rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove row level encryption for certificate

Browse Source 
certificate is public no need to encrypt it

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2025-10-01 09:46:49 +02:00
parent 2158a910a2
commit 359aaab1b4
2 changed files with 35 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files

150
pkg/coredata/custom_domain.go
View File

@@ -30,24 +30,23 @@ import (
type ( type (
CustomDomain struct { CustomDomain struct {
ID gid.GID `db:"id"` ID gid.GID `db:"id"`
OrganizationID gid.GID `db:"organization_id"` OrganizationID gid.GID `db:"organization_id"`
Domain string `db:"domain"` Domain string `db:"domain"`
HTTPChallengeToken *string `db:"http_challenge_token"` HTTPChallengeToken *string `db:"http_challenge_token"`
HTTPChallengeKeyAuth *string `db:"http_challenge_key_auth"` HTTPChallengeKeyAuth *string `db:"http_challenge_key_auth"`
HTTPChallengeURL *string `db:"http_challenge_url"` HTTPChallengeURL *string `db:"http_challenge_url"`
HTTPOrderURL *string `db:"http_order_url"` HTTPOrderURL *string `db:"http_order_url"`
SSLCertificate *tls.Certificate `db:"-"` // Parsed certificate SSLCertificate *tls.Certificate `db:"-"`
SSLCertificatePEM []byte `db:"-"` // Decrypted PEM SSLCertificatePEM []byte `db:"ssl_certificate"`
EncryptedSSLCertificate []byte `db:"encrypted_ssl_certificate"` SSLPrivateKeyPEM []byte `db:"-"`
SSLPrivateKeyPEM []byte `db:"-"` // Decrypted PEM EncryptedSSLPrivateKey []byte `db:"encrypted_ssl_private_key"`
EncryptedSSLPrivateKey []byte `db:"encrypted_ssl_private_key"` SSLCertificateChain *string `db:"ssl_certificate_chain"`
SSLCertificateChain *string `db:"ssl_certificate_chain"` SSLStatus CustomDomainSSLStatus `db:"ssl_status"`
SSLStatus CustomDomainSSLStatus `db:"ssl_status"` SSLExpiresAt *time.Time `db:"ssl_expires_at"`
SSLExpiresAt *time.Time `db:"ssl_expires_at"` IsActive bool `db:"is_active"`
IsActive bool `db:"is_active"` CreatedAt time.Time `db:"created_at"`
CreatedAt time.Time `db:"created_at"` UpdatedAt time.Time `db:"updated_at"`
UpdatedAt time.Time `db:"updated_at"`
} }
CustomDomains []*CustomDomain CustomDomains []*CustomDomain
@@ -95,7 +94,7 @@ SELECT
http_challenge_key_auth, http_challenge_key_auth,
http_challenge_url, http_challenge_url,
http_order_url, http_order_url,
encrypted_ssl_certificate, ssl_certificate,
encrypted_ssl_private_key, encrypted_ssl_private_key,
ssl_certificate_chain, ssl_certificate_chain,
ssl_status, ssl_status,
@@ -128,15 +127,6 @@ LIMIT 1
*cd = customDomain *cd = customDomain
// Decrypt SSL certificate
if len(cd.EncryptedSSLCertificate) > 0 {
decrypted, err := cipher.Decrypt(cd.EncryptedSSLCertificate, encryptionKey)
if err != nil {
return fmt.Errorf("cannot decrypt SSL certificate: %w", err)
}
cd.SSLCertificatePEM = decrypted
}
// Decrypt SSL private key // Decrypt SSL private key
if len(cd.EncryptedSSLPrivateKey) > 0 { if len(cd.EncryptedSSLPrivateKey) > 0 {
decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey) decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
@@ -179,7 +169,7 @@ SELECT
http_challenge_key_auth, http_challenge_key_auth,
http_challenge_url, http_challenge_url,
http_order_url, http_order_url,
encrypted_ssl_certificate, ssl_certificate,
encrypted_ssl_private_key, encrypted_ssl_private_key,
ssl_certificate_chain, ssl_certificate_chain,
ssl_status, ssl_status,
@@ -213,15 +203,6 @@ FOR UPDATE
*cd = customDomain *cd = customDomain
