1 #include "config.h" 2 3 #include "certificate.hpp" 4 5 #include "certs_manager.hpp" 6 #include "x509_utils.hpp" 7 8 #include <openssl/asn1.h> 9 #include <openssl/bio.h> 10 #include <openssl/buffer.h> 11 #include <openssl/err.h> 12 #include <openssl/evp.h> 13 #include <openssl/obj_mac.h> 14 #include <openssl/objects.h> 15 #include <openssl/opensslv.h> 16 #include <openssl/pem.h> 17 #include <openssl/x509v3.h> 18 19 #include <cstdint> 20 #include <cstdio> 21 #include <cstdlib> 22 #include <exception> 23 #include <filesystem> 24 #include <fstream> 25 #include <map> 26 #include <phosphor-logging/elog-errors.hpp> 27 #include <phosphor-logging/elog.hpp> 28 #include <phosphor-logging/log.hpp> 29 #include <utility> 30 #include <vector> 31 #include <watch.hpp> 32 #include <xyz/openbmc_project/Certs/error.hpp> 33 #include <xyz/openbmc_project/Common/error.hpp> 34 35 namespace phosphor::certs 36 { 37 38 namespace 39 { 40 namespace fs = std::filesystem; 41 using ::phosphor::logging::elog; 42 using ::phosphor::logging::entry; 43 using ::phosphor::logging::level; 44 using ::phosphor::logging::log; 45 using ::phosphor::logging::report; 46 using InvalidCertificateError = 47 ::sdbusplus::xyz::openbmc_project::Certs::Error::InvalidCertificate; 48 using ::phosphor::logging::xyz::openbmc_project::Certs::InvalidCertificate; 49 using ::sdbusplus::xyz::openbmc_project::Common::Error::InternalFailure; 50 51 // RAII support for openSSL functions. 52 using BIOMemPtr = std::unique_ptr<BIO, decltype(&::BIO_free)>; 53 using X509StorePtr = std::unique_ptr<X509_STORE, decltype(&::X509_STORE_free)>; 54 using ASN1TimePtr = std::unique_ptr<ASN1_TIME, decltype(&ASN1_STRING_free)>; 55 using EVPPkeyPtr = std::unique_ptr<EVP_PKEY, decltype(&::EVP_PKEY_free)>; 56 using BufMemPtr = std::unique_ptr<BUF_MEM, decltype(&::BUF_MEM_free)>; 57 58 // Refer to schema 2018.3 59 // http://redfish.dmtf.org/schemas/v1/Certificate.json#/definitions/KeyUsage for 60 // supported KeyUsage types in redfish 61 // Refer to 62 // https://github.com/openssl/openssl/blob/master/include/openssl/x509v3.h for 63 // key usage bit fields 64 std::map<uint8_t, std::string> keyUsageToRfStr = { 65 {KU_DIGITAL_SIGNATURE, "DigitalSignature"}, 66 {KU_NON_REPUDIATION, "NonRepudiation"}, 67 {KU_KEY_ENCIPHERMENT, "KeyEncipherment"}, 68 {KU_DATA_ENCIPHERMENT, "DataEncipherment"}, 69 {KU_KEY_AGREEMENT, "KeyAgreement"}, 70 {KU_KEY_CERT_SIGN, "KeyCertSign"}, 71 {KU_CRL_SIGN, "CRLSigning"}, 72 {KU_ENCIPHER_ONLY, "EncipherOnly"}, 73 {KU_DECIPHER_ONLY, "DecipherOnly"}}; 74 75 // Refer to schema 2018.3 76 // http://redfish.dmtf.org/schemas/v1/Certificate.json#/definitions/KeyUsage for 77 // supported Extended KeyUsage types in redfish 78 std::map<uint8_t, std::string> extendedKeyUsageToRfStr = { 79 {NID_server_auth, "ServerAuthentication"}, 80 {NID_client_auth, "ClientAuthentication"}, 81 {NID_email_protect, "EmailProtection"}, 82 {NID_OCSP_sign, "OCSPSigning"}, 83 {NID_ad_timeStamping, "Timestamping"}, 84 {NID_code_sign, "CodeSigning"}}; 85 86 /** 87 * @brief Dumps the PEM encoded certificate to installFilePath 88 * 89 * @param[in] pem - PEM encoded X509 certificate buffer. 90 * @param[in] certFilePath - Path to the destination file. 91 * 92 * @return void 93 */ 94 95 void dumpCertificate(const std::string& pem, const std::string& certFilePath) 96 { 97 std::ofstream outputCertFileStream; 98 99 outputCertFileStream.exceptions( 100 std::ofstream::failbit | std::ofstream::badbit | std::ofstream::eofbit); 101 102 try 103 { 104 outputCertFileStream.open(certFilePath, std::ios::out); 105 outputCertFileStream << pem << "\n" << std::flush; 106 outputCertFileStream.close(); 107 } 108 catch (const std::exception& e) 109 { 110 log<level::ERR>("Failed to dump certificate", entry("ERR=%s", e.what()), 111 entry("SRC_PEM=%s", pem.c_str()), 112 entry("DST=%s", certFilePath.c_str())); 113 elog<InternalFailure>(); 114 } 115 } 116 } // namespace 117 118 void Certificate::copyCertificate(const std::string& certSrcFilePath, 119 const std::string& certFilePath) 120 { 121 // Copy the certificate to the installation path 122 // During bootup will be parsing existing file so no need to 123 // copy it. 124 if (certSrcFilePath != certFilePath) 125 { 126 std::ifstream inputCertFileStream; 127 std::ofstream outputCertFileStream; 128 inputCertFileStream.exceptions(std::ifstream::failbit | 129 std::ifstream::badbit | 130 std::ifstream::eofbit); 131 outputCertFileStream.exceptions(std::ofstream::failbit | 132 std::ofstream::badbit | 133 std::ofstream::eofbit); 134 try 135 { 136 inputCertFileStream.open(certSrcFilePath); 137 outputCertFileStream.open(certFilePath, std::ios::out); 138 outputCertFileStream << inputCertFileStream.rdbuf() << std::flush; 139 inputCertFileStream.close(); 140 outputCertFileStream.close(); 141 } 142 catch (const std::exception& e) 143 { 144 log<level::ERR>("Failed to copy certificate", 145 entry("ERR=%s", e.what()), 146 entry("SRC=%s", certSrcFilePath.c_str()), 147 entry("DST=%s", certFilePath.c_str())); 148 elog<InternalFailure>(); 149 } 150 } 151 } 152 153 std::string 154 Certificate::generateUniqueFilePath(const std::string& directoryPath) 155 { 156 char* filePath = tempnam(directoryPath.c_str(), nullptr); 157 if (filePath == nullptr) 158 { 159 log<level::ERR>( 160 "Error occurred while creating random certificate file path", 161 entry("DIR=%s", directoryPath.c_str())); 162 elog<InternalFailure>(); 163 } 164 std::string filePathStr(filePath); 165 free(filePath); 166 return filePathStr; 167 } 168 169 std::string Certificate::generateAuthCertFileX509Path( 170 const std::string& certSrcFilePath, const std::string& certDstDirPath) 171 { 172 const internal::X509Ptr cert = loadCert(certSrcFilePath); 173 unsigned long hash = X509_subject_name_hash(cert.get()); 174 static constexpr auto CERT_HASH_LENGTH = 9; 175 char hashBuf[CERT_HASH_LENGTH]; 176 177 snprintf(hashBuf, CERT_HASH_LENGTH, "%08lx", hash); 178 179 const std::string certHash(hashBuf); 180 for (size_t i = 0; i < maxNumAuthorityCertificates; ++i) 181 { 182 const std::string certDstFileX509Path = 183 certDstDirPath + "/" + certHash + "." + std::to_string(i); 184 if (!fs::exists(certDstFileX509Path)) 185 { 186 return certDstFileX509Path; 187 } 188 } 189 190 log<level::ERR>("Authority certificate x509 file path already used", 191 entry("DIR=%s", certDstDirPath.c_str())); 192 elog<InternalFailure>(); 193 } 194 195 std::string 196 Certificate::generateAuthCertFilePath(const std::string& certSrcFilePath) 197 { 198 // If there is a certificate file path (which means certificate replacement 199 // is doing) use it (do not create new one) 200 if (!certFilePath.empty()) 201 { 202 return certFilePath; 203 } 204 // If source certificate file is located in the certificates directory use 205 // it (do not create new one) 206 else if (fs::path(certSrcFilePath).parent_path().string() == 207 certInstallPath) 208 { 209 return certSrcFilePath; 210 } 211 // Otherwise generate new file name/path 212 else 213 { 214 return generateUniqueFilePath(certInstallPath); 215 } 216 } 217 218 std::string 219 Certificate::generateCertFilePath(const