tsvetlin · Mar 31, 2020 · Feb 18, 2020 · Feb 25, 2020 · Feb 25, 2020 · Feb 25, 2020
diff --git a/.gitignore b/.gitignore
@@ -31,6 +31,7 @@ wrapper
 /mvnw.cmd
 /orchestrator/target
 /serviceregistry/target
+/certificate-authority/target
 /.settings
 /authorization/.settings
 /core-common/.settings

diff --git a/README.md b/README.md
@@ -74,7 +74,14 @@ Please be aware, that 4.1.3 is __NOT__ backwards compatible with 4.1.2. If you h
 	       * [Client](#gateway_endpoints_client)
            * [Private](#gateway_endpoints_private)
            * [Management](#gateway_endpoints_mgmt)
-	6. [QoS Monitor (Quality of Service Monitor)](#qos_monitor)
+    7. [Certificate Authority](#ca)
+       * [System Design Description Overview](#ca_sdd)
+       * [Services and Use Cases](#ca_usecases)  
+       * [Endpoints](#ca_endpoints)
+	       * [Client](#ca_endpoints_client)
+           * [Private](#ca_endpoints_private)
+           * [Management](#ca_endpoints_mgmt)
+	  8. [QoS Monitor (Quality of Service Monitor)](#qos_monitor)
        * [System Design Description Overview](#qos_monitor_sdd)
        * [Services and Use Cases](#qos_monitor_usecases)  
        * [Endpoints](#qos_monitor_endpoints)
@@ -6273,6 +6280,106 @@ __ActiveSession__ is the output.
 | `responseControlQueue` | control queue of response messaging through the the Relay |
 | `sessionStartedAt` | Time stamp of session start |
 
+<a name="ca" />
+
+# Certificate Authority
+
+<a name="ca_sdd" />
+
+## System Design Description Overview
+
+The purpose of the Certificate Authority supporting core system is issuing signed certificates to be used in the local cloud.
+
+<a name="ca_provided_services" />
+
+## Provided services
+
+The Certificate Authority provides the following services:
+* [Echo](#ca_endpoints_get_echo)
+* [Certificate signing](#ca_endpoints_sign)
+
+<a name="ca_usecases" />
+
+## Use cases
+
+The main use case of the Certificate Authority is to issue signed certificates to new consumers coming via the Onboarding Controller.
+
+<a name="ca_endpoints" />
+
+## Endpoints
+
+<a name="ca_endpoints_client" />
+
+### Client endpoint description<br />
+
+| Function | URL subpath | Method | Input | Output |
+| -------- | ----------- | ------ | ----- | ------ |
+| [Echo](#ca_endpoints_get_echo) | /echo | GET    | -    | OK     |
+
+<a name="ca_endpoints_private" />
+
+### Private endpoint description<br />
+
+| Function | URL subpath | Method | Input | Output |
+| -------- | ----------- | ------ | ----- | ------ |
+| [Sign CSR with the Cloud Certificate](#ca_endpoints_sign) | /sign | POST | CertificateSigningRequest | [CertificateSigningResponse](#ca_certificate_signing_response) |
+
+<a name="ca_endpoints_get_echo" />
+
+### Echo 
+```
+GET /certificate-authority/echo
+```
+
+Returns a "Got it" message with the purpose of testing the core service availability.
+
+<a name="ca_endpoints_sign" />
+
+### Sign CSR with the Cloud Certificate
+
+```
+POST /certificate-authority/sign
+```
+
+Returns the whole certificate chain beginning with the newly generated leaf certificate and ending with the root certificate.
+
+Each certificate's issuer is the same as the subject of the following one. The issuer of the root certificate is the same as the subject.
+
+__Sign CSR with the Cloud Certificate__ inputs:
+
+`https://ca_ip:ca_port/certificate-authority/sign`
+
+| __Sign CSR with the Cloud Certificate__ query parameters |
+| ------------------------------------------------------- |
+
+| Parameter | Description | Necessity | Format/Limitations |
+| --------- | ----------- | --------- | ----------- |
+| `encodedCSR` | PKCS #10 Certificate Signing Request | mandatory | Base64 encoded CSR |
+
+<a name="ca_certificate_signing_response" />
+
+__Sign CSR with the Cloud Certificate__ output :
+
+```json
+{
+  "certificateChain": [
+    "<generated client certificate>",
+    "<cloud certificate>",
+    "<root certificate>"
+  ]
+}
+```
+
+| Field | Description |
+| ----- | ----------- |
+| `certificateChain` | The whole certificate chain in an array of PEM encoded strings |
+
+<a name="ca_endpoints_mgmt" />
+
+### Management endpoint description<br />
+
+The Certificate Authority does not have management endpoints.