// Decrypt SSL certificate
if len(cd.EncryptedSSLCertificate) > 0 {
decrypted, err := cipher.Decrypt(cd.EncryptedSSLCertificate, encryptionKey)
if err != nil {
return fmt.Errorf("cannot decrypt SSL certificate: %w", err)
}
cd.SSLCertificatePEM = decrypted
}
// Decrypt SSL private key // Decrypt SSL private key
if len(cd.EncryptedSSLPrivateKey) > 0 { if len(cd.EncryptedSSLPrivateKey) > 0 {
decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey) decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
@@ -264,7 +245,7 @@ SELECT
http_challenge_key_auth, http_challenge_key_auth,
http_challenge_url, http_challenge_url,
http_order_url, http_order_url,
encrypted_ssl_certificate, ssl_certificate,
encrypted_ssl_private_key, encrypted_ssl_private_key,
ssl_certificate_chain, ssl_certificate_chain,
ssl_status, ssl_status,
@@ -297,15 +278,6 @@ LIMIT 1
*cd = customDomain *cd = customDomain
// Decrypt SSL certificate
if len(cd.EncryptedSSLCertificate) > 0 {
decrypted, err := cipher.Decrypt(cd.EncryptedSSLCertificate, encryptionKey)
if err != nil {
return fmt.Errorf("cannot decrypt SSL certificate: %w", err)
}
cd.SSLCertificatePEM = decrypted
}
// Decrypt SSL private key // Decrypt SSL private key
if len(cd.EncryptedSSLPrivateKey) > 0 { if len(cd.EncryptedSSLPrivateKey) > 0 {
decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey) decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
@@ -338,17 +310,9 @@ func (cd *CustomDomain) Insert(
scope Scoper, scope Scoper,
encryptionKey cipher.EncryptionKey, encryptionKey cipher.EncryptionKey,
) error { ) error {
var err error
var encryptedCert []byte
if len(cd.SSLCertificatePEM) > 0 {
encryptedCert, err = cipher.Encrypt(cd.SSLCertificatePEM, encryptionKey)
if err != nil {
return fmt.Errorf("cannot encrypt SSL certificate: %w", err)
}
}
var encryptedKey []byte var encryptedKey []byte
if len(cd.SSLPrivateKeyPEM) > 0 { if len(cd.SSLPrivateKeyPEM) > 0 {
var err error
encryptedKey, err = cipher.Encrypt(cd.SSLPrivateKeyPEM, encryptionKey) encryptedKey, err = cipher.Encrypt(cd.SSLPrivateKeyPEM, encryptionKey)
if err != nil { if err != nil {
return fmt.Errorf("cannot encrypt SSL private key: %w", err) return fmt.Errorf("cannot encrypt SSL private key: %w", err)
@@ -365,7 +329,7 @@ INSERT INTO custom_domains (
http_challenge_key_auth, http_challenge_key_auth,
http_challenge_url, http_challenge_url,
http_order_url, http_order_url,
encrypted_ssl_certificate, ssl_certificate,
encrypted_ssl_private_key, encrypted_ssl_private_key,
ssl_certificate_chain, ssl_certificate_chain,
ssl_status, ssl_status,
@@ -382,7 +346,7 @@ INSERT INTO custom_domains (
@http_challenge_key_auth, @http_challenge_key_auth,
@http_challenge_url, @http_challenge_url,
@http_order_url, @http_order_url,
@encrypted_ssl_certificate, @ssl_certificate,
@encrypted_ssl_private_key, @encrypted_ssl_private_key,
@ssl_certificate_chain, @ssl_certificate_chain,
@ssl_status, @ssl_status,
@@ -402,7 +366,7 @@ INSERT INTO custom_domains (
"http_challenge_key_auth": cd.HTTPChallengeKeyAuth, "http_challenge_key_auth": cd.HTTPChallengeKeyAuth,
"http_challenge_url": cd.HTTPChallengeURL, "http_challenge_url": cd.HTTPChallengeURL,
"http_order_url": cd.HTTPOrderURL, "http_order_url": cd.HTTPOrderURL,
"encrypted_ssl_certificate": encryptedCert, "ssl_certificate": cd.SSLCertificatePEM,
"encrypted_ssl_private_key": encryptedKey, "encrypted_ssl_private_key": encryptedKey,
