fix(be): Sectigo R46 CA remediation

Author: mamartinezmejia

.github/workflows/.tools-deploy.yml

@@ -24,14 +24,12 @@ jobs:
           tag_fallback: latest
           triggers: ('legacydb/')
 
-      - name: Build (backend) with Sectigo PEM
+      - name: Build (backend)
         uses: bcgov/action-builder-ghcr@cb2629351c87dd1c2130073e4ebb7233a9653a63 # v4.4.1
         with:
           package: backend
           tag_fallback: latest
           triggers: ('backend/')
-          build_args: |
-            --build-arg SECTIGO_R46_PEM=${{ secrets.SECTIGO_R46_PEM }}
 
   pre-tools:
     name: Pre Deploy Tools

.github/workflows/pr-open.yml

@@ -35,19 +35,7 @@ jobs:
       matrix:
         package: [backend, database, frontend, legacy, processor]
     steps:
-      - name: Build (backend) with Sectigo PEM
-        if: ${{ matrix.package == 'backend' }}
-        uses: bcgov/action-builder-ghcr@cb2629351c87dd1c2130073e4ebb7233a9653a63 # v4.4.1
-        with:
-          package: backend
-          tag_fallback: latest
-          triggers: ('backend/')
-          # Pass the PEM as a build-arg from GitHub Secrets; DO NOT commit the PEM file to repo
-          build_args: |
-            --build-arg SECTIGO_R46_PEM=${{ secrets.SECTIGO_R46_PEM }}
-
-      - name: Build (other packages)
-        if: ${{ matrix.package != 'backend' }}
+      - name: Build
         uses: bcgov/action-builder-ghcr@cb2629351c87dd1c2130073e4ebb7233a9653a63 # v4.4.1
         with:
           package: ${{ matrix.package }}

backend/Dockerfile

@@ -1,61 +1,69 @@
 ### Builder
 FROM ghcr.io/graalvm/native-image:22.3.3 AS build
 
-# --- SSL Root CA Refresh (Sectigo R46) ---
+# --- SSL Root CA Import (Sectigo Public Server Authentication Root R46) ---
 # Canada Post rotated its certificate chain to a root (Sectigo Public Server Authentication Root R46)
 # missing from the older JDK bundled with this GraalVM image. We need that root in the trust store
 # BEFORE native-image build so the embedded trust store trusts Canada Post endpoints.
-# Policy: do NOT commit the PEM. Approaches supported:
-#  1. Provide the PEM via build arg SECTIGO_R46_PEM (recommended; store content in GitHub/OpenShift secret).
-#  2. Fallback: attempt network fetch from crt.sh (public CT log) if build arg not supplied.
-ARG SECTIGO_R46_PEM=""
+# Source of truth: the reviewed, checked-in public certificate below (see backend/certs/ for
+# provenance and rotation notes). This is public CA material, not a secret. The fingerprint is
+# pinned and verified before import; there is no network fetch (e.g. crt.sh) in this build path.
+ARG SECTIGO_R46_ALIAS="sectigo-r46-root"
+ARG SECTIGO_R46_SHA256="7B:B6:47:A6:2A:EE:AC:88:BF:25:7A:A5:22:D0:1F:FE:A3:95:E0:AB:45:C7:3F:93:F6:56:54:EC:38:F2:5A:06"
 
-RUN set -e; \
+COPY certs/sectigo-r46-root.pem /tmp/sectigo-r46-root.pem
+
+RUN set -eu; \
   CERT_FILE=/tmp/sectigo-r46-root.pem; \
-  echo "--- Starting Sectigo CA Import ---"; \
-  if [ -n "$SECTIGO_R46_PEM" ]; then \
-    echo "Using provided SECTIGO_R46_PEM build argument."; \
-    printf '%b' "$SECTIGO_R46_PEM" > "$CERT_FILE"; \
-  else \
-    echo "Attempting remote fetch of Sectigo R46 root..."; \
-    curl -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
-         --retry 5 \
-         --retry-delay 5 \
-         --retry-connrefused \
-         -fsSL 'https://crt.sh/?d=4256644734' \
-         -o "$CERT_FILE" \
-      || { echo "ERROR: Curl failed to connect to crt.sh."; exit 1; }; \
-    \
-    echo "Verifying downloaded file format..."; \
-    grep -q "BEGIN CERTIFICATE" "$CERT_FILE" || { \
-      echo "ERROR: Downloaded file is not a valid PEM. crt.sh likely returned an HTML error page. File content:"; \
-      cat "$CERT_FILE"; \
-      exit 1; \
-    }; \
+  ALIAS="$SECTIGO_R46_ALIAS"; \
+  KEYSTORE="$JAVA_HOME/lib/security/cacerts"; \
+  STOREPASS=changeit; \
+  echo "--- Sectigo R46 CA import ---"; \
+  [ -s "$CERT_FILE" ] || { echo "ERROR: $CERT_FILE is missing or empty. Ensure backend/certs/sectigo-r46-root.pem is committed and included in the build context."; exit 1; }; \
+  grep -q "BEGIN CERTIFICATE" "$CERT_FILE" || { echo "ERROR: $CERT_FILE does not contain PEM certificate data."; exit 1; }; \
+  [ -f "$KEYSTORE" ] || { echo "ERROR: keystore $KEYSTORE was not found in this image."; exit 1; }; \
+  [ -w "$KEYSTORE" ] || { echo "ERROR: keystore $KEYSTORE is not writable."; exit 1; }; \
+  echo "Validating certificate with keytool..."; \
+  keytool -printcert -file "$CERT_FILE" > /tmp/sectigo-r46-root.info 2>/tmp/sectigo-r46-root.err \
+    || { echo "ERROR: certificate is malformed and failed to parse:"; cat /tmp/sectigo-r46-root.err; rm -f "$CERT_FILE" /tmp/sectigo-r46-root.info /tmp/sectigo-r46-root.err; exit 1; }; \
+  ACTUAL_SHA256=$(grep -i "SHA256:" /tmp/sectigo-r46-root.info | head -1 | sed 's/.*SHA256: *//' | tr -d ' \t'); \
+  [ -n "$ACTUAL_SHA256" ] || { echo "ERROR: could not extract a SHA-256 fingerprint from the certificate."; exit 1; }; \
+  EXPECTED_NORM=$(echo "$SECTIGO_R46_SHA256" | tr '[:lower:]' '[:upper:]' | tr -d ':'); \
+  ACTUAL_NORM=$(echo "$ACTUAL_SHA256" | tr '[:lower:]' '[:upper:]' | tr -d ':'); \
+  if [ "$ACTUAL_NORM" != "$EXPECTED_NORM" ]; then \
+    echo "ERROR: certificate fingerprint mismatch."; \
+    echo "  expected sha256: $SECTIGO_R46_SHA256"; \
+    echo "  actual sha256:   $ACTUAL_SHA256"; \
+    rm -f "$CERT_FILE" /tmp/sectigo-r46-root.info /tmp/sectigo-r46-root.err; \
+    exit 1; \
   fi; \
-  \
-  echo "Checking if alias already exists in trust store..."; \
-  if keytool -list -keystore "$JAVA_HOME/lib/security/cacerts" -storepass changeit -alias sectigo-r46-root >/dev/null 2>&1; then \
-    echo "Alias sectigo-r46-root already exists, skipping import."; \
+  echo "Fingerprint verified (sha256=$ACTUAL_SHA256)."; \
+  if keytool -list -keystore "$KEYSTORE" -storepass "$STOREPASS" -alias "$ALIAS" >/dev/null 2>&1; then \
+    EXISTING_SHA256=$(keytool -list -v -keystore "$KEYSTORE" -storepass "$STOREPASS" -alias "$ALIAS" 2>/dev/null \
+      | grep -i "SHA256:" | head -1 | sed 's/.*SHA256: *//' | tr -d ' \t' | tr '[:lower:]' '[:upper:]' | tr -d ':'); \
+    if [ "$EXISTING_SHA256" = "$EXPECTED_NORM" ]; then \
+      echo "Alias $ALIAS already present in $KEYSTORE with matching fingerprint; skipping import."; \
+    else \
+      echo "ERROR: alias $ALIAS already exists in $KEYSTORE with a mismatched fingerprint (found $EXISTING_SHA256)."; \
+      rm -f "$CERT_FILE" /tmp/sectigo-r46-root.info /tmp/sectigo-r46-root.err; \
+      exit 1; \
+    fi; \
   else \
-    echo "Importing certificate..."; \
+    echo "Importing certificate as alias $ALIAS..."; \
     keytool -importcert \
       -trustcacerts \
       -noprompt \
-      -alias sectigo-r46-root \
+      -alias "$ALIAS" \
       -file "$CERT_FILE" \
-      -keystore "$JAVA_HOME/lib/security/cacerts" \
-      -storepass changeit; \
+      -keystore "$KEYSTORE" \
+      -storepass "$STOREPASS"; \
   fi; \
-  \
   echo "Verifying successful installation..."; \
-  keytool -list \
-    -keystore "$JAVA_HOME/lib/security/cacerts" \
-    -storepass changeit \
-    -alias sectigo-r46-root >/dev/null; \
+  keytool -list -keystore "$KEYSTORE" -storepass "$STOREPASS" -alias "$ALIAS" >/dev/null 2>&1 \
+    || { echo "ERROR: post-import verification failed for alias $ALIAS."; exit 1; }; \
   \
-  rm -f "$CERT_FILE"; \
-  echo "--- Sectigo CA Import Successful ---"
+  rm -f "$CERT_FILE" /tmp/sectigo-r46-root.info /tmp/sectigo-r46-root.err; \
+  echo "--- Sectigo R46 CA import complete (alias=$ALIAS, sha256=$ACTUAL_SHA256) ---"
 
 # Copy
 WORKDIR /app
@@ -81,4 +89,4 @@ HEALTHCHECK CMD curl -f http://localhost:8080/actuator/health | grep '"status":"
 ENV SPRING_PROFILES_ACTIVE=container
 
 # Startup
-ENTRYPOINT ["/app/nr-forest-client-backend"]
+ENTRYPOINT ["/app/nr-forest-client-backend"]

backend/certs/sectigo-r46-root.md

@@ -0,0 +1,56 @@
+# Sectigo Public Server Authentication Root R46
+
+This directory contains a **public** root CA certificate, checked into source control
+per Option A of the Sectigo R46 CA build remediation plan. It is not a credential:
+it contains no private key and grants no access by itself. It is required so the
+GraalVM native-image build trusts Canada Post's TLS chain, which was rotated to this
+root.
+
+## Certificate record
+
+| Field | Value |
+|---|---|
+| File | `sectigo-r46-root.pem` |
+| Subject | `CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB` |
+| Issuer | `CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB` (self-signed root) |
+| Serial number | `75:8d:fd:8b:ae:7c:07:00:fa:a9:25:a7:e1:c7:ad:14` |
+| Not before | 2021-03-22T00:00:00Z |
+| Not after | 2046-03-21T23:59:59Z |
+| SHA-256 fingerprint (pinned) | `7B:B6:47:A6:2A:EE:AC:88:BF:25:7A:A5:22:D0:1F:FE:A3:95:E0:AB:45:C7:3F:93:F6:56:54:EC:38:F2:5A:06` |
+| Import alias in `cacerts` | `sectigo-r46-root` |
+| Type | Root CA (`BasicConstraints: CA=true`), no private key present |
+
+The pinned fingerprint above is also encoded as the `SECTIGO_R46_SHA256` build
+argument default in [`backend/Dockerfile`](../Dockerfile) and is verified there
+before the certificate is imported. A build fails if the checked-in PEM does not
+hash to this value.
+
+## Provenance
+
+- Source: extracted from the Mozilla-derived CA bundle published at
+  `https://curl.se/ca/cacert.pem` (curl's official CA bundle), which lists this
+  certificate under the entry `Sectigo Public Server Authentication Root R46`.
+- Not sourced from `crt.sh` or any other transient/CI-time lookup.
+- Verified independently with `X509Certificate2` parsing (subject, issuer, serial,
+  validity, SHA-256 fingerprint) before being checked in.
+
+> **Action required before merge:** this record was captured and formatted by an
+> automated coding assistant, not by the certificate/security owner named in
+> Phase 0 of the remediation plan. Before merging, the platform/security owner
+> must independently re-verify the fingerprint above (e.g. with
+> `openssl x509 -in sectigo-r46-root.pem -noout -sha256 -fingerprint`) against an
+> authoritative Sectigo source, sign off, and record their name/date here.
+
+## Rotation
+
+If Canada Post or Sectigo rotates this root:
+
+1. Obtain the new certificate from an authoritative source (Sectigo's certificate
+   repository or a verified endpoint capture) — not from an implicit build-time
+   fetch.
+2. Validate it locally (`openssl x509 -noout -subject -issuer -serial -dates
+   -fingerprint -sha256`).
+3. Replace `sectigo-r46-root.pem` and update the `SECTIGO_R46_SHA256` default in
+   `backend/Dockerfile` and the table above in the same pull request, so the
+   certificate and its pinned fingerprint change atomically.
+4. Have the change reviewed as a security-sensitive dependency update.

