37b521ec6c
Merge branch 'master' into feat/vault
2 years ago
9797b3350e
Merge branch 'master' into herman/allow-deny
2 years ago
db337debcd
Load provisioner from the database instead of the extension.
2 years ago
49c41636cc
implemented some requested changes
2 years ago
53dbe2309b
implemented some requested changes
2 years ago
a607ab189a
requested changes
2 years ago
d417ce3232
implement changes from review
2 years ago
668cb6f39c
missed some mentions of PEM when changing the returned format to DER regarding CRL generation
2 years ago
7d024cc4cb
change GenerateCertificateRevocationList to return DER, store DER in db instead of PEM, nicer PEM encoding of CRL, add Mock stubs
2 years ago
e8fdb703c9
initial support for CRL
2 years ago
571b21abbc
Fix (most) PR comments
2 years ago
b49307f326
Fix ACME order tests with mock ACME CA
2 years ago
9e0edc7b50
Add early authority policy evaluation to ACME order API
2 years ago
613c99f00f
Fix linting issues
2 years ago
9d027c17d0
Send current provisioner on PostCertificate
2 years ago
101ca6a2d3
Check admin subjects before changing policy
2 years ago
81b0c6c37c
Add API implementation for authority and provisioner policy
2 years ago
7c541888ad
Refactor configuration of allow/deny on authority level
2 years ago
c0525381eb
Merge branch 'master' into feat/vault
2 years ago
5cb23c6029
Merge pull request #804 from smallstep/herman/normalize-ipv6-dns-names
...
Normalize IPv6 hostname addresses
2 years ago
e887ccaa07
Ensure the CA TLS certificate represents IPv6 DNS names as IP in cert
...
If an IPv6 domain name (i.e. [::1]) is provided manually in the `ca.json`,
this commit will ensure that it's represented as an IP SAN in the TLS
certificate. Before this change, the IPv6 would become a DNS SAN.
2 years ago
300c19f8b9
Add a custom enforcer that can be used to modify a cert.
2 years ago
68b980d689
feat(authority): avoid hardcoded cn in authority csr
2 years ago
50c3bce98d
Change if/if to if/else-if when checking the type of JSON error
2 years ago
a3cf6bac36
Add special handling for *json.UnmarshalTypeError
2 years ago
0475a4d26f
Refactor extraction of JSON template syntax errors
2 years ago
a5455d3572
Improve errors related to template execution failures (slightly)
2 years ago
3bc3957b06
Merge branch 'master' into hs/acme-revocation
3 years ago
47a8a3c463
Add test case for ACME Revoke to Authority
3 years ago
c9cd876a7d
Merge branch 'master' into hs/acme-revocation
3 years ago
ff04873a2a
Change the default error type to forbidden in Sign.
...
The errors will also be propagated from sign options.
3 years ago
668d3ea6c7
Modify errs.Wrap() with bad request to send messages to users.
3 years ago
8ce807a6cb
Modify errs.BadRequest() calls to always send an error to the client.
3 years ago
3151255a25
Merge branch 'master' into hs/acme-revocation
3 years ago
933b40a02a
Introduce gocritic linter and address warnings
3 years ago
42fde8ba28
Merge branch 'master' into linkedca
3 years ago
9e5762fe06
Allow the reuse of azure token if DisableTrustOnFirstUse is true
...
Azure caches tokens for 24h and we cannot issue a new certificate
for the same instance in that period of time.
The meaning of this parameter is to allow the signing of multiple
certificate in one instance. This is possible in GCP, because we
get a new token, and is possible in AWS because we can generate
a new one. On Azure there was no other way to do it unless you
wait for 24h.
Fixes #656
3 years ago
d72fa953ac
Remove debug statements.
3 years ago
3f07eb597a
Implement revocation using linkedca.
3 years ago
0730a165fd
Add collection of files and authority template.
3 years ago
71f8019243
Store x509 and ssh certificates on linkedca if enabled.
3 years ago
8f7e700f09
Merge branch 'master' into hs/acme-revocation
3 years ago
9fdef64709
Admin level API for provisioner mgmt v1
3 years ago
84e7d468f2
Improve handling of ACME revocation
3 years ago
7b5d6968a5
first commit
3 years ago
2cbaee9c1d
Allow to use an alternative interface to store renewed certs.
...
This can be useful to know if a certificate has been renewed and
link one certificate with the 'parent'.
3 years ago
e6833ecee3
Add extension of db.AuthDB to store the fullchain.
...
Add a temporary solution to allow an extension of an db.AuthDB
interface that logs the fullchain of certificates instead of just
the leaf.
3 years ago
0b8528ce6b
Allow mTLS revocation without provisioner.
3 years ago
bcf70206ac
Add support for revocation using an extra provisioner in the RA.
3 years ago
a6115e29c2
Add initial implementation of StepCAS.
...
StepCAS allows to configure step-ca as an RA using another step-ca
as the main CA.
3 years ago
3e0ab8fba7
Fix typo.
4 years ago
d64427487d
Add comment about the missing error check.
4 years ago
e17ce39e3a
Add support for Revoke using CAS.
4 years ago
aad8f9e582
Pass issuer and signer to softCAS options.
...
Remove commented code and initialize CAS properly.
Minor fixes in CloudCAS.
4 years ago
1b1f73dec6
Early attempt to develop a CAS interface.
4 years ago
cef0475e71
Make clear what's a template/unsigned certificate.
4 years ago
c94a1c51be
Merge branch 'master' into ssh-cert-templates
4 years ago
ba918100d0
Use go.step.sm/crypto/jose
...
Replace use of github.com/smallstep/cli/crypto with the new package
go.step.sm/crypto/jose.
4 years ago
81875074e3
tie -> the in comment
4 years ago
cb594ed2e0
go mod tidy and golang 1.15.0 cleanup ...
...
- cs.NegotiatedProtocolIsMutual has been deprecated but we still build
in travis with 1.14 so for now we'll ignore this linting error
- string(int) was resolving to string of a single rune rather than
string of digits -> use fmt.Sprint
4 years ago
d30a95236d
Use always go.step.sm/crypto
4 years ago
0a59efd853
Use new x509util to generate the CA certificate.
4 years ago
4943ae58d8
Move TLSOption, TLSVersion, CipherSuites and ASN1DN to certificates.
4 years ago
ce1eb0a01b
Use new x509util for renew/rekey.
4 years ago
c8d225a763
Use x509util from go.step.sm/crypto/x509util
4 years ago
a7b65f1e1e
Add authority.Sign test with custom templates.
4 years ago
6c64fb3ed2
Rename provisioner options structs:
...
* provisioner.ProvisionerOptions => provisioner.Options
* provisioner.Options => provisioner.SignOptions
* provisioner.SSHOptions => provisioner.SingSSHOptions
4 years ago
ccc705cdcd
Use alias x509legacy to cli x509util in tls.go.
4 years ago
8f0dd811af
Allow to send errors from template to cli.
4 years ago
4795e371bd
Add back the support for ca.json DN template.
4 years ago
d1d9ae42d6
Use certificates x509util instead of cli for certificate signing.
4 years ago
fd05f3249b
A few last fixes and tests added for rekey/renew ...
...
- remove all `renewOrRekey`
- explicitly test difference between renew and rekey (diff pub keys)
- add back tests for renew
4 years ago
ea9bc493b8
Merge pull request #307 from dharanikumar-s/master
...
Add support for rekeying Fixes #292
4 years ago
57fb0c80cf
Removed calculating SubjectKeyIdentifier on Rekey
4 years ago
dfda497929
Renamed RenewOrRekey to Rekey
4 years ago
fe73154a20
Corrected misspelling
4 years ago
2479371c06
Added error check while marshalling public key
4 years ago
c8c3581e2f
SubjectKeyIdentifier extention is calculated from public key passed to this function instead of copying from old certificate
4 years ago
8f504483ce
Added RenewOrRekey function based on @maraino suggestion. RenewOrReky is called from Renew.
4 years ago
3813f57b1a
Add support for rekeying Fixes #292
4 years ago
d25e7f64c2
wip
4 years ago
3636ba3228
wip
4 years ago
1951669e13
wip
4 years ago
bfe1f4952d
Rename interface to CertificateEnforcer and add tests.
4 years ago
64f26c0f40
Enforce a duration for identity certificates.
4 years ago
05cc1437b7
Remove unnecessary parse of certificate.
4 years ago
43bd8113aa
Remove unnecessary comments.
4 years ago
69a1b68283
Merge branch 'ssh' into kms
4 years ago
b265877050
Simplify statuscoder error generators.
4 years ago
c387b21808
Introduce generalized statusCoder errors and loads of ssh unit tests.
...
* StatusCoder api errors that have friendly user messages.
* Unit tests for SSH sign/renew/rekey/revoke across all provisioners.
4 years ago
c62526b39f
Add wip support for kms.
4 years ago
e67ccd9e3d
Add fault tolerance against clock skew accross system on TLS certificates.
4 years ago
8eeb82d0ce
Store renew certificate in the database.
5 years ago
0c3b9ebf45
Fix indentation.
5 years ago
a9ea292bd4
sshpop provisioner + ssh renew | revoke | rekey first pass
5 years ago
bc6074f596
Change api of functions Authority.Sign, Authority.Renew
...
Returns certificate chain instead of 2 members.
Implements #126
5 years ago
fe7973c060
wip
5 years ago
2127d09ef3
Rename context type to apiCtx.
...
It will conflict with the context package.
5 years ago
ab4d569f36
Add /revoke API with interface db backend
5 years ago
8c8547bf65
Remove unnecessary parse and improve tests.
5 years ago
Mariano Cano
Herman Slatman
Mariano Cano
Raal Goff
Herman Slatman
Ahmet DEMIR
max furman
dharanikumar-s
Jozef Kralik