feat: added pilot certificate

certificates-generation/Dockerfile

@@ -20,6 +20,7 @@ RUN chmod 700 /ca/private && \
 COPY openssl_config_ca.cnf /ca/openssl_config_ca.cnf
 COPY openssl_config_host.cnf /ca/openssl_config_host.cnf
 COPY openssl_config_user.cnf /ca/openssl_config_user.cnf
+COPY openssl_config_pilot.cnf /ca/openssl_config_pilot.cnf
 
 # Generate CA private key and certificate
 RUN openssl genrsa -out /ca/private/ca.key 2048

certificates-generation/entrypoint.sh

@@ -29,7 +29,7 @@ if ! openssl ca -config /ca/openssl_config_ca.cnf \
     exit 1
 fi
 
-### User
+### User (for DIRAC client)
 
 if ! openssl genrsa -out /ca/certs/client.key 2048; then
     echo "Failed to generate user private key"
@@ -55,6 +55,32 @@ if ! openssl ca -config /ca/openssl_config_ca.cnf \
     exit 1
 fi
 
+### DIRAC Pilot
+
+if ! openssl genrsa -out /ca/certs/pilot.key 2048; then
+    echo "Failed to generate pilot private key"
+    exit 1
+fi
+chmod 400 pilot.key
+
+if ! openssl req -config /ca/openssl_config_pilot.cnf \
+                 -key /ca/certs/pilot.key \
+                 -new \
+                 -out /ca/requests/pilot.req; then
+    echo "Failed to generate pilot certificate signing request"
+    exit 1
+fi
+
+if ! openssl ca -config /ca/openssl_config_ca.cnf \
+                -extensions usr_cert \
+                -batch \
+                -days 5 \
+                -in /ca/requests/pilot.req \
+                -out /ca/certs/pilot.pem; then
+    echo "Failed to generate pilot certificate"
+    exit 1
+fi
+
 ###
 
 echo "DIRAC Certificates generated and available in /ca/certs"

certificates-generation/openssl_config_host.cnf

@@ -1,6 +1,3 @@
-# OpenSSL root CA configuration file
-
-
 [ req ]
 # Options for the `req` tool (`man req`).
 default_bits        = 2048

certificates-generation/openssl_config_pilot.cnf

@@ -0,0 +1,20 @@
+[ req ]
+default_bits           = 2048
+encrypt_key            = yes
+distinguished_name     = req_dn
+prompt                 = no
+req_extensions        = v3_req
+
+# Generates the following subject
+# Subject: O=DIRAC CI, O=CERN, CN=pilot
+[ req_dn ]
+C                      = ch
+O                      = DIRAC
+OU                     = DIRAC CI
+CN                     = pilot
+
+[ v3_req ]
+# Extensions for client certificates (`man x509v3_config`).
+nsComment = "OpenSSL Generated Client Certificate"
+keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
+extendedKeyUsage = clientAuth