backend/certs/sectigo-r46-root.pem

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFijCCA3KgAwIBAgIQdY39i658BwD6qSWn4cetFDANBgkqhkiG9w0BAQwFADBf
+MQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQD
+Ey1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYw
+HhcNMjEwMzIyMDAwMDAwWhcNNDYwMzIxMjM1OTU5WjBfMQswCQYDVQQGEwJHQjEY
+MBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1Ymxp
+YyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQCTvtU2UnXYASOgHEdCSe5jtrch/cSV1UgrJnwUUxDa
+ef0rty2k1Cz66jLdScK5vQ9IPXtamFSvnl0xdE8H/FAh3aTPaE8bEmNtJZlMKpnz
+SDBh+oF8HqcIStw+KxwfGExxqjWMrfhu6DtK2eWUAtaJhBOqbchPM8xQljeSM9xf
+iOefVNlI8JhD1mb9nxc4Q8UBUQvX4yMPFF1bFOdLvt30yNoDN9HWOaEhUTCDsG3X
+ME6WW5HwcCSrv0WBZEMNvSE6Lzzpng3LILVCJ8zab5vuZDCQOc2TZYEhMbUjUDM3
+IuM47fgxMMxF/mL50V0yeUKH32rMVhlATc6qu/m1dkmU8Sf4kaWD5QazYw6A3OAS
+VYCmO2a0OYctyPDQ0RTp5A1NDvZdV3LFOxxHVp3i1fuBYYzMTYCQNFu31xR13NgE
+SJ/AwSiItOkcyqex8Va3e0lMWeUgFaiEAin6OJRpmkkGj80feRQXEgyDet4fsZfu
++Zd4KKTIRJLpfSYFplhym3kT2BFfrsU4YjRosoYwjviQYZ4ybPUHNs2iTG7sijbt
+8uaZFURww3y8nDnAtOFr94MlI1fZEoDlSfB1D++N6xybVCi0ITz8fAr/73trdf+L
+HaAZBav6+CuBQug4urv7qv094PPK306Xlynt8xhW6aWWrL3DkJiy4Pmi1KZHQ3xt
+zwIDAQABo0IwQDAdBgNVHQ4EFgQUVnNYZJX5khqwEioEYnmhQBWIIUkwDgYDVR0P
+AQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAC9c
+mTz8Bl6MlC5w6tIyMY208FHVvArzZJ8HXtXBc2hkeqK5Duj5XYUtqDdFqij0lgVQ
+YKlJfp/imTYpE0RHap1VIDzYm/EDMrraQKFz6oOht0SmDpkBm+S8f74TlH7Kph52
+gDY9hAaLMyZlbcp+nv4fjFg4exqDsQ+8FxG75gbMY/qB8oFM2gsQa6H61SilzwZA
+Fv97fRheORKkU55+MkIQpiGRqRxOF3yEvJ+M0ejf5lG5Nkc/kLnHvALcWxxPDkjB
+JYOcCj+esQMzEhonrPcibCTRAUH4WAP+JWgiH5paPHxsnnVI84HxZmduTILA7rpX
+DhjvLpr3Etiga+kFpaHpaPi8TD8SHkXoUsCjvxInebnMMTzD9joiFgOgyY9mpFui
+TdaBJQbpdqQACj7LzTWb4OE4y2BThihCQRxEV+ioratF4yUQvNs+ZUH7G6aXD+u5
+dHn5HrwdVw1Hr8Mvn4dGp+smWg9WY7ViYG4A++MnESLn/pmPNPW56MORcr3Ywx65
+LvKRRFHQV80MNNVIIb/bE/FmJUNS0nAiNs2fxBx1IK1jcmMGDw4nztJqDby1ORrp
+0XZ60Vzk50lJLVU3aPAaOpg+VBeHVOmmJ1CJeyAvP/+/oYtKR5j/K3tJPsMpRmAY
+QqszKbrAKbkTidOIijlBO8n9pu0f9GBj39ItVQGL
+-----END CERTIFICATE-----