+
 <a name="qos_monitor" />
 
 # QOS MONITOR (QUALITY OF SERVICE MONITOR)

diff --git a/certificate-authority/.classpath b/certificate-authority/.classpath
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<classpath>
+	<classpathentry kind="src" output="target/classes" path="src/main/java">
+		<attributes>
+			<attribute name="optional" value="true"/>
+			<attribute name="maven.pomderived" value="true"/>
+		</attributes>
+	</classpathentry>
+	<classpathentry excluding="**" kind="src" output="target/classes" path="src/main/resources">
+		<attributes>
+			<attribute name="maven.pomderived" value="true"/>
+		</attributes>
+	</classpathentry>
+	<classpathentry kind="src" output="target/test-classes" path="src/test/java">
+		<attributes>
+			<attribute name="optional" value="true"/>
+			<attribute name="maven.pomderived" value="true"/>
+			<attribute name="test" value="true"/>
+		</attributes>
+	</classpathentry>
+	<classpathentry excluding="**" kind="src" output="target/test-classes" path="src/test/resources">
+		<attributes>
+			<attribute name="maven.pomderived" value="true"/>
+			<attribute name="test" value="true"/>
+		</attributes>
+	</classpathentry>
+	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-11">
+		<attributes>
+			<attribute name="maven.pomderived" value="true"/>
+		</attributes>
+	</classpathentry>
+	<classpathentry kind="con" path="org.eclipse.m2e.MAVEN2_CLASSPATH_CONTAINER">
+		<attributes>
+			<attribute name="maven.pomderived" value="true"/>
+		</attributes>
+	</classpathentry>
+	<classpathentry kind="src" path="target/generated-sources/annotations">
+		<attributes>
+			<attribute name="optional" value="true"/>
+			<attribute name="maven.pomderived" value="true"/>
+			<attribute name="ignore_optional_problems" value="true"/>
+			<attribute name="m2e-apt" value="true"/>
+		</attributes>
+	</classpathentry>
+	<classpathentry kind="src" output="target/test-classes" path="target/generated-test-sources/test-annotations">
+		<attributes>
+			<attribute name="optional" value="true"/>
+			<attribute name="maven.pomderived" value="true"/>
+			<attribute name="ignore_optional_problems" value="true"/>
+			<attribute name="m2e-apt" value="true"/>
+			<attribute name="test" value="true"/>
+		</attributes>
+	</classpathentry>
+	<classpathentry kind="output" path="target/classes"/>
+</classpath>
diff --git a/certificate-authority/.project b/certificate-authority/.project
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>arrowhead-certificate-authority</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.eclipse.jdt.core.javabuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.m2e.core.maven2Builder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.eclipse.jdt.core.javanature</nature>
+		<nature>org.eclipse.m2e.core.maven2Nature</nature>
+	</natures>
+</projectDescription>
diff --git a/certificate-authority/pom.xml b/certificate-authority/pom.xml
@@ -0,0 +1,153 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>eu.arrowhead</groupId>
+		<artifactId>core</artifactId>
+		<version>${revision}</version>
+	</parent>
+
+	<artifactId>arrowhead-certificate-authority</artifactId>
+	<packaging>jar</packaging>
+	<name>Arrowhead Certificate Authority</name>
+	<description>Certificate Authority core service</description>
+
+	<dependencies>
+		<dependency>
+			<groupId>eu.arrowhead</groupId>
+			<artifactId>arrowhead-core-common</artifactId>
+			<version>${revision}</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.bouncycastle</groupId>
+			<artifactId>bcprov-jdk15on</artifactId>
+			<version>${bouncy.castle.version}</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.bouncycastle</groupId>
+			<artifactId>bcpkix-jdk15on</artifactId>
+			<version>${bouncy.castle.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>org.jetbrains</groupId>
+			<artifactId>annotations</artifactId>
+			<version>18.0.0</version>
+			<scope>compile</scope>
+		</dependency>
+	</dependencies>
+
+	<build>
+		<plugins>
+			<plugin>
+				<artifactId>maven-resources-plugin</artifactId>
+				<version>${mvn.resources.version}</version>
+				<executions>
+					<execution>
+						<id>copy-resources</id>
+						<!-- here the phase you need -->
+						<phase>validate</phase>
+						<goals>
+							<goal>copy-resources</goal>
+						</goals>
+						<configuration>
+							<outputDirectory>${basedir}/target</outputDirectory>
+							<resources>
+								<resource>
+									<directory>src/main/resources</directory>
+									<includes>
+										<include>application.properties</include>
+										<include>log4j2.xml</include>
+									</includes>
+								</resource>
+							</resources>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+
+			<plugin>
+				<artifactId>jdeb</artifactId>
+				<groupId>org.vafer</groupId>
+				<version>1.8</version>
+				<executions>
+					<execution>
+						<phase>package</phase>
+						<goals>
+							<goal>jdeb</goal>
+						</goals>
+						<configuration>
+							<snapshotExpand>true</snapshotExpand>
+							<snapshotTemplate>[YYMMddHHmm].${git.commit.id.abbrev}</snapshotTemplate>
+							<deb>target/${project.artifactId}_${revision}.deb</deb>
+							<verbose>true</verbose>
+							<controlDir>${basedir}/src/deb/control</controlDir>
+							<dataSet>
+								<data>
+									<type>file</type>
+									<src>${project.build.directory}/${project.build.finalName}.jar</src>
+									<mapper>
+										<type>perm</type>
+										<prefix>/usr/share/arrowhead/certificate_authority</prefix>
+										<filemode>755</filemode>
+									</mapper>
+								</data>
+
+								<data>
+									<type>link</type>
+									<linkName>/usr/share/arrowhead/certificate_authority/${project.artifactId}.jar</linkName>
+									<linkTarget>/usr/share/arrowhead/certificate_authority/${project.build.finalName}.jar</linkTarget>
+								</data>
+
+								<data>
+									<type>file</type>
+									<src>${project.build.directory}/log4j2.xml</src>
+									<mapper>
+										<type>perm</type>
+										<prefix>/etc/arrowhead/systems/certificate_authority</prefix>
+										<filemode>644</filemode>
+									</mapper>
+								</data>
+
+								<data>
+									<type>file</type>
+									<src>${project.build.directory}/application.properties</src>
+									<mapper>
+										<type>perm</type>
+										<prefix>/etc/arrowhead/systems/certificate_authority</prefix>
+										<filemode>644</filemode>
+									</mapper>
+								</data>
+
+								<data>
+									<type>link</type>
+									<linkName>/usr/share/arrowhead/certificate_authority/application.properties</linkName>
+									<linkTarget>/etc/arrowhead/systems/certificate_authority/application.properties</linkTarget>
+								</data>
+
+								<data>
+									<type>file</type>
+									<src>${project.basedir}/src/deb/arrowhead-certificate-authority.service</src>
+									<mapper>
+										<type>perm</type>
+										<prefix>/etc/systemd/system</prefix>
+										<filemode>644</filemode>
+									</mapper>
+								</data>
+
+								<data>
+									<type>file</type>
+									<src>${project.basedir}/../scripts/certificate_authority_privileges.sql</src>
+									<mapper>
+										<type>perm</type>
+										<prefix>/usr/share/arrowhead/conf</prefix>
+									</mapper>
+								</data>
+							</dataSet>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+		</plugins>
+	</build>
+</project>
diff --git a/certificate-authority/src/deb/arrowhead-certificate-authority.service b/certificate-authority/src/deb/arrowhead-certificate-authority.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=arrowhead-certificate-authority
+After=network.target mysql.target
+
+[Service]
+WorkingDirectory=/etc/arrowhead/systems/certificate_authority
+ExecStart=/usr/bin/java -Dlog4j.configurationFile=file:/etc/arrowhead/systems/certificate_authority/log4j2.xml -jar /usr/share/arrowhead/certificate_authority/arrowhead-certificate-authority.jar
+ExecStartPost=/bin/bash -c 'sleep 10'
+TimeoutStopSec=5
+Type=simple
+User=arrowhead
+Group=arrowhead
+
+[Install]
+WantedBy=default.target