HLD for Redfish Certificate Provisioning Integration

[shreyansh-nexthop]

No description provided.

[mssonicbld]

/azp run

[azure-pipelines]

No pipelines are associated with this pull request.

[mssonicbld]

/azp run

[azure-pipelines]

No pipelines are associated with this pull request.

[mssonicbld]

/azp run

[azure-pipelines]

No pipelines are associated with this pull request.

[mssonicbld]

/azp run

[azure-pipelines]

No pipelines are associated with this pull request.

[mssonicbld]

/azp run

[azure-pipelines]

No pipelines are associated with this pull request.

[judyjoseph]

@qiluo-msft @yxieca for review

[mssonicbld]

/azp run

[azure-pipelines]

No pipelines are associated with this pull request.

[judyjoseph]

@shreyansh-nexthop you could refer to this config https://github.com/sonic-net/sonic-mgmt/tree/master/ansible/roles/testbed/nut/templates/config_patch/common .. we could have redfish config similar to how it is done for other services like gnmi/restapi/telemetry

Sample config as below, so with this we can use the attributes server_crt/server_key/ca_crt etc and the other configs to set the port as configurable, client_auth = cert, where CN validation is enforced OR none.

  // Similar to restapi/telemetry certs
 "REDFISH": {
    "config": {
      "client_auth": "cert|none",
      "port": "443"
    },
    "certs": {
      "server_crt": "/etc/sonic/redfish/redfishserver.cer",
      "server_key": "/etc/sonic/redfish/redfishserver.key",
      "ca_crt": "/etc/sonic/credentials/ROOT_CERTIFICATE.pem"
    }
 }

[shreyansh-nexthop]

@shreyansh-nexthop you could refer to this config https://github.com/sonic-net/sonic-mgmt/tree/master/ansible/roles/testbed/nut/templates/config_patch/common .. we could have redfish config similar to how it is done for other services like gnmi/restapi/telemetry

Sample config as below, so with this we can use the attributes server_crt/server_key/ca_crt etc and the other configs to set the port as configurable, client_auth = cert, where CN validation is enforced OR none.

  // Similar to restapi/telemetry certs
 "REDFISH": {
    "config": {
      "client_auth": "cert|none",
      "port": "443"
    },
    "certs": {
      "server_crt": "/etc/sonic/redfish/redfishserver.cer",
      "server_key": "/etc/sonic/redfish/redfishserver.key",
      "ca_crt": "/etc/sonic/credentials/ROOT_CERTIFICATE.pem"
    }
 }

Sure, this can be done, will update the HLD

[mssonicbld]

/azp run

[azure-pipelines]

No pipelines are associated with this pull request.

[judyjoseph]

So assuming the following is true

By default when BMC boots up for first time, the certificate bmcweb serves is not CA-signed. 
It is a self-signed certificate that bmcweb generates itself at first startup -- There is no CA, no truststore, and mTLS is off. In that default state /redfish/v1 works. 
Because no client certificate is required, you can reach it with curl -k https:///redfish/v1