module ietf-keychain {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-keychain";
prefix "kc";
organization
"IETF NETCONF (Network Configuration) Working Group";
contact
"WG Web:
WG List:
WG Chair: Mehmet Ersue
WG Chair: Mahesh Jethanandani
Editor: Kent Watsen
";
description
"This module defines a keychain to centralize management of
security credentials.
Copyright (c) 2014 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD
License set forth in Section 4.c of the IETF Trust's
Legal Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC VVVV; see
the RFC itself for full legal notices.";
revision "2015-07-06" {
description
"Initial version";
reference
"RFC VVVV: NETCONF Server and RESTCONF Server Configuration
Models";
}
container keychain {
description
"A list of private-keys and their associated certificates, as
well as lists of trusted certificates for client certificate
authentication. RPCs are provided to generate a new private
key and to generate a certificate signing requests.";
container private-keys {
description
"A list of private key maintained by the keychain.";
list private-key {
key name;
description
"A private key.";
leaf name {
type string;
description
"An arbitrary name for the private key.";
}
leaf algorithm {
type enumeration {
enum rsa { description "TBD"; }
enum dsa { description "TBD"; }
enum secp192r1 { description "TBD"; }
enum sect163k1 { description "TBD"; }
enum sect163r2 { description "TBD"; }
enum secp224r1 { description "TBD"; }
enum sect233k1 { description "TBD"; }
enum sect233r1 { description "TBD"; }
enum secp256r1 { description "TBD"; }
enum sect283k1 { description "TBD"; }
enum sect283r1 { description "TBD"; }
enum secp384r1 { description "TBD"; }
enum sect409k1 { description "TBD"; }
enum sect409r1 { description "TBD"; }
enum secp521r1 { description "TBD"; }
enum sect571k1 { description "TBD"; }
enum sect571r1 { description "TBD"; }
}
config false;
description
"The algorithm used by the private key.";
}
leaf key-length {
type uint32;
config false;
description
"The key-length used by the private key.";
}
leaf public-key {
type string;
config false;
description
"The public-key matching the private key.";
}
container certificates {
list certificate {
key name;
description
"A certificate for this public key.";
leaf name {
type string;
description
"An arbitrary name for the certificate.";
}
leaf chain {
type binary;
description
"The certificate itself, as well as an ordered
sequence of intermediate certificates leading
to a trust anchor, as specified by RFC 5246,
Section 7.4.2.";
reference
"RFC 5246: The Transport Layer Security (TLS)
Protocol Version 1.2";
}
}
description
"A list of certificates for this public key.";
}
action generate-certificate-signing-request {
description
"Generates a certificate signing request structure for
the associated private key using the passed subject
and attribute values.";
input {
leaf subject {
type binary;
mandatory true;
description
"The 'subject' field in the CertificationRequestInfo
defined in RFC 2986, Section 4.1.";
reference
"RFC 2986: PKCS #10: Certification Request Syntax
Specification Version 1.7";
}
leaf attributes {
type binary;
description
"The 'attributes' field in the CertificationRequestInfo
defined in RFC 2986, Section 4.1.";
reference
"RFC 2986: PKCS #10: Certification Request Syntax
Specification Version 1.7";
}
}
output {
leaf certificate-signing-request {
type binary;
mandatory true;
description
"The CertificationRequestInfo structure as specified
by RFC 2986, Section 4.1.";
reference
"RFC 2986: PKCS #10: Certification Request Syntax
Specification Version 1.7";
}
}
}
}
action generate-private-key {
description
"Generates a private key using the specified algorithm and
key length.";
input {
leaf name {
type string;
mandatory true;
description
"The name this private-key should have when listed in
/keychain/private-keys/private-key. As such, the
passed value must not match any existing 'name' value.";
}
leaf algorithm {
type enumeration {
enum rsa { description "TBD"; }
enum dsa { description "TBD"; }
enum secp192r1 { description "TBD"; }
enum sect163k1 { description "TBD"; }
enum sect163r2 { description "TBD"; }
enum secp224r1 { description "TBD"; }
enum sect233k1 { description "TBD"; }
enum sect233r1 { description "TBD"; }
enum secp256r1 { description "TBD"; }
enum sect283k1 { description "TBD"; }
enum sect283r1 { description "TBD"; }
enum secp384r1 { description "TBD"; }
enum sect409k1 { description "TBD"; }
enum sect409r1 { description "TBD"; }
enum secp521r1 { description "TBD"; }
enum sect571k1 { description "TBD"; }
enum sect571r1 { description "TBD"; }
}
mandatory true;
description
"The algorithm to be used.";
}
leaf key-length {
type uint32;
mandatory true;
description
"The key length to be used.";
}
}
}
}
list trusted-certificates {
key name;
description
"A list of lists of trusted certificates.";
leaf name {
type string;
description
"An arbitrary name for this list of trusted certificates.";
}
list trusted-certificate {
key name;
description
"A list of trusted certificates for a specific use.";
leaf name {
type string;
description
"An arbitrary name for this trusted certificate.";
}
leaf certificate {
type binary;
description
"The binary certificate structure as specified by RFC
5246, Section 7.4.6, i.e.,: opaque ASN.1Cert<1..2^24>;
";
reference
"RFC 5246: The Transport Layer Security (TLS)
Protocol Version 1.2";
}
}
}
}
rpc generate-certificate-signing-request {
description
"Generates a certificate signing request structure for
the specified private key using the passed subject
and attribute values.";
input {
leaf private-key {
type leafref {
path "/keychain/private-keys/private-key/name";
}
description
"The private key to generate the certificate signing
request for.";
}
leaf subject {
type binary;
mandatory true;
description
"The 'subject' field in the CertificationRequestInfo
defined in RFC 2986, Section 4.1.";
reference
"RFC 2986: PKCS #10: Certification Request Syntax
Specification Version 1.7";
}
leaf attributes {
type binary;
description
"The 'attributes' field in the CertificationRequestInfo
defined in RFC 2986, Section 4.1.";
reference
"RFC 2986: PKCS #10: Certification Request Syntax
Specification Version 1.7";
}
}
output {
leaf certificate-signing-request {
type binary;
mandatory true;
description
"The CertificationRequestInfo structure as specified
by RFC 2986, Section 4.1.";
reference
"RFC 2986: PKCS #10: Certification Request Syntax
Specification Version 1.7";
}
}
}
rpc generate-private-key {
description
"Generates a private key using the specified algorithm and
key length.";
input {
leaf name {
type string;
mandatory true;
description
"The name this private-key should have when listed in
/keychain/private-keys/private-key. As such, the
passed value must not match any existing 'name' value.";
}
leaf algorithm {
type enumeration {
enum rsa { description "TBD"; }
enum dsa { description "TBD"; }
enum secp192r1 { description "TBD"; }
enum sect163k1 { description "TBD"; }
enum sect163r2 { description "TBD"; }
enum secp224r1 { description "TBD"; }
enum sect233k1 { description "TBD"; }
enum sect233r1 { description "TBD"; }
enum secp256r1 { description "TBD"; }
enum sect283k1 { description "TBD"; }
enum sect283r1 { description "TBD"; }
enum secp384r1 { description "TBD"; }
enum sect409k1 { description "TBD"; }
enum sect409r1 { description "TBD"; }
enum secp521r1 { description "TBD"; }
enum sect571k1 { description "TBD"; }
enum sect571r1 { description "TBD"; }
}
mandatory true;
description
"The algorithm to be used.";
}
leaf key-length {
type uint32;
mandatory true;
description
"The key length to be used.";
}
}
}
}