🔐 CA Password Management & Approval Workflow - Spécification

Date: 2025-09-28 Status: 🟡 EN CONCEPTION Priorité: 🟡 IMPORTANTE

🎯 OBJECTIF

Implémenter un système complet de gestion des mots de passe pour les CAs critiques (Root CA + Intermediate critiques) avec workflow d'approbation pour les CSRs.

📋 FONCTIONNALITÉS

1. GESTION MOTS DE PASSE CA

Règles Métier

  • Root CAs: Mot de passe OBLIGATOIRE
  • Intermediate critiques: Mot de passe selon choix admin
  • Standard CAs: Pas de mot de passe (optionnel)
  • Auto-détection: Utiliser champ existant type (root/intermediate)

Database Schema ⚠️ SIMPLIFIÉ

-- Utiliser le champ 'type' existant au lieu de 'critical_level'
-- Pas de redondance avec ENUM

-- Seulement ajouter:
ALTER TABLE certificate_authorities ADD COLUMN password_required BOOLEAN DEFAULT FALSE;

-- Logique:
-- type='root' → password_required automatiquement TRUE
-- type='intermediate' → password_required selon choix admin

2. INTERFACE CRÉATION/ÉDITION CA

// Page: /ca/create + /ca/{id}/edit
Form Fields:
┌─ CA Configuration ─────────────────────────┐
│ Type: [Root CA ▼]                          │
│                                            │
│ 🔐 Private Key Security:                   │
│ □ Password Required for Signing            │
│   (✓ Automatically enabled for Root CAs)  │
│                                            │
│ IF password_required:                      │
│ ├─ Set Password: [______________]          │
│ ├─ Confirm:     [______________]           │
│ └─ Strength:    ████████░░ (Strong)       │
└────────────────────────────────────────────┘

3. CERTIFICATE SIGNING - PASSWORD PROMPT

// Page: /certificates/create
// Quand CA.password_required = true:

┌─ Certificate Signing ──────────────────────┐
│ CA: Root CA (🔐 Password Protected)        │
│                                            │
│ ⚠️  This CA requires password for signing │
│                                            │
│ CA Private Key Password:                   │
│ [_________________________] [🔓 Unlock]   │
│                                            │
│ [ ] Remember for this session (15 min)    │
│                                            │
│ [Generate Certificate] [Cancel]            │
└────────────────────────────────────────────┘

4. CSR APPROVAL WORKFLOW

CSR Submission Interface

// Page: /csr/upload
┌─ CSR Upload & Approval Request ───────────┐
│ Certificate Signing Request:               │
│ [Upload .csr file] or [Paste CSR content] │
│                                            │
│ Target CA: [Root CA ▼]                     │
│ Purpose:   [Web Server ▼]                  │
│ Validity:  [365 days ▼]                    │
│                                            │
│ Approval Status:                           │
│ ● Automatic (Standard CA)                  │
│ ○ Manual Approval Required (Root/Critical) │
│                                            │
│ IF manual approval:                        │
│ Justification (required):                  │
│ [___________________________________]     │
│                                            │
│ [Submit for Approval] [Generate Now]       │
└────────────────────────────────────────────┘

Admin Approval Dashboard

// Page: /admin/pending-approvals
┌─ Pending Certificate Approvals ───────────┐
│                                            │
│ 🟡 3 CSRs awaiting approval                │
│                                            │
│ ┌─ CSR #001 ─────────────────┐            │
│ │ Subject: *.example.com     │            │
│ │ CA: Root CA (🔐 Critical)  │            │
│ │ Requested by: user@co.com  │            │
│ │ Date: 2025-09-28 14:30     │            │
│ │ Justification: "Production │            │
│ │   web server certificate"  │            │
│ │                            │            │
│ │ [📄 View CSR] [✅ Approve] │            │
│ │ [❌ Reject]   [💬 Comment] │            │
│ └────────────────────────────┘            │
└────────────────────────────────────────────┘

🔌 API ENDPOINTS

CA Password Management

POST   /api/v1/ca/{id}/password/validate     // Valider mot de passe
POST   /api/v1/ca/{id}/password/unlock       // Déverrouiller pour session
GET    /api/v1/ca/{id}/password/status       // Status verrouillage
PUT    /api/v1/ca/{id}/password/require      // Activer/désactiver password

CSR Approval Workflow

POST   /api/v1/csr/submit                    // Soumettre CSR pour approbation
GET    /api/v1/csr/pending                   // Liste CSRs en attente (admin)
POST   /api/v1/csr/{id}/approve              // Approuver CSR (admin)
POST   /api/v1/csr/{id}/reject               // Rejeter CSR (admin)
GET    /api/v1/csr/{id}/status               // Status CSR pour user

