Onboarding NPIs to Trust Bundle Install Module

This document describes how to enable and configure the tlBMC Trust Bundle Install Module for an NPI. This module enables certificate and secure credential management through Redfish.

Prerequisites

To use the Trust Bundle Install Module, it must be enabled for your platform in tlbmc_config_bundle.textproto. If it is not enabled, tlBMC will not expose the necessary Redfish routes for certificate management.

See tlbmc_config_bundle.textproto in tlbmc source.

To enable the module, add trust_bundle_install_module { enabled: true } to your platform's configuration in platform_to_config map. For example:

platform_to_config {
  key: "your_platform_name"
  value {
    trust_bundle_install_module {
      enabled: true
    }
  }
}

Functionality

When the Trust Bundle Install Module is enabled, tlBMC claims ownership of Redfish routes related to certificate management and configures security policies. Specifically, it:

• Enables Certificate Service Routes:
  • /redfish/v1/CertificateService
  • /redfish/v1/CertificateService/CertificateLocations
  • Manager certificate collections and actions under /redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates (and other cert collections).
• Instantiates the Credential Manager: Enables back-end handling of secure credentials, allowing:
  • Generating Certificate Signing Requests (CSR).
  • Installing and replacing Server Certificates (e.g., HTTPS certificates).
  • Installing and validating Trust Bundles (CA certificates).
  • Installing OS Verification Certificates and Serial Console CA Keys.
• Restricts Authorization Policy: Enforces a strict authorization policy during recovery states, ensuring only certificate-related actions are permitted.

These features allow secure bootstrap and identity provision for the BMC over standard Redfish APIs.

Code References

• all_routes.cc (registers routes if enabled)
• store_impl.cc (instantiates CredentialManager)
• credential_manager.h