Skip to content

[Key Vault] Adding error logging for when downloading an HSM's security domain fails. #29175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vcolin7 merged 1 commit into from
Jun 7, 2022
Merged

[Key Vault] Adding error logging for when downloading an HSM's security domain fails. #29175

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 43 additions & 37 deletions sdk/keyvault/test-resources-post.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,49 +12,49 @@ using namespace System.Security.Cryptography.X509Certificates
# Use same parameter names as declared in eng/common/New-TestResources.ps1 (assume validation therein).
[CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Medium')]
param (
[Parameter()]
[hashtable] $DeploymentOutputs,
[Parameter()]
[hashtable] $DeploymentOutputs,

# Captures any arguments from eng/common/New-TestResources.ps1 not declared here (no parameter errors).
[Parameter(ValueFromRemainingArguments = $true)]
$RemainingArguments
# Captures any arguments from eng/common/New-TestResources.ps1 not declared here (no parameter errors).
[Parameter(ValueFromRemainingArguments = $true)]
$RemainingArguments
)

# By default stop for any error.
if (!$PSBoundParameters.ContainsKey('ErrorAction')) {
$ErrorActionPreference = 'Stop'
$ErrorActionPreference = 'Stop'
}

function Log($Message) {
Write-Host ('{0} - {1}' -f [DateTime]::Now.ToLongTimeString(), $Message)
Write-Host ('{0} - {1}' -f [DateTime]::Now.ToLongTimeString(), $Message)
}

function New-X509Certificate2([string] $SubjectName) {

$rsa = [RSA]::Create(2048)
try {
$req = [CertificateRequest]::new(
[string] $SubjectName,
$rsa,
[HashAlgorithmName]::SHA256,
[RSASignaturePadding]::Pkcs1
)

# TODO: Add any KUs necessary to $req.CertificateExtensions

$NotBefore = [DateTimeOffset]::Now.AddDays(-1)
$NotAfter = $NotBefore.AddDays(365)

$req.CreateSelfSigned($NotBefore, $NotAfter)
}
finally {
$rsa.Dispose()
}
$rsa = [RSA]::Create(2048)
try {
$req = [CertificateRequest]::new(
[string] $SubjectName,
$rsa,
[HashAlgorithmName]::SHA256,
[RSASignaturePadding]::Pkcs1
)

# TODO: Add any KUs necessary to $req.CertificateExtensions

$NotBefore = [DateTimeOffset]::Now.AddDays(-1)
$NotAfter = $NotBefore.AddDays(365)

$req.CreateSelfSigned($NotBefore, $NotAfter)
}
finally {
$rsa.Dispose()
}
}

function Export-X509Certificate2([string] $Path, [X509Certificate2] $Certificate) {

$Certificate.Export([X509ContentType]::Pfx) | Set-Content $Path -AsByteStream
$Certificate.Export([X509ContentType]::Pfx) | Set-Content $Path -AsByteStream
}

function Export-X509Certificate2PEM([string] $Path, [X509Certificate2] $Certificate) {
Expand All @@ -69,33 +69,39 @@ $([Convert]::ToBase64String($Certificate.RawData, 'InsertLineBreaks'))

# Make sure we deployed a Managed HSM.
if (!$DeploymentOutputs['AZURE_MANAGEDHSM_ENDPOINT']) {
Log "Managed HSM not deployed; skipping activation"
exit
Log "Managed HSM not deployed; skipping activation"
exit
}

[Uri] $hsmUrl = $DeploymentOutputs['AZURE_MANAGEDHSM_ENDPOINT']
$hsmName = $hsmUrl.Host.Substring(0, $hsmUrl.Host.IndexOf('.'))

Log 'Creating 3 X509 certificates to activate security domain'
$wrappingFiles = foreach ($i in 0..2) {
$certificate = New-X509Certificate2 "CN=$($hsmUrl.Host)"
$certificate = New-X509Certificate2 "CN=$($hsmUrl.Host)"

$baseName = "$PSScriptRoot\$hsmName-certificate$i"
Export-X509Certificate2 "$baseName.pfx" $certificate
Export-X509Certificate2PEM "$baseName.cer" $certificate
$baseName = "$PSScriptRoot\$hsmName-certificate$i"
Export-X509Certificate2 "$baseName.pfx" $certificate
Export-X509Certificate2PEM "$baseName.cer" $certificate

Resolve-Path "$baseName.cer"
Resolve-Path "$baseName.cer"
}

Log "Downloading security domain from '$hsmUrl'"

$sdPath = "$PSScriptRoot\$hsmName-security-domain.key"
if (Test-Path $sdpath) {
Log "Deleting old security domain: $sdPath"
Remove-Item $sdPath -Force
Log "Deleting old security domain: $sdPath"
Remove-Item $sdPath -Force
}

Export-AzKeyVaultSecurityDomain -Name $hsmName -Quorum 2 -Certificates $wrappingFiles -OutputPath $sdPath
Export-AzKeyVaultSecurityDomain -Name $hsmName -Quorum 2 -Certificates $wrappingFiles -OutputPath $sdPath -ErrorAction SilentlyContinue -Verbose
if ( !$? ) {
Write-Host $Error[0].Exception
Write-Error $Error[0]

exit
}

Log "Security domain downloaded to '$sdPath'; Managed HSM is now active at '$hsmUrl'"

Expand Down