AxisPowershell

1.2.1

private/functions/Test-AxisCertificateAuthorityDogtag.ps1

function Test-AxisCertificateAuthorityDogtag {
    <#
    .SYNOPSIS
    Checks that a Dogtag PKI instance and its EST subsystem are reachable.

    .DESCRIPTION
    1. GET <Server>/pki/rest/info - unauthenticated server info document (Name, Version), the same request the
       pki CLI issues first ("GET /pki/rest/info", see https://lists.dogtagpki.org/archives/list/users@lists.dogtagpki.org/message/RBAQJNXG6ITVLY6EUON6PFM2SBVEONPC/ ).
       Treated as optional: a failure is reported but does not make the authority unreachable (exact JSON field
       names UNCONFIRMED, see worker_est.md).
    2. Delegates to Test-AxisCertificateAuthorityEST against EstServer (or Server) for the EST /cacerts check,
       credential presence and CAThumbprint pin.
    Also warns when no agent credential/certificate is configured for revocation (Revoke-AxisCertificateOnDogtag).

    .PARAMETER Authority
    The authority hashtable (Type='Dogtag'). See Submit-AxisCsrToDogtag for the keys.
    #>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory)]
        [Hashtable]$Authority
    )

    if(!$Authority.Server -and !$Authority.EstServer) {
        return [pscustomobject]@{ Reachable = $false; Message = "Authority has no Server (expected 'https://host:8443')" }
    }

    $Notes = @()
    if($Authority.Server) {
        $InfoUri = "$($Authority.Server.TrimEnd('/'))/pki/rest/info"
        $Param = @{
            Method = 'GET'
            Uri = $InfoUri
            UseBasicParsing = $true
            TimeoutSec = 30
            Headers = @{ Accept = 'application/json' }
            Verbose = $false
            ErrorAction = 'Stop'
        }
        if($Authority.SkipCertificateCheck) {
            if($PSVersionTable.PSVersion.Major -ge 6) {
                $Param.Add('SkipCertificateCheck',$true)
            }
            else {
                Set-CertificateValidation -Disable
            }
        }
        Write-Verbose "GET $InfoUri"
        Try {
            $Response = Invoke-WebRequest @Param
            $Content = $Response.Content
            if($Content -is [Byte[]]) { $Content = [System.Text.Encoding]::UTF8.GetString($Content) }
            $Info = $null
            Try { $Info = $Content | ConvertFrom-Json } Catch { }
            if($Info.Version) {
                $Notes += "Dogtag CA $($Info.Name) version $($Info.Version) at $($Authority.Server)"
            }
            else {
                $Notes += "Dogtag CA REST reachable at $($Authority.Server)"
            }
        }
        Catch {
            $Notes += "WARNING: $InfoUri not reachable ($($_.Exception.Message)); revocation via REST may fail"
        }
    }

    $EstAuthority = $Authority.Clone()
    $EstAuthority["Type"] = "EST"
    if($Authority.EstServer) { $EstAuthority["Server"] = $Authority.EstServer }
    $Est = Test-AxisCertificateAuthorityEST -Authority $EstAuthority
    $Notes += "EST: $($Est.Message)"

    if(!$Authority.ClientCertThumbprint -and !$Authority.RevokeCredentialTarget) {
        $Notes += "revocation will use the EST credential as CA agent; configure RevokeCredentialTarget or ClientCertThumbprint (Certificate Manager Agents) if that user is not an agent"
    }

    return [pscustomobject]@{
        Reachable = [bool]$Est.Reachable
        Message = ($Notes -join "; ")
    }
}