std::string& certSrcFilePath) 220 { 221 if (certType == CertificateType::Authority) 222 { 223 return generateAuthCertFilePath(certSrcFilePath); 224 } 225 else 226 { 227 return certInstallPath; 228 } 229 } 230 231 Certificate::Certificate(sdbusplus::bus::bus& bus, const std::string& objPath, 232 CertificateType type, const std::string& installPath, 233 const std::string& uploadPath, Watch* watch, 234 Manager& parent) : 235 internal::CertificateInterface(bus, objPath.c_str(), true), 236 objectPath(objPath), certType(type), certInstallPath(installPath), 237 certWatch(watch), manager(parent) 238 { 239 auto installHelper = [this](const auto& filePath) { 240 if (!compareKeys(filePath)) 241 { 242 elog<InvalidCertificateError>(InvalidCertificate::REASON( 243 "Private key does not match the Certificate")); 244 }; 245 }; 246 typeFuncMap[CertificateType::Server] = installHelper; 247 typeFuncMap[CertificateType::Client] = installHelper; 248 typeFuncMap[CertificateType::Authority] = [](const std::string&) {}; 249 250 auto appendPrivateKey = [this](const std::string& filePath) { 251 checkAndAppendPrivateKey(filePath); 252 }; 253 254 appendKeyMap[CertificateType::Server] = appendPrivateKey; 255 appendKeyMap[CertificateType::Client] = appendPrivateKey; 256 appendKeyMap[CertificateType::Authority] = [](const std::string&) {}; 257 258 // Generate certificate file path 259 certFilePath = generateCertFilePath(uploadPath); 260 261 // install the certificate 262 install(uploadPath); 263 264 this->emit_object_added(); 265 } 266 267 Certificate::Certificate(sdbusplus::bus::bus& bus, const std::string& objPath, 268 const CertificateType& type, 269 const std::string& installPath, X509_STORE& x509Store, 270 const std::string& pem, Watch* watchPtr, 271 Manager& parent) : 272 internal::CertificateInterface(bus, objPath.c_str(), true), 273 objectPath(objPath), certType(type), certInstallPath(installPath), 274 certWatch(watchPtr), manager(parent) 275 { 276 // Generate certificate file path 277 certFilePath = generateUniqueFilePath(installPath); 278 279 // install the certificate 280 install(x509Store, pem); 281 282 this->emit_object_added(); 283 } 284 285 Certificate::~Certificate() 286 { 287 if (!fs::remove(certFilePath)) 288 { 289 log<level::INFO>("Certificate file not found!", 290 entry("PATH=%s", certFilePath.c_str())); 291 } 292 } 293 294 void Certificate::replace(const std::string filePath) 295 { 296 manager.replaceCertificate(this, filePath); 297 } 298 299 void Certificate::install(const std::string& certSrcFilePath) 300 { 301 log<level::INFO>("Certificate install ", 302 entry("FILEPATH=%s", certSrcFilePath.c_str())); 303 304 // stop watch for user initiated certificate install 305 if (certWatch != nullptr) 306 { 307 certWatch->stopWatch(); 308 } 309 310 // Verify the certificate file 311 fs::path file(certSrcFilePath); 312 if (!fs::exists(file)) 313 { 314 log<level::ERR>("File is Missing", 315 entry("FILE=%s", certSrcFilePath.c_str())); 316 elog<InternalFailure>(); 317 } 318 319 try 320 { 321 if (fs::file_size(certSrcFilePath) == 0) 322 { 323 // file is empty 324 log<level::ERR>("File is empty", 325 entry("FILE=%s", certSrcFilePath.c_str())); 326 elog<InvalidCertificateError>( 327 InvalidCertificate::REASON("File is empty")); 328 } 329 } 330 catch (const fs::filesystem_error& e) 331 { 332 // Log Error message 333 log<level::ERR>(e.what(), entry("FILE=%s", certSrcFilePath.c_str())); 334 elog<InternalFailure>(); 335 } 336 337 X509StorePtr x509Store = getX509Store(certSrcFilePath); 338 339 // Load Certificate file into the X509 structure. 