TrueCloudLab/certificates
16
0
Fork 2
Code Issues 1 Pull requests 1 Releases Activity Actions

Renew identity certificate in /ssh/rekey and /ssh/renew

Browse source
This commit is contained in:
Mariano Cano 2019-12-18 14:43:38 -08:00 committed by max furman
parent 47f4ac1b53
commit c1bd1561dd
2 changed files with 35 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
api/sshRekey.go
View file

@ -30,7 +30,8 @@ func (s *SSHRekeyRequest) Validate() error {
// SSHRekeyResponse is the response object that returns the SSH certificate.
type SSHRekeyResponse struct {
Certificate SSHCertificate `json:"crt"`
Certificate SSHCertificate `json:"crt"`
IdