.
32    ///
33    /// Typically `https://<hostname>:8443` for the secure admin/agent port.
34    /// The REST API endpoints are relative to this URL (e.g., `/ca/rest/certs`).
35    pub ca_url: Url,
36
37    /// Base URL of the Dogtag KRA subsystem (optional).
38    ///
39    /// Required only for `/serverkeygen` operations that need server-side key
40    /// generation and archival. Typically on the same host as the CA but may
41    /// be a separate instance.
42    pub kra_url: Option<Url>,
43
44    /// Path to the PEM-encoded agent certificate file.
45    ///
46    /// This certificate authenticates the client to the Dogtag REST API.
47    /// Must be issued by a CA trusted by the Dogtag instance and have
48    /// the appropriate agent privileges.
49    pub agent_cert_file: String,
50
51    /// Path to the PEM-encoded agent private key file.
52    pub agent_key_file: String,
53
54    /// Path to the PEM-encoded CA certificate file for TLS verification.
55    ///
56    /// Used to verify the Dogtag server's TLS certificate. This is typically
57    /// the root CA certificate that issued the Dogtag instance's server cert.
58    pub ca_cert_file: String,
59
60    /// Default enrollment profile ID.
61    ///
62    /// Common profiles include:
63    /// - `caServerCert` — TLS server certificates
64    /// - `caUserCert` — User/client certificates
65    /// - `caIPAserviceCert` — FreeIPA service certificates
66    /// - `caDualCert` — Dual-key (signing + encryption) certificates
67    pub profile_id: String,
68
69    /// Server-Side Keygen (SSKG) enrollment profile ID.
70    ///
71    /// Used by EST `/serverkeygen`. Must have `serverKeygenInputImpl` input,
72    /// `pkcs12OutputImpl` output, and `serverKeygenUserKeyDefaultImpl` default.
73    /// Falls back to `"caServerKeygenEST"` if not set.
74    #[serde(default)]
75    pub sskg_profile_id: Option<String>,
76
77    /// HTTP request timeout in seconds.
78    ///
79    /// Applied to each individual HTTP request to the Dogtag REST API.
80    /// Enrollment operations may take longer if the CA profile requires
81    /// approval workflows.
82    #[serde(default = "default_timeout")]
83    pub timeout_secs: u64,
84
85    /// Maximum number of retry attempts for transient failures.
86    ///
87    /// Retries are attempted for HTTP 5xx errors and connection failures.
88    /// Client errors (4xx) are not retried.
89    #[serde(default = "default_retry_max")]
90    pub retry_max: u32,
91
92    /// Delay between retry attempts in milliseconds.
93    #[serde(default = "default_retry_delay")]
94    pub retry_delay_ms: u64,
95
96    /// Username for HTTP basic auth (used when ca_url is HTTP).
97    ///
98    /// NSS cannot validate ML-DSA-87 client certs in the TLS handshake
99    /// (Bug 2025246). When ca_url uses HTTP, basic auth with username/password
100    /// is used instead of mTLS agent cert authentication.
101    #[serde(default)]
102    pub username: Option<String>,
103
104    /// Password for HTTP basic auth.
105    #[serde(default)]
106    pub password: Option<String>,
107
108    /// Username for KRA basic auth. Defaults to `username` if not set.
109    /// Dogtag creates `kraadmin` as the KRA admin (separate from `caadmin`).
110    #[serde(default)]
111    pub kra_username: Option<String>,
112
113    /// Password for KRA basic auth. Defaults to `password` if not set.
114    #[serde(default)]
115    pub kra_password: Option<String>,
116
117    /// Skip mTLS client certificate presentation on HTTPS connections.
118    ///
119    /// When true, the client connects to HTTPS endpoints using basic auth
120    /// only, without presenting the agent certificate during the TLS
121    /// handshake. Required for PQ (ML-DSA-87) CAs where the Dogtag
122    /// server's NSS cannot validate ML-DSA-signed agent cert chains
123    /// during TLS client authentication (NSS lacks ML-DSA TLS
124    /// SignatureScheme support).
125    #[serde(default)]
126    pub skip_mtls: bool,
127
128    /// Accept invalid TLS server certificates (self-signed, expired, wrong hostname).
129    ///
130    /// **WARNING**: Setting this to `true` disables TLS certificate validation,
131    /// allowing MITM attacks. Use only in development/test environments with
132    /// self-signed Dogtag certificates. Production deployments should set this
133    /// to `false` and configure `ca_cert_file` with the proper root CA.
134    #[serde(default = "default_accept_invalid_certs")]
135    pub accept_invalid_certs: bool,
136}
137
138fn default_accept_invalid_certs() -> bool {
139    false
140}
141
142fn default_timeout() -> u64 {
143    30
144}
145
146fn default_retry_max() -> u32 {
147    3
148}
149
150fn default_retry_delay() -> u64 {
151    1000
152}
kipuka_dogtag/config.rs

kipuka_dogtag/
config.rs
