PKI.CAServer

Class PKI.CAServer Extends (%Persistent, %SOAP.WebService) [ Deprecated ]

Certificate Authority server. Use with PKI.CAClient.

Parameters

SERVICENAME

Parameter SERVICENAME = "CAServer";

Name of the WebService.

NAMESPACE

Parameter NAMESPACE = "http://pki.intersystems.com";

SOAP Namespace for the WebService

USECLASSNAMESPACES

Parameter USECLASSNAMESPACES = 1;

Namespaces of referenced classes will be used in the WSDL.

IRISCA

Parameter IRISCA = "IRIS CA";

Properties

Name

Property Name As %String [ InitialExpression = {..#IRISCA}, Required ];

The default Certificate Authority server has the name "IRIS CA". There is at most one per InterSystems IRIS instance.

CAPath

Property CAPath As %String(MAXLEN = 200);

Path to this Certificate Authority server's Certificate (.cer) and Private Key (.key) files

CAFilename

Property CAFilename As %String [ Required ];

Name of this Certificate Authority server's Certificate (.cer) and Private Key (.key) files

AttributePrompt

Property AttributePrompt As %String(MAXLEN = 100) [ InitialExpression = "Country,State or Province,Locality,Organization,Organizational Unit,Common Name" ];

Prompts to use when building a %List for constructing a Subject Distinguished Name.

AttributeType

Property AttributeType As %String [ InitialExpression = "C,ST,L,O,OU,CN" ];

Attribute type keywords to use when building the "-subject" argument to the "openssl req" command

Days

Property Days As %Integer [ InitialExpression = 365, Required ];

Validity period (in days) for issued certificates

SMTPServer

Property SMTPServer As %String;

SMTP server for sending email notification on receipt of a Certificate Signing Request or issuance of a Certificate

SMTPUsername

Property SMTPUsername As %String;

SMTP username for sending email notification on receipt of a Certificate Signing Request or issuance of a Certificate

SMTPPassword

Property SMTPPassword As %String;

SMTP password for sending email notification on receipt of a Certificate Signing Request or issuance of a Certificate

AdminEmail

Property AdminEmail As %String;

Email address of the administrator of this Certificate Authority server. Email notification will be sent to this address on receipt of a Certificate Signing Request.

Methods

BuildSubject

Method BuildSubject(values As %List) As %String

Build the "-subject" argument to the "openssl req" command from a %List

SubmitCSR

Method SubmitCSR(csr As PKI.CSR) As %String [ WebMethod ]

Web method for submitting a Certificate Signing Request. This method saves the PKI.CSR object and sends notification to the email address of the administrator of this Certificate Authority server.
Parameter:
csr - a PKI.CSR object
Return value:
String describing successful Certificate Signing Request submission, or a SOAP fault on error

ListCertificates

Method ListCertificates(hostname As %String, instance As %String) As %XML.DataSet [ WebMethod ]

Web method for retrieving a list of X.509 Certificates issued by this Certificate Authority server.
Return value:
An %XML.DataSet object

GetCertificate

Method GetCertificate(number As %String) As PKI.Certificate [ WebMethod ]

Web method for retrieving an X.509 Certificate issued by this Certificate Authority server.
Parameter:
number - serial number of the X.509 Certificate requested, or 0 to request this Certificate Authority server's X.509 Certificate
Return value:
A PKI.Certificate object

Sign

Method Sign(name As %String, password As %String, certType As %Integer, ByRef st As %Status) As %String

Issue an X.509 Certificate for a Certificate Signing Request. This method creates and saves a PKI.Certificate object and sends notification to the email address of the local technical contact of the Certificate Authority client that generated the Certificate Signing Request.
Parameters:
name - Name of the Certificate Signing Request to be processed
password - Password for this Certificate Authority server's Private Key file
certType - Intended usage of the issued certificate
1 = TLS/SSL, XML encryption and signature verification
2 = Intermediate Certificate Authority server
st - On return, contains a status code
Return value:
String describing successful Certificate issuance, or error

Configure

ClassMethod Configure(server As PKI.CAServer, attrList As %List, password As %String, days As %Integer, ByRef st As %Status) As %String

Two use cases:

1. Configure this Certificate Authority server.
   Must be called before Certificate Signing Requests can be submitted or Certificates issued. Creates the OpenSSL configuration file "openssl.cnf" if it does not exist. When called for the first time, this method creates this Certificate Authority server's Certificate (.cer) and Private Key (.key) files, and creates and saves its PKI.Certificate object. Once created these can not be changed. The other properties of this Certificate Authority server can be updated later.
   Parameters:
   server - PKI.CAServer object, with all required properties set
   attrList - %List containing attribute values to be used in constructing this Certificate Authority server's Subject Distinguished Name (first invocation only)
   password - Password used to encrypt Private Key file (first invocation only)
   days - desired validity period of CA certificate, in days
   st - On return, contains a status code
   Return value:
   String describing successful configuration, or error

2. Update the openssl.cnf file to the latest version
   Calling ##class(PKI.CAServer).Configure() with no arguments will create or update the openssl.cnf file to the latest version.

ConfigureData

Method ConfigureData() [ ProcedureBlock = 0 ]

%OnAfterSave

Method %OnAfterSave(insert As %Boolean) As %Status [ Internal, Private ]

%OnAfterDelete

ClassMethod %OnAfterDelete(oid As %ObjectIdentity) As %Status [ Internal, Private ]

CheckWebApp

ClassMethod CheckWebApp() As %Status [ Internal ]

This method will ensure that the /isc/pki web application is enabled if the default CAServer instance is configured and disabled otherwise. If the application does not exist this will return an error.