Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat：根证书导入增加指纹白名单校验

Browse Source
This commit is contained in:
waner 2026-05-06 15:58:16 +08:00
parent 8287289167
commit 855ea1247b
6 changed files with 137 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
README.md
View File

@ -110,6 +110,7 @@ Open:
- `POST /api/v1/crls/delete`
当前实现边界：
- 可通过 `tms.cert.trusted-root-fingerprints` 配置根 CA 证书 SHA-256 指纹白名单；配置后根 CA 导入必须命中白名单，中间 CA 仍按当前可信链校验。
- CRL 文件支持 PEM / DER 格式，导入接口会先创建后台任务并返回 `taskId`，前端通过 `POST /api/v1/crls/import-tasks/detail` 轮询 `PENDING/RUNNING/SUCCESS/FAILED` 状态。
- 后台导入完成后保存 CRL metadata 和 CRL 内每条 revoked certificate 明细；原始 CRL 文件只作为临时文件参与解析，任务结束后删除，不作为业务数据长期保存。
- CRL issuer 通过可信 CA 的 issuer DN 候选和实际 CRL 签名验证解析。

4
config/application.yml.example
View File

@ -41,6 +41,10 @@ tms:
storage:
upload-base-dir: /home/tms/uploads
max-file-size-bytes: 104857600
cert:
# 允许导入为根 CA 信任锚的 SHA-256 指纹白名单。为空表示不限制；生产建议填写线下确认的根 CA 指纹。
trusted-root-fingerprints:
- ""
init:
executor:
mode: LOCAL

23
src/main/java/com/cisd/tms/modules/cert/config/CertProperties.java Normal file
View File

@ -0,0 +1,23 @@
package com.cisd.tms.modules.cert.config;
import org.springframework.boot.context.properties.ConfigurationProperties;
import java.util.ArrayList;
import java.util.List;
@ConfigurationProperties(prefix = "tms.cert")
public class CertProperties {
/**
* 允许导入为信任锚的根 CA 证书 SHA-256 指纹。为空时保持兼容，不限制根 CA 导入。
*/
private List<String> trustedRootFingerprints = new ArrayList<>();
public List<String> getTrustedRootFingerprints() {
return trustedRootFingerprints;
}
public void setTrustedRootFingerprints(List<String> trustedRootFingerprints) {
this.trustedRootFingerprints = trustedRootFingerprints == null ? new ArrayList<>() : trustedRootFingerprints;
}
}

52
src/main/java/com/cisd/tms/modules/cert/service/TrustedCertService.java
View File

@ -9,13 +9,16 @@ import com.cisd.tms.modules.cert.dto.TrustedCertDeleteRequest;
import com.cisd.tms.modules.cert.dto.TrustedCertDetailResponse;
import com.cisd.tms.modules.cert.dto.TrustedCertItemResponse;
import com.cisd.tms.modules.cert.dto.TrustedCertListRequest;
import com.cisd.tms.modules.cert.config.CertProperties;
import com.cisd.tms.modules.cert.entity.TrustedCertEntity;
import com.cisd.tms.modules.cert.repository.CertificateRepository;
import com.cisd.tms.modules.cert.repository.TrustedCertRepository;
import com.cisd.tms.modules.cert.support.CertPemSupport;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import org.springframework.util.StringUtils;
import org.springframework.web.multipart.MultipartFile;
import java.nio.charset.StandardCharsets;
@ -24,7 +27,10 @@ import java.security.cert.X509CRL;
import java.security.cert.X509Certificate;
import java.time.LocalDateTime;
import java.time.ZoneId;
import java.util.Locale;
import java.util.List;
import java.util.Set;
import java.util.stream.Collectors;
@Service
public class TrustedCertService {
@ -40,13 +46,32 @@ public class TrustedCertService {
private final TrustedCertRepository trustedCertRepository;
private final CertificateRepository certificateRepository;
private final Set<String> trustedRootFingerprints;
public TrustedCertService(
TrustedCertRepository trustedCertRepository,
CertificateRepository certificateRepository
) {
this(trustedCertRepository, certificateRepository, List.of());
}
@Autowired
public TrustedCertService(
TrustedCertRepository trustedCertRepository,
CertificateRepository certificateRepository,
CertProperties certProperties
) {
this(trustedCertRepository, certificateRepository, certProperties.getTrustedRootFingerprints());
}
TrustedCertService(
TrustedCertRepository trustedCertRepository,
CertificateRepository certificateRepository,
List<String> trustedRootFingerprints
) {
this.trustedCertRepository = trustedCertRepository;
this.certificateRepository = certificateRepository;
this.trustedRootFingerprints = normalizeFingerprints(trustedRootFingerprints);
}
public Page<TrustedCertItemResponse> list(TrustedCertListRequest request) {
@ -69,6 +94,7 @@ public class TrustedCertService {
}
int caLevel = isSelfSigned(certificate) ? 0 : 1;
if (caLevel == 0) {
assertRootFingerprintAllowed(fingerprint);
// 根 CA 必须能自签自验，防止把 subject=issuer 的伪造证书放入信任锚。
certificate.verify(certificate.getPublicKey(), "BC");
} else {
@ -269,4 +295,30 @@ public class TrustedCertService {
private boolean isSelfSigned(X509Certificate certificate) {
return certificate.getSubjectX500Principal().equals(certificate.getIssuerX500Principal());
}
private void assertRootFingerprintAllowed(String fingerprint) {
if (trustedRootFingerprints.isEmpty()) {
return;
}
if (!trustedRootFingerprints.contains(normalizeFingerprint(fingerprint))) {
throw new BizException(ErrorCode.BAD_REQUEST.getCode(), "根CA证书指纹不在白名单中");
}
}
private Set<String> normalizeFingerprints(List<String> fingerprints) {
if (fingerprints == null) {
return Set.of();
}
return fingerprints.stream()
.map(this::normalizeFingerprint)
.filter(StringUtils::hasText)
.collect(Collectors.toUnmodifiableSet());
}
private String normalizeFingerprint(String fingerprint) {
if (!StringUtils.hasText(fingerprint)) {
return "";
}
return fingerprint.replaceAll("[^0-9A-Fa-f]", "").toUpperCase(Locale.ROOT);
}
}