340 internal::X509Ptr cert = loadCert(certSrcFilePath); 341 342 // Perform validation 343 validateCertificateAgainstStore(*x509Store, *cert); 344 validateCertificateStartDate(*cert); 345 validateCertificateInSSLContext(*cert); 346 347 // Invoke type specific append private key function. 348 if (auto it = appendKeyMap.find(certType); it == appendKeyMap.end()) 349 { 350 log<level::ERR>("Unsupported Type", 351 entry("TYPE=%s", certificateTypeToString(certType))); 352 elog<InternalFailure>(); 353 } 354 else 355 { 356 it->second(certSrcFilePath); 357 } 358 359 // Invoke type specific compare keys function. 360 if (auto it = typeFuncMap.find(certType); it == typeFuncMap.end()) 361 { 362 log<level::ERR>("Unsupported Type", 363 entry("TYPE=%s", certificateTypeToString(certType))); 364 elog<InternalFailure>(); 365 } 366 else 367 { 368 it->second(certSrcFilePath); 369 } 370 371 copyCertificate(certSrcFilePath, certFilePath); 372 storageUpdate(); 373 374 // Keep certificate ID 375 certId = generateCertId(*cert); 376 377 // Parse the certificate file and populate properties 378 populateProperties(*cert); 379 380 // restart watch 381 if (certWatch != nullptr) 382 { 383 certWatch->startWatch(); 384 } 385 } 386 387 void Certificate::install(X509_STORE& x509Store, const std::string& pem) 388 { 389 log<level::INFO>("Certificate install ", entry("PEM_STR=%s", pem.data())); 390 391 if (certType != CertificateType::Authority) 392 { 393 log<level::ERR>("Bulk install error: Unsupported Type; only authority " 394 "supports bulk install", 395 entry("TYPE=%s", certificateTypeToString(certType))); 396 elog<InternalFailure>(); 397 } 398 399 // stop watch for user initiated certificate install 400 if (certWatch) 401 { 402 certWatch->stopWatch(); 403 } 404 405 // Load Certificate file into the X509 structure. 406 internal::X509Ptr cert = parseCert(pem); 407 // Perform validation; no type specific compare keys function 408 validateCertificateAgainstStore(x509Store, *cert); 409 validateCertificateStartDate(*cert); 410 validateCertificateInSSLContext(*cert); 411 412 // Copy the PEM to the installation path 413 dumpCertificate(pem, certFilePath); 414 storageUpdate(); 415 // Keep certificate ID 416 certId = generateCertId(*cert); 417 // Parse the certificate file and populate properties 418 populateProperties(*cert); 419 // restart watch 420 if (certWatch) 421 { 422 certWatch->startWatch(); 423 } 424 } 425 426 void Certificate::populateProperties() 427 { 428 internal::X509Ptr cert = loadCert(certInstallPath); 429 populateProperties(*cert); 430 } 431 432 std::string Certificate::getCertId() const 433 { 434 return certId; 435 } 436 437 bool Certificate::isSame(const std::string& certPath) 438 { 439 internal::X509Ptr cert = loadCert(certPath); 440 return getCertId() == generateCertId(*cert); 441 } 442 443 void Certificate::storageUpdate() 444 { 445 if (certType == CertificateType::Authority) 446 { 447 // Create symbolic link in the certificate directory 448 std::string certFileX509Path; 449 try 450 { 451 if (!certFilePath.empty() && 452 fs::is_regular_file(fs::path(certFilePath))) 453 { 454 certFileX509Path = 455 generateAuthCertFileX509Path(certFilePath, certInstallPath); 456 fs::create_symlink(fs::path(certFilePath), 457 fs::path(certFileX509Path)); 458 } 459 } 460 catch (const std::exception& e) 461 { 462 log<level::ERR>("Failed to create symlink for certificate", 463 entry("ERR=%s", e.what()), 464 entry("FILE=%s", certFilePath.c_str()), 465 entry("SYMLINK=%s", certFileX509Path.c_str())); 466 elog<InternalFailure>(); 467 } 468 } 469 } 470 471 void Certificate::populateProperties(X509& cert) 472 { 473 // Update properties if no error thrown 474 BIOMemPtr certBio(BIO_new(BIO_s_mem()), BIO_free); 475 PEM_write_bio_X509(certBio.get(), &cert); 476 BufMemPtr certBuf(BUF_MEM_new(), BUF_MEM_free); 477 BUF_MEM* buf = certBuf.get(); 478 BIO_get_mem_ptr(certBio.get(), &buf); 479 std::string certStr(buf->data, buf->length); 480 certificateString(certStr); 481 482 static const int maxKeySize = 4096; 483 char subBuffer[maxKeySize] = {0}; 484 BIOMemPtr subBio(BIO_new(BIO_s_mem()), BIO_free); 485 // This pointer cannot be freed independantly. 486 X509_NAME* sub = X509_get_subject_name(&cert); 487 X509_NAME_print_ex(subBio.get(), sub, 0, XN_FLAG_SEP_COMMA_PLUS); 488 BIO_read(subBio.get(), subBuffer, maxKeySize); 489 subject(subBuffer); 490 491 char issuerBuffer[maxKeySize] = {0}; 492 BIOMemPtr issuerBio(BIO_new(BIO_s_mem()), BIO_free); 493 // This pointer cannot be freed independantly. 494 X509_NAME* issuer_name = X509_get_issuer_name(&cert); 495 X509_NAME_print_ex(issuerBio.get(), issuer_name, 0, XN_FLAG_SEP_COMMA_PLUS); 496 BIO_read(issuerBio.get(), issuerBuffer, maxKeySize); 497 issuer(issuerBuffer); 498 499 std::vector<std::string> keyUsageList; 500 ASN1_BIT_STRING* usage; 501 502 // Go through each usage in the bit string and convert to 503 // corresponding string value 504 if ((usage = static_cast<ASN1_BIT_STRING*>( 505 X509_get_ext_d2i(&cert, NID_key_usage, nullptr, nullptr)))) 506 { 507 for (auto i = 0; i < usage->length; ++i) 508 { 509 for (auto& x : keyUsageToRfStr) 510 { 511 if (x.first & usage->data[i]) 512 { 513 keyUsageList.push_back(x.second); 514 break; 515 } 516 } 517 } 518 } 519 520 EXTENDED_KEY_USAGE* extUsage; 521 if ((extUsage = static_cast<EXTENDED_KEY_USAGE*>( 522 X509_get_ext_d2i(&cert, NID_ext_key_usage, nullptr, nullptr)))) 523 { 524 for (int i = 0; i < sk_ASN1_OBJECT_num(extUsage); i++) 525 { 526 keyUsageList.push_back(extendedKeyUsageToRfStr[OBJ_obj2nid( 527 sk_ASN1_OBJECT_value(extUsage, i))]); 528 } 529 } 530 keyUsage(keyUsageList); 531 532 int days = 0; 533 int secs = 0; 534 535 ASN1TimePtr epoch(ASN1_TIME_new(), ASN1_STRING_free); 536 // Set time to 00:00am GMT, Jan 1 1970; format: YYYYMMDDHHMMSSZ 537 ASN1_TIME_set_string(epoch.get(), "19700101000000Z"); 538 539 static const uint64_t dayToSeconds = 24 * 60 * 60; 540 ASN1_TIME* notAfter = X509_get_notAfter(&cert); 541 ASN1_TIME_diff(&days, &secs, epoch.get(), notAfter); 542 validNotAfter((days * dayToSeconds) + secs); 543 544 ASN1_TIME* notBefore = X509_get_notBefore(&cert); 545 ASN1_TIME_diff(&days, &secs, epoch.get(), notBefore); 546 validNotBefore((days * dayToSeconds) + secs); 547 } 548 549 void Certificate::checkAndAppendPrivateKey(const std::string& filePath) 550 { 551 BIOMemPtr keyBio(BIO_new(BIO_s_file()), ::BIO_free); 552 if (!keyBio) 553 { 554 log<level::ERR>("Error occurred during BIO_s_file call", 555 entry("FILE=%s", filePath.c_str())); 556 elog<InternalFailure>(); 557 } 558 BIO_read_filename(keyBio.get(), filePath.c_str()); 559 560 EVPPkeyPtr priKey( 561 PEM_read_bio_PrivateKey(keyBio.get(), nullptr, nullptr, nullptr), 562 ::EVP_PKEY_free); 563 if (!priKey) 564 { 565 log<level::INFO>("Private key not present in file", 566 entry("FILE=%s", filePath.c_str())); 567 fs::path privateKeyFile = fs::path(certInstallPath).parent_path(); 568 privateKeyFile = privateKeyFile / defaultPrivateKeyFileName; 569 if (!fs::exists(privateKeyFile)) 570 { 571 log<level::ERR>("Private key file is not found", 572 entry("FILE=%s", privateKeyFile.c_str())); 573 elog<InternalFailure>(); 574 } 575 576 std::ifstream privKeyFileStream; 577 std::ofstream certFileStream; 578 privKeyFileStream.exceptions(std::ifstream::failbit | 579 std::ifstream::badbit | 580 std::ifstream::eofbit); 581 certFileStream.exceptions(std::ofstream::failbit | 582 std::ofstream::badbit | 583 std::ofstream::eofbit); 584 try 585 { 586 privKeyFileStream.open(privateKeyFile); 587 certFileStream.open(filePath, std::ios::app); 588 certFileStream << std::endl; // insert line break 589 certFileStream << privKeyFileStream.rdbuf() << std::flush; 590 privKeyFileStream.close(); 591 certFileStream.close(); 592 } 593 catch (const std::exception& e) 594 { 595 log<level::ERR>("Failed to append private key", 596 entry("ERR=%s", e.what()), 597 entry("SRC=%s", privateKeyFile.c_str()), 598 entry("DST=%s", filePath.c_str())); 599 elog<InternalFailure>(); 600 } 601 } 602 } 603 604 bool Certificate::compareKeys(const std::string& filePath) 605 { 606 log<level::INFO>("Certificate compareKeys", 607 entry("FILEPATH=%s", filePath.c_str())); 608 internal::X509Ptr cert(X509_new(), ::X509_free); 609 if (!cert) 610 { 611 log<level::ERR>("Error occurred during X509_new call", 612 entry("FILE=%s", filePath.c_str()), 613 entry("ERRCODE=%lu", ERR_get_error())); 614 elog<InternalFailure>(); 615 } 616 617 BIOMemPtr bioCert(BIO_new_file(filePath.c_str(), "rb"), ::BIO_free); 618 if (!bioCert) 619 { 620 log<level::ERR>("Error occurred during BIO_new_file call", 621 entry("FILE=%s", filePath.c_str())); 622 elog<InternalFailure>(); 623 } 624 625 X509* x509 = cert.get(); 626 PEM_read_bio_X509(bioCert.get(), &x509, nullptr, nullptr); 627 628 EVPPkeyPtr pubKey(X509_get_pubkey(cert.get()), ::EVP_PKEY_free); 629 if (!pubKey) 630 { 631 log<level::ERR>("Error occurred during X509_get_pubkey", 632 entry("FILE=%s", filePath.c_str()), 633 entry("ERRCODE=%lu", ERR_get_error())); 634 elog<InvalidCertificateError>( 635 InvalidCertificate::REASON("Failed to get public key info")); 636 } 637 638 BIOMemPtr keyBio(BIO_new(BIO_s_file()), ::BIO_free); 639 if (!keyBio) 640 { 641 log<level::ERR>("Error occurred during BIO_s_file call", 642 entry("FILE=%s", filePath.c_str())); 643 elog<InternalFailure>(); 644 } 645 BIO_read_filename(keyBio.get(), filePath.c_str()); 646 647 EVPPkeyPtr priKey( 648 PEM_read_bio_PrivateKey(keyBio.get(), nullptr, nullptr, nullptr), 649 ::EVP_PKEY_free); 650 if (!priKey) 651 { 652 log<level::ERR>("Error occurred during PEM_read_bio_PrivateKey", 653 entry("FILE=%s", filePath.c_str()), 654 entry("ERRCODE=%lu", ERR_get_error())); 655 elog<InvalidCertificateError>( 656 InvalidCertificate::REASON("Failed to get private key info")); 657 } 658 659 #if (OPENSSL_VERSION_NUMBER < 0x30000000L) 660 int32_t rc = EVP_PKEY_cmp(priKey.get(), pubKey.get()); 661 #else 662 int32_t rc = EVP_PKEY_eq(priKey.get(), pubKey.get()); 663 #endif 664 if (rc != 1) 665 { 666 log<level::ERR>("Private key is not matching with Certificate", 667 entry("FILE=%s", filePath.c_str()), 668 entry("ERRCODE=%d", rc)); 669 return false; 670 } 671 return true; 672 } 673 674 void Certificate::delete_() 675 { 676 manager.deleteCertificate(this); 677 } 678 679 std::string Certificate::getObjectPath() 680 { 681 return objectPath; 682 } 683 684 std::string Certificate::getCertFilePath() 685 { 686 return certFilePath; 687 } 688 689 void Certificate::setCertFilePath(const std::string& path) 690 { 691 certFilePath = path; 692 } 693 694 void Certificate::setCertInstallPath(const std::string& path) 695 { 696 certInstallPath = path; 697 } 698 699 } // namespace phosphor::certs 700