FreeIPA HSM integration testing
- Modified Dogtag 10.7.3 with patches from https://magnus-k-karlsson.blogspot.com/2019/08/installing-dogtag-on-fedora-30-with.html
- FreeIPA 4.8 upstream with latest HSM related fixes
## installation with SoftHSM2
### Install COPR version with additional patches
```
# dnf copr enable -y cheimes/freeipa-hsm
# dnf update -y
# rpm -qa freeipa-server pki-ca
freeipa-server-4.8.1-1+hsm1.fc30.x86_64
pki-ca-10.7.3-3+hsm1.fc30.noarch
```
### Preparse SoftHSM2 and disable P11-Kit completely
```
# softhsm2-util --init-token --label "Dogtag" --so-pin redhat123 --pin redhat123 --free
# chmod 777 -R /var/lib/softhsm/
# mv /etc/crypto-policies/local.d/nss-p11-kit.config /etc/crypto-policies/local.d/nss-p11-kit.config.bak
# echo "# disabled for FreeIPA" > /etc/crypto-policies/local.d/nss-p11-kit.config
# update-crypto-policies
```
### PKI ini override
```
# cat << EOF > /root/freeipa-hsm.ini
[DEFAULT]
pki_hsm_enable=True
pki_hsm_libfile=%(softhsm2_so)s
pki_hsm_modulename=softhsm2
pki_token_name=Dogtag
pki_token_password=redhat123
EOF
```
### Install server
```
# ipa-server-install --domain ipa.example --realm IPA.EXAMPLE -U -p Secret123 -a Secret123 --pki-config-override /root/freeipa-hsm.ini
```
## Verification
```
# echo "redhat123" > /etc/pki/pki-tomcat/alias/hsm.txt
# certutil -d /etc/pki/pki-tomcat/alias/ -L -h internal -f /etc/pki/pki-tomcat/alias/hsm.txt
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
caSigningCert cert-pki-ca CT,C,C
auditSigningCert cert-pki-ca ,,P
Server-Cert cert-pki-ca u,u,u
# certutil -d /etc/pki/pki-tomcat/alias/ -K -h internal -f /etc/pki/pki-tomcat/alias/pwdfile.txt
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"
< 0> rsa 7e63a9f1be92a07e21a16f7d7b4898a9f72533bc NSS Certificate DB:Server-Cert cert-pki-ca
# certutil -d /etc/pki/pki-tomcat/alias/ -L -h Dogtag -f /etc/pki/pki-tomcat/alias/hsm.txt
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Dogtag:auditSigningCert cert-pki-ca u,u,Pu
Dogtag:subsystemCert cert-pki-ca u,u,u
Dogtag:caSigningCert cert-pki-ca CTu,Cu,Cu
Dogtag:ocspSigningCert cert-pki-ca u,u,u
# certutil -d /etc/pki/pki-tomcat/alias/ -K -h Dogtag -f /etc/pki/pki-tomcat/alias/hsm.txt
certutil: Checking token "Dogtag" in slot "SoftHSM slot ID 0x2b24f0e8"
< 0> rsa 120991d7c363e5a33b4642e48f2afd2503c73b3e caSigningCert cert-pki-ca
< 1> rsa b8486305022a9e49d2e8dd18ddd757d7b628579e auditSigningCert cert-pki-ca
< 2> rsa a3f8523a9b141b08ef4916e96d9936b1ba5916b4 subsystemCert cert-pki-ca
< 3> rsa cd2b056930cad6cae8e57e60b831916ac5efc0de ocspSigningCert cert-pki-ca
```
This is a companion discussion topic for the original entry at https://copr.fedorainfracloud.org/coprs/cheimes/freeipa-hsm/