2
src/main/resources/application.yml
View File

@ -50,6 +50,8 @@ tms:
# 上传文件大小上限（字节）。
max-file-size-bytes: ${TMS_FILE_STORAGE_MAX_FILE_SIZE_BYTES:104857600}
cert:
# 允许导入为根 CA 信任锚的 SHA-256 指纹白名单，多个值用英文逗号分隔；为空时不限制根 CA 导入。
trusted-root-fingerprints: ${TMS_CERT_TRUSTED_ROOT_FINGERPRINTS:}
crl:
# CRL 导入临时目录；原始文件只在解析过程中暂存，导入结束后删除。
temp-dir: ${TMS_CERT_CRL_TEMP_DIR:/home/tms/tmp/crl-import}

55
src/test/java/com/cisd/tms/modules/cert/service/TrustedCertServiceTest.java
View File

@ -30,6 +30,7 @@ import java.time.Instant;
import java.time.temporal.ChronoUnit;
import java.util.Date;
import java.util.List;
import java.util.Locale;
import java.util.Optional;
import javax.security.auth.x500.X500Principal;
@ -214,6 +215,56 @@ class TrustedCertServiceTest {
assertEquals("RSA", captor.getValue().getAlgoType());
}
@Test
void shouldAllowRootCaWhenFingerprintMatchesWhitelist() throws Exception {
TrustedCertRepository trustedCertRepository = Mockito.mock(TrustedCertRepository.class);
KeyPair rootKeyPair = sm2KeyPair();
X509Certificate root = certificate(
rootKeyPair,
rootKeyPair,
"CN=Root",
"CN=Root",
true,
KeyUsage.keyCertSign | KeyUsage.cRLSign
);
TrustedCertService service = new TrustedCertService(
trustedCertRepository,
Mockito.mock(CertificateRepository.class),
List.of(colonFingerprint(CertPemSupport.sha256Fingerprint(root)).toLowerCase(Locale.ROOT))
);
Mockito.when(trustedCertRepository.findByFingerprint(Mockito.any())).thenReturn(Optional.empty());
Mockito.when(trustedCertRepository.save(Mockito.any())).thenAnswer(invocation -> invocation.getArgument(0));
service.importTrusted(multipart(root), "root");
Mockito.verify(trustedCertRepository).save(Mockito.any());
}
@Test
void shouldRejectRootCaWhenFingerprintDoesNotMatchWhitelist() throws Exception {
TrustedCertRepository trustedCertRepository = Mockito.mock(TrustedCertRepository.class);
KeyPair rootKeyPair = sm2KeyPair();
X509Certificate root = certificate(
rootKeyPair,
rootKeyPair,
"CN=Root",
"CN=Root",
true,
KeyUsage.keyCertSign | KeyUsage.cRLSign
);
TrustedCertService service = new TrustedCertService(
trustedCertRepository,
Mockito.mock(CertificateRepository.class),
List.of("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")
);
Mockito.when(trustedCertRepository.findByFingerprint(Mockito.any())).thenReturn(Optional.empty());
BizException exception = assertThrows(BizException.class, () -> service.importTrusted(multipart(root), "root"));
assertEquals("根CA证书指纹不在白名单中", exception.getMessage());
Mockito.verify(trustedCertRepository, Mockito.never()).save(Mockito.any());
}
private KeyPair sm2KeyPair() throws Exception {
KeyPairGenerator generator = KeyPairGenerator.getInstance("EC", "BC");
generator.initialize(new ECGenParameterSpec("sm2p256v1"));
@ -301,4 +352,8 @@ class TrustedCertServiceTest {
CertPemSupport.toPem(certificate).getBytes()
);
}
private String colonFingerprint(String fingerprint) {
return fingerprint.replaceAll("(.{2})(?=.)", "$1:");
}
}