"ssl_certificate_chain": cd.SSLCertificateChain, "ssl_certificate_chain": cd.SSLCertificateChain,
"ssl_status": cd.SSLStatus, "ssl_status": cd.SSLStatus,
@@ -412,12 +376,11 @@ INSERT INTO custom_domains (
"updated_at": cd.UpdatedAt, "updated_at": cd.UpdatedAt,
} }
_, err = conn.Exec(ctx, q, args) _, err := conn.Exec(ctx, q, args)
if err != nil { if err != nil {
return fmt.Errorf("cannot insert custom domain: %w", err) return fmt.Errorf("cannot insert custom domain: %w", err)
} }
cd.EncryptedSSLCertificate = encryptedCert
cd.EncryptedSSLPrivateKey = encryptedKey cd.EncryptedSSLPrivateKey = encryptedKey
return nil return nil
@@ -429,15 +392,6 @@ func (cd *CustomDomain) Update(
scope Scoper, scope Scoper,
encryptionKey cipher.EncryptionKey, encryptionKey cipher.EncryptionKey,
) error { ) error {
var encryptedCert []byte
if len(cd.SSLCertificatePEM) > 0 {
var err error
encryptedCert, err = cipher.Encrypt(cd.SSLCertificatePEM, encryptionKey)
if err != nil {
return fmt.Errorf("cannot encrypt SSL certificate: %w", err)
}
}
var encryptedKey []byte var encryptedKey []byte
if len(cd.SSLPrivateKeyPEM) > 0 { if len(cd.SSLPrivateKeyPEM) > 0 {
var err error var err error
@@ -455,7 +409,7 @@ SET
http_challenge_key_auth = @http_challenge_key_auth, http_challenge_key_auth = @http_challenge_key_auth,
http_challenge_url = @http_challenge_url, http_challenge_url = @http_challenge_url,
http_order_url = @http_order_url, http_order_url = @http_order_url,
encrypted_ssl_certificate = @encrypted_ssl_certificate, ssl_certificate = @ssl_certificate,
encrypted_ssl_private_key = @encrypted_ssl_private_key, encrypted_ssl_private_key = @encrypted_ssl_private_key,
ssl_certificate_chain = @ssl_certificate_chain, ssl_certificate_chain = @ssl_certificate_chain,
ssl_status = @ssl_status, ssl_status = @ssl_status,
@@ -475,7 +429,7 @@ WHERE
"http_challenge_key_auth": cd.HTTPChallengeKeyAuth, "http_challenge_key_auth": cd.HTTPChallengeKeyAuth,
"http_challenge_url": cd.HTTPChallengeURL, "http_challenge_url": cd.HTTPChallengeURL,
"http_order_url": cd.HTTPOrderURL, "http_order_url": cd.HTTPOrderURL,
"encrypted_ssl_certificate": encryptedCert, "ssl_certificate": cd.SSLCertificatePEM,
"encrypted_ssl_private_key": encryptedKey, "encrypted_ssl_private_key": encryptedKey,
"ssl_certificate_chain": cd.SSLCertificateChain, "ssl_certificate_chain": cd.SSLCertificateChain,
"ssl_status": cd.SSLStatus, "ssl_status": cd.SSLStatus,
@@ -490,7 +444,6 @@ WHERE
return fmt.Errorf("cannot update custom domain: %w", err) return fmt.Errorf("cannot update custom domain: %w", err)
} }
cd.EncryptedSSLCertificate = encryptedCert
cd.EncryptedSSLPrivateKey = encryptedKey cd.EncryptedSSLPrivateKey = encryptedKey
return nil return nil
@@ -539,7 +492,7 @@ SELECT
http_challenge_key_auth, http_challenge_key_auth,
http_challenge_url, http_challenge_url,
http_order_url, http_order_url,
encrypted_ssl_certificate, ssl_certificate,
encrypted_ssl_private_key, encrypted_ssl_private_key,
ssl_certificate_chain, ssl_certificate_chain,
ssl_status, ssl_status,
@@ -572,15 +525,6 @@ WHERE
} }
for _, cd := range result { for _, cd := range result {
// Decrypt SSL certificate
if len(cd.EncryptedSSLCertificate) > 0 {
decrypted, err := cipher.Decrypt(cd.EncryptedSSLCertificate, encryptionKey)
if err != nil {
return fmt.Errorf("cannot decrypt SSL certificate: %w", err)
}
cd.SSLCertificatePEM = decrypted
}
// Decrypt SSL private key // Decrypt SSL private key
if len(cd.EncryptedSSLPrivateKey) > 0 { if len(cd.EncryptedSSLPrivateKey) > 0 {
decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey) decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
@@ -625,7 +569,7 @@ SELECT
http_challenge_key_auth, http_challenge_key_auth,
http_challenge_url, http_challenge_url,
http_order_url, http_order_url,
encrypted_ssl_certificate, ssl_certificate,
encrypted_ssl_private_key, encrypted_ssl_private_key,
ssl_certificate_chain, ssl_certificate_chain,
ssl_status, ssl_status,
@@ -658,24 +602,7 @@ LIMIT 1
*cd = customDomain *cd = customDomain
// Decrypt SSL certificate // No need to decrypt anything for challenge validation
if len(cd.EncryptedSSLCertificate) > 0 {
decrypted, err := cipher.Decrypt(cd.EncryptedSSLCertificate, encryptionKey)
if err != nil {
return fmt.Errorf("cannot decrypt SSL certificate: %w", err)
}
cd.SSLCertificatePEM = decrypted
}
// Decrypt SSL private key
if len(cd.EncryptedSSLPrivateKey) > 0 {
decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
if err != nil {
return fmt.Errorf("cannot decrypt SSL private key: %w", err)
}
cd.SSLPrivateKeyPEM = decrypted
}
return nil return nil
} }
@@ -693,7 +620,7 @@ SELECT
http_challenge_key_auth, http_challenge_key_auth,
http_challenge_url, http_challenge_url,
http_order_url, http_order_url,
encrypted_ssl_certificate, ssl_certificate,
encrypted_ssl_private_key, encrypted_ssl_private_key,
ssl_certificate_chain, ssl_certificate_chain,
ssl_status, ssl_status,
@@ -745,7 +672,7 @@ SELECT
http_challenge_key_auth, http_challenge_key_auth,
http_challenge_url, http_challenge_url,
http_order_url, http_order_url,
encrypted_ssl_certificate, ssl_certificate,
encrypted_ssl_private_key, encrypted_ssl_private_key,
ssl_certificate_chain, ssl_certificate_chain,
ssl_status, ssl_status,
@@ -800,7 +727,7 @@ SELECT
http_challenge_key_auth, http_challenge_key_auth,
http_challenge_url, http_challenge_url,
http_order_url, http_order_url,
encrypted_ssl_certificate, ssl_certificate,
encrypted_ssl_private_key, encrypted_ssl_private_key,
ssl_certificate_chain, ssl_certificate_chain,
ssl_status, ssl_status,
@@ -813,7 +740,7 @@ FROM
WHERE WHERE
%s %s
AND ssl_status = 'ACTIVE' AND ssl_status = 'ACTIVE'
AND encrypted_ssl_certificate IS NOT NULL AND ssl_certificate IS NOT NULL
` `
q = fmt.Sprintf(q, scope.SQLFragment()) q = fmt.Sprintf(q, scope.SQLFragment())
@@ -832,15 +759,6 @@ WHERE
} }
for _, cd := range result { for _, cd := range result {
// Decrypt SSL certificate
if len(cd.EncryptedSSLCertificate) > 0 {
decrypted, err := cipher.Decrypt(cd.EncryptedSSLCertificate, encryptionKey)
if err != nil {
return fmt.Errorf("cannot decrypt SSL certificate: %w", err)
}
cd.SSLCertificatePEM = decrypted
}
// Decrypt SSL private key // Decrypt SSL private key
if len(cd.EncryptedSSLPrivateKey) > 0 { if len(cd.EncryptedSSLPrivateKey) > 0 {
decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey) decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)

2
pkg/coredata/migrations/20250929T121248Z.sql
View File

@@ -14,7 +14,7 @@ CREATE TABLE custom_domains (
tenant_id TEXT NOT NULL, tenant_id TEXT NOT NULL,
organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
domain CITEXT NOT NULL UNIQUE, domain CITEXT NOT NULL UNIQUE,
encrypted_ssl_certificate BYTEA, ssl_certificate BYTEA,
encrypted_ssl_private_key BYTEA, encrypted_ssl_private_key BYTEA,
ssl_certificate_chain TEXT, ssl_certificate_chain TEXT,
ssl_status custom_domain_ssl_status, ssl_status custom_domain_ssl_status,