Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

quote handling #6

Closed
wants to merge 10 commits into from
Closed

quote handling #6

wants to merge 10 commits into from

Conversation

amiller
Copy link
Contributor

@amiller amiller commented Sep 6, 2024

  • Good riddance to Gramine-RATLS. We're managing our own TLS now to have a trustless domain
  • If the private key exists (sealed file), use it as the TLS key
  • Otherwise, generate a fresh private key and save it
  • Also generate the Certificate Signing Request. Output this to untrusted file
  • If the certificate isn't available (untrusted file), wait for it

Later we could include some automation to run certbot appropriately to fulfill the CSR but that's not the business of the enclave

@amiller amiller self-assigned this Sep 6, 2024
amiller
amiller commented Sep 6, 2024
View reviewed changes
Copy link
Contributor Author

@amiller amiller left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks great, only request is putting the quote to a file

src/main.rs Outdated Show resolved Hide resolved
@amiller amiller marked this pull request as ready for review September 7, 2024 00:09
amiller
amiller commented Sep 8, 2024
View reviewed changes
src/main.rs Outdated
let cert = fs::read(CERTIFICATE_PATH).await.expect("cert not found");
let config =
RustlsConfig::from_pem(cert, pkey.private_key_to_pem_pkcs8().unwrap()).await.unwrap();
let addr = SocketAddr::from(([0, 0, 0, 0], 8001));
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ports are good as untrusted env parameters, give the host some fleixiblity

amiller
amiller commented Sep 8, 2024
View reviewed changes
Copy link
Contributor Author

@amiller amiller left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Session handling looks fine

@amiller amiller closed this Sep 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rpalakkal rpalakkal rpalakkal left review comments

Assignees

@amiller amiller

@rpalakkal rpalakkal

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@amiller @rpalakkal