Certificate Signing with Password

POST   /api/v1/certificates/sign-with-password
Body: {
  "csr": "-----BEGIN CERTIFICATE REQUEST-----...",
  "ca_id": 3,
  "ca_password": "secure_password",
  "remember_session": true,
  "bypass_approval": false  // Si admin et approval workflow
}

🗄️ DATABASE SCHEMA

Modification CAs (Simplifiée)

-- Seulement ajouter password_required (pas de critical_level)
ALTER TABLE certificate_authorities ADD COLUMN password_required BOOLEAN DEFAULT FALSE;

-- Logique application:
-- IF type = 'root' THEN password_required = TRUE automatiquement
-- IF type = 'intermediate' THEN password_required selon choix admin

Table CSR Approvals (Nouvelle)

CREATE TABLE pending_certificate_requests (
    id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
    ca_id BIGINT UNSIGNED NOT NULL,
    user_id BIGINT UNSIGNED NOT NULL,
    csr_content TEXT NOT NULL,
    common_name VARCHAR(255) NOT NULL,
    subject_alt_names JSON NULL,
    purpose_category VARCHAR(100),
    validity_days INTEGER DEFAULT 365,
    justification TEXT,
    status ENUM('pending', 'approved', 'rejected', 'signed') DEFAULT 'pending',
    approved_by BIGINT UNSIGNED NULL,
    approved_at TIMESTAMP NULL,
    rejection_reason TEXT NULL,
    signed_certificate_id BIGINT UNSIGNED NULL,  -- Link to final certificate
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,

    FOREIGN KEY (ca_id) REFERENCES certificate_authorities(id),
    FOREIGN KEY (user_id) REFERENCES users(id),
    FOREIGN KEY (approved_by) REFERENCES users(id),
    FOREIGN KEY (signed_certificate_id) REFERENCES certificates(id),

    INDEX idx_status (status),
    INDEX idx_ca_user (ca_id, user_id),
    INDEX idx_pending (status, created_at)
);

🔄 WORKFLOW COMPLET

graph TD
    A[User uploads CSR] --> B{CA type check}
    B -->|Root/Critical| C[Require approval workflow]
    B -->|Standard| D{Password protected?}

    C --> E[Submit to approval queue]
    E --> F[Email notification to admins]
    F --> G[Admin reviews CSR]
    G --> H{Approved?}
    H -->|Yes| D
    H -->|No| I[Reject with reason + email user]

    D -->|Yes| J[Prompt for CA password]
    D -->|No| K[Sign certificate immediately]

    J --> L{Password valid?}
    L -->|Yes| K
    L -->|No| M[Error + retry]

    K --> N[Certificate issued]
    N --> O[Email confirmation + audit log]

🛡️ SÉCURITÉ & AUDIT

Password Security

  • BCrypt hashing pour stockage
  • Rate limiting: 3 tentatives / 15 minutes
  • Session unlock: 15 minutes max
  • IP tracking des tentatives
  • Audit log complet

Approval Security

  • Permission admin requise
  • Audit trail CSR → Certificate
  • Email notifications
  • Justification obligatoire
  • Horodatage complet

Audit Events

// Events to log:
- ca_password_set / ca_password_removed
- ca_password_unlock_success / ca_password_unlock_failed
- csr_submitted / csr_approved / csr_rejected
- certificate_signed_with_password
- approval_workflow_bypassed (admin)

🎯 PHASES IMPLÉMENTATION

Phase 1: CA Password Management (1 semaine)

  1. Migration database (password_required field)
  2. API endpoints password validation
  3. UI password prompts
  4. Session unlock mechanism

Phase 2: CSR Approval Workflow (1 semaine)

  1. Table pending_certificate_requests
  2. CSR submission interface
  3. Admin approval dashboard
  4. Email notifications

Phase 3: Integration & Polish (3 jours)

  1. Workflow integration complet
  2. Tests unitaires & sécurité
  3. Documentation utilisateur
  4. Audit logging

✅ CRITÈRES DE SUCCÈS

  • [ ] Root CAs protégées par mot de passe obligatoire
  • [ ] Interface intuitive création/gestion passwords
  • [ ] Workflow approbation CSR fonctionnel
  • [ ] Dashboard admin pour approvals
  • [ ] API complète pour intégration
  • [ ] Audit trail complet
  • [ ] Email notifications automatiques
  • [ ] Tests sécurité validés

📝 Note: Cette spécification utilise les champs existants (type) pour éviter la redondance et se base sur l'architecture PKI existante.