diff --git a/backend/src/db/migrations/20241107112632_skip-bootstrap-cert-validation-est.ts b/backend/src/db/migrations/20241107112632_skip-bootstrap-cert-validation-est.ts index 69b1193ed..dd6bcf8ad 100644 --- a/backend/src/db/migrations/20241107112632_skip-bootstrap-cert-validation-est.ts +++ b/backend/src/db/migrations/20241107112632_skip-bootstrap-cert-validation-est.ts @@ -3,16 +3,16 @@ import { Knex } from "knex"; import { TableName } from "../schemas"; export async function up(knex: Knex): Promise { - const hasSkipBootstrapCertValidationCol = await knex.schema.hasColumn( + const hasDisableBootstrapCertValidationCol = await knex.schema.hasColumn( TableName.CertificateTemplateEstConfig, - "skipBootstrapCertValidation" + "disableBootstrapCertValidation" ); const hasCaChainCol = await knex.schema.hasColumn(TableName.CertificateTemplateEstConfig, "encryptedCaChain"); await knex.schema.alterTable(TableName.CertificateTemplateEstConfig, (t) => { - if (!hasSkipBootstrapCertValidationCol) { - t.boolean("skipBootstrapCertValidation").defaultTo(false).notNullable(); + if (!hasDisableBootstrapCertValidationCol) { + t.boolean("disableBootstrapCertValidation").defaultTo(false).notNullable(); } if (hasCaChainCol) { @@ -22,16 +22,16 @@ export async function up(knex: Knex): Promise { } export async function down(knex: Knex): Promise { - const hasSkipBootstrapCertValidationCol = await knex.schema.hasColumn( + const hasDisableBootstrapCertValidationCol = await knex.schema.hasColumn( TableName.CertificateTemplateEstConfig, - "skipBootstrapCertValidation" + "disableBootstrapCertValidation" ); const hasCaChainCol = await knex.schema.hasColumn(TableName.CertificateTemplateEstConfig, "encryptedCaChain"); await knex.schema.alterTable(TableName.CertificateTemplateEstConfig, (t) => { - if (hasSkipBootstrapCertValidationCol) { - t.dropColumn("skipBootstrapCertValidation"); + if (hasDisableBootstrapCertValidationCol) { + t.dropColumn("disableBootstrapCertValidation"); } if (hasCaChainCol) { diff --git a/backend/src/db/schemas/certificate-template-est-configs.ts b/backend/src/db/schemas/certificate-template-est-configs.ts index a24089c54..262f22b06 100644 --- a/backend/src/db/schemas/certificate-template-est-configs.ts +++ b/backend/src/db/schemas/certificate-template-est-configs.ts @@ -17,7 +17,7 @@ export const CertificateTemplateEstConfigsSchema = z.object({ isEnabled: z.boolean(), createdAt: z.date(), updatedAt: z.date(), - skipBootstrapCertValidation: z.boolean().default(false) + disableBootstrapCertValidation: z.boolean().default(false) }); export type TCertificateTemplateEstConfigs = z.infer; diff --git a/backend/src/ee/services/certificate-est/certificate-est-service.ts b/backend/src/ee/services/certificate-est/certificate-est-service.ts index 83e5845fd..5790c8d5a 100644 --- a/backend/src/ee/services/certificate-est/certificate-est-service.ts +++ b/backend/src/ee/services/certificate-est/certificate-est-service.ts @@ -171,7 +171,7 @@ export const certificateEstServiceFactory = ({ }); } - if (!estConfig.skipBootstrapCertValidation) { + if (!estConfig.disableBootstrapCertValidation) { const caCerts = estConfig.caChain .match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?.map((cert) => { diff --git a/backend/src/server/routes/v1/certificate-template-router.ts b/backend/src/server/routes/v1/certificate-template-router.ts index ede482778..681e40e0d 100644 --- a/backend/src/server/routes/v1/certificate-template-router.ts +++ b/backend/src/server/routes/v1/certificate-template-router.ts @@ -15,7 +15,7 @@ const sanitizedEstConfig = CertificateTemplateEstConfigsSchema.pick({ id: true, certificateTemplateId: true, isEnabled: true, - skipBootstrapCertValidation: true + disableBootstrapCertValidation: true }); export const registerCertificateTemplateRouter = async (server: FastifyZodProvider) => { @@ -247,11 +247,11 @@ export const registerCertificateTemplateRouter = async (server: FastifyZodProvid caChain: z.string().trim().optional(), passphrase: z.string().min(1), isEnabled: z.boolean().default(true), - skipBootstrapCertValidation: z.boolean().default(false) + disableBootstrapCertValidation: z.boolean().default(false) }) .refine( - ({ caChain, skipBootstrapCertValidation }) => - skipBootstrapCertValidation || (!skipBootstrapCertValidation && caChain), + ({ caChain, disableBootstrapCertValidation }) => + disableBootstrapCertValidation || (!disableBootstrapCertValidation && caChain), "CA chain is required" ), response: { @@ -299,7 +299,7 @@ export const registerCertificateTemplateRouter = async (server: FastifyZodProvid body: z.object({ caChain: z.string().trim().optional(), passphrase: z.string().min(1).optional(), - skipBootstrapCertValidation: z.boolean().optional(), + disableBootstrapCertValidation: z.boolean().optional(), isEnabled: z.boolean().optional() }), response: { diff --git a/backend/src/services/certificate-template/certificate-template-service.ts b/backend/src/services/certificate-template/certificate-template-service.ts index 483296b87..ead3e85cb 100644 --- a/backend/src/services/certificate-template/certificate-template-service.ts +++ b/backend/src/services/certificate-template/certificate-template-service.ts @@ -236,7 +236,7 @@ export const certificateTemplateServiceFactory = ({ actorAuthMethod, actor, actorOrgId, - skipBootstrapCertValidation + disableBootstrapCertValidation }: TCreateEstConfigurationDTO) => { const plan = await licenseService.getPlan(actorOrgId); if (!plan.pkiEst) { @@ -305,7 +305,7 @@ export const certificateTemplateServiceFactory = ({ hashedPassphrase, encryptedCaChain, isEnabled, - skipBootstrapCertValidation + disableBootstrapCertValidation }); return { ...estConfig, projectId: certTemplate.projectId }; @@ -320,7 +320,7 @@ export const certificateTemplateServiceFactory = ({ actorAuthMethod, actor, actorOrgId, - skipBootstrapCertValidation + disableBootstrapCertValidation }: TUpdateEstConfigurationDTO) => { const plan = await licenseService.getPlan(actorOrgId); if (!plan.pkiEst) { @@ -369,7 +369,7 @@ export const certificateTemplateServiceFactory = ({ const updatedData: TCertificateTemplateEstConfigsUpdate = { isEnabled, - skipBootstrapCertValidation + disableBootstrapCertValidation }; if (caChain) { @@ -468,7 +468,7 @@ export const certificateTemplateServiceFactory = ({ hashedPassphrase: estConfig.hashedPassphrase, projectId: certTemplate.projectId, orgId: certTemplate.orgId, - skipBootstrapCertValidation: estConfig.skipBootstrapCertValidation + disableBootstrapCertValidation: estConfig.disableBootstrapCertValidation }; }; diff --git a/backend/src/services/certificate-template/certificate-template-types.ts b/backend/src/services/certificate-template/certificate-template-types.ts index db50a54ba..cdccb6a2d 100644 --- a/backend/src/services/certificate-template/certificate-template-types.ts +++ b/backend/src/services/certificate-template/certificate-template-types.ts @@ -37,7 +37,7 @@ export type TCreateEstConfigurationDTO = { caChain?: string; passphrase: string; isEnabled: boolean; - skipBootstrapCertValidation: boolean; + disableBootstrapCertValidation: boolean; } & Omit; export type TUpdateEstConfigurationDTO = { @@ -45,7 +45,7 @@ export type TUpdateEstConfigurationDTO = { caChain?: string; passphrase?: string; isEnabled?: boolean; - skipBootstrapCertValidation?: boolean; + disableBootstrapCertValidation?: boolean; } & Omit; export type TGetEstConfigurationDTO = diff --git a/docs/documentation/platform/pki/est.mdx b/docs/documentation/platform/pki/est.mdx index a31a5672e..ecbd98dd9 100644 --- a/docs/documentation/platform/pki/est.mdx +++ b/docs/documentation/platform/pki/est.mdx @@ -35,6 +35,7 @@ These endpoints are exposed on port 8443 under the .well-known/est path e.g. ![est enrollment modal create](/images/platform/pki/est/template-enrollment-modal.png) + - **Disable Bootstrap Certificate Validation** - Enable this if your devices are not configured with a bootstrap certificate. - **Certificate Authority Chain** - This is the certificate chain used to validate your devices' manufacturing/pre-installed certificates. This will be used to authenticate your devices with Infisical's EST server. - **Passphrase** - This is also used to authenticate your devices with Infisical's EST server. When configuring the clients, use the value defined here as the EST password. diff --git a/docs/images/platform/pki/est/template-enrollment-modal.png b/docs/images/platform/pki/est/template-enrollment-modal.png index c7fed648e..60ed273d7 100644 Binary files a/docs/images/platform/pki/est/template-enrollment-modal.png and b/docs/images/platform/pki/est/template-enrollment-modal.png differ diff --git a/frontend/src/hooks/api/certificateTemplates/types.ts b/frontend/src/hooks/api/certificateTemplates/types.ts index af8093895..14367a280 100644 --- a/frontend/src/hooks/api/certificateTemplates/types.ts +++ b/frontend/src/hooks/api/certificateTemplates/types.ts @@ -49,7 +49,7 @@ export type TCreateEstConfigDTO = { caChain?: string; passphrase: string; isEnabled: boolean; - skipBootstrapCertValidation: boolean; + disableBootstrapCertValidation: boolean; }; export type TUpdateEstConfigDTO = { @@ -57,7 +57,7 @@ export type TUpdateEstConfigDTO = { caChain?: string; passphrase?: string; isEnabled?: boolean; - skipBootstrapCertValidation?: boolean; + disableBootstrapCertValidation?: boolean; }; export type TEstConfig = { @@ -65,5 +65,5 @@ export type TEstConfig = { certificateTemplateId: string; caChain: string; isEnabled: boolean; - skipBootstrapCertValidation: boolean; + disableBootstrapCertValidation: boolean; }; diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateTemplateEnrollmentModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateTemplateEnrollmentModal.tsx index 4df8c1359..72be07e2a 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateTemplateEnrollmentModal.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateTemplateEnrollmentModal.tsx @@ -36,7 +36,7 @@ const schema = z.object({ caChain: z.string().optional(), passphrase: z.string().optional(), isEnabled: z.boolean(), - skipBootstrapCertValidation: z.boolean().optional().default(false) + disableBootstrapCertValidation: z.boolean().optional().default(false) }); export type FormData = z.infer; @@ -65,26 +65,26 @@ export const CertificateTemplateEnrollmentModal = ({ popUp, handlePopUpToggle }: const { mutateAsync: updateEstConfig } = useUpdateEstConfig(); const [isPassphraseFocused, setIsPassphraseFocused] = useToggle(false); - const skipBootstrapCertValidation = watch("skipBootstrapCertValidation"); + const disableBootstrapCertValidation = watch("disableBootstrapCertValidation"); useEffect(() => { - if (skipBootstrapCertValidation) { + if (disableBootstrapCertValidation) { setValue("caChain", ""); } - }, [skipBootstrapCertValidation]); + }, [disableBootstrapCertValidation]); useEffect(() => { if (data) { reset({ caChain: data.caChain, isEnabled: data.isEnabled, - skipBootstrapCertValidation: data.skipBootstrapCertValidation + disableBootstrapCertValidation: data.disableBootstrapCertValidation }); } else { reset({ caChain: "", isEnabled: false, - skipBootstrapCertValidation: false + disableBootstrapCertValidation: false }); } }, [data]); @@ -97,7 +97,7 @@ export const CertificateTemplateEnrollmentModal = ({ popUp, handlePopUpToggle }: caChain, passphrase, isEnabled, - skipBootstrapCertValidation + disableBootstrapCertValidation }); } else { if (!passphrase) { @@ -110,7 +110,7 @@ export const CertificateTemplateEnrollmentModal = ({ popUp, handlePopUpToggle }: caChain, passphrase, isEnabled, - skipBootstrapCertValidation + disableBootstrapCertValidation }); } @@ -167,7 +167,7 @@ export const CertificateTemplateEnrollmentModal = ({ popUp, handlePopUpToggle }: )} { return ( @@ -176,27 +176,27 @@ export const CertificateTemplateEnrollmentModal = ({ popUp, handlePopUpToggle }: onCheckedChange={(value) => field.onChange(value)} isChecked={field.value} > -

Skip Bootstrap Certificate Validation

+

Disable Bootstrap Certificate Validation

); }} /> - {!skipBootstrapCertValidation && ( + {!disableBootstrapCertValidation && ( (