16 Commits (10f6a901ec98f0eb7ba101f772cc96f2694abb25)

Author	SHA1	Message	Date
Mariano Cano	10f6a901ec	Let the CA determine the RA lifetime ... When the RA mode with StepCAS is used, let the CA decide which lifetime the RA should get instead of requiring always 24h. This commit also fixes linter warnings. Related to #1094	3 months ago
max furman	8b256f0351	address linter warning for go 1.19	1 year ago
max furman	ab0d2503ae	Standardize linting file and fix or ignore lots of linting errors	2 years ago
Mariano Cano	a7fcfe0e4e	Verify with roots and intermediates	2 years ago
Mariano Cano	ea8579f3df	Fix bad signature algorithm on EC+RSA PKI ... When the root certificate has an EC key and he intermediate has an RSA key, the signature algorithm of the leafs should be the default one, SHA256WithRSA, instead of the one that the intermediate has. Fixes #1033	2 years ago
Mariano Cano	369b8f81c3	Use go.step.sm/crypto/kms ... Fixes #975	2 years ago
Mariano Cano	31af1efa48	Sign certificates with the issuer signature algorithm ... An RSA key can sign another certificates using the RSA PKCS#1 and the RSA-PSS scheme, this change will keep the signature algorithm used in the issuer in the signed certificates instead of using PKCS#1 by default.	2 years ago
Mariano Cano	955d4cf80d	Add authority.WithX509SignerFunc ... This change adds a new authority option that allows to pass a callback that returns the certificate chain and signer used to sign X.509 certificates. This option will be used by Caddy, they renew the intermediate certificate weekly and there's no other way to replace it without re-creating the embedded CA. Fixes #874	2 years ago
Mariano Cano	e15b5faf7d	Merge branch 'master' into keyvault	3 years ago
max furman	933b40a02a	Introduce gocritic linter and address warnings	3 years ago
Mariano Cano	52a18e0c2d	Add key name to CreateCertificateAuthority	3 years ago
Mariano Cano	6d644880bd	Allow to kms signers to define the SignatureAlgorithm ... CloudKMS keys signs data using an specific signature algorithm, in RSA keys, this can be PKCS#1 RSA or RSA-PSS, if the later is used, x509.CreateCertificate will fail unless the template SignatureCertificate is properly set. On contrast, AWSKMS RSA keys, are just RSA keys, and can sign with PKCS#1 or RSA-PSS schemes, so right now the way to enforce one or the other is to used templates.	3 years ago
Herman Slatman	7ad90d10b3	Refactor initialization of SCEP authority	3 years ago
Miclain Keffeler	7545b4a625	leverage intermediate_ca.crt for appending certs.	3 years ago
Mariano Cano	7aa8a8fe1e	Complete tests for softCAS.	4 years ago
Mariano Cano	e146b3fe16	Add Unit tests for softcas.	4 years ago