28 Commits (8b256f0351f9295eb2c91d81d7556e8f84a369dc)

Author	SHA1	Message	Date
max furman	8b256f0351	address linter warning for go 1.19	1 year ago
Mariano Cano	8200d19894	Improve CRL implementation ... This commit adds some changes to PR #731, some of them are: - Add distribution point to the CRL - Properly stop the goroutine that generates the CRLs - CRL config validation - Remove expired certificates from the CRL - Require enable set to true to generate a CRL This last point is the principal change in behaviour from the previous implementation. The CRL will not be generated if it's not enabled, and if it is enabled it will always be regenerated at some point, not only if there is a revocation.	2 years ago
Raal Goff	d0e81af524	Merge branch 'master' into crl-support	2 years ago
max furman	ab0d2503ae	Standardize linting file and fix or ignore lots of linting errors	2 years ago
Raal Goff	924082bb49	fix linter errors	2 years ago
Raal Goff	d2483f3a70	Merge branch 'master' into crl-support ... # Conflicts: # authority/config/config.go	2 years ago
Mariano Cano	ea8579f3df	Fix bad signature algorithm on EC+RSA PKI ... When the root certificate has an EC key and he intermediate has an RSA key, the signature algorithm of the leafs should be the default one, SHA256WithRSA, instead of the one that the intermediate has. Fixes #1033	2 years ago
Mariano Cano	369b8f81c3	Use go.step.sm/crypto/kms ... Fixes #975	2 years ago
Raal Goff	60671b07d7	Merge branch 'master' into crl-support ... # Conflicts: # api/api.go # authority/config/config.go # cas/softcas/softcas.go # db/db.go	2 years ago
Mariano Cano	31af1efa48	Sign certificates with the issuer signature algorithm ... An RSA key can sign another certificates using the RSA PKCS#1 and the RSA-PSS scheme, this change will keep the signature algorithm used in the issuer in the signed certificates instead of using PKCS#1 by default.	2 years ago
Raal Goff	c8b38c0e13	implemented requested changes	2 years ago
Raal Goff	d417ce3232	implement changes from review	2 years ago
Raal Goff	e8fdb703c9	initial support for CRL	2 years ago
Mariano Cano	955d4cf80d	Add authority.WithX509SignerFunc ... This change adds a new authority option that allows to pass a callback that returns the certificate chain and signer used to sign X.509 certificates. This option will be used by Caddy, they renew the intermediate certificate weekly and there's no other way to replace it without re-creating the embedded CA. Fixes #874	2 years ago
Mariano Cano	e15b5faf7d	Merge branch 'master' into keyvault	3 years ago
max furman	933b40a02a	Introduce gocritic linter and address warnings	3 years ago
Mariano Cano	52a18e0c2d	Add key name to CreateCertificateAuthority	3 years ago
Mariano Cano	e4e799ca85	Fix typos in comment.	3 years ago
Mariano Cano	6d644880bd	Allow to kms signers to define the SignatureAlgorithm ... CloudKMS keys signs data using an specific signature algorithm, in RSA keys, this can be PKCS#1 RSA or RSA-PSS, if the later is used, x509.CreateCertificate will fail unless the template SignatureCertificate is properly set. On contrast, AWSKMS RSA keys, are just RSA keys, and can sign with PKCS#1 or RSA-PSS schemes, so right now the way to enforce one or the other is to used templates.	3 years ago
Miclain Keffeler	ffbfcfb1f2	format.	3 years ago
Miclain K Keffeler	f3396bf964	Update softcas.go	3 years ago
Miclain Keffeler	7545b4a625	leverage intermediate_ca.crt for appending certs.	3 years ago
Mariano Cano	b2ae112dd2	Add initial tests for CreateCertificateAuthority.	4 years ago
Mariano Cano	2b4b902975	Add initial support for `step ca init` with cloud cas. ... Fixes smallstep/cli#363	4 years ago
Mariano Cano	e146b3fe16	Add Unit tests for softcas.	4 years ago
Mariano Cano	1550a21f68	Fix unit tests.	4 years ago
Mariano Cano	aad8f9e582	Pass issuer and signer to softCAS options. ... Remove commented code and initialize CAS properly. Minor fixes in CloudCAS.	4 years ago
Mariano Cano	1b1f73dec6	Early attempt to develop a CAS interface.	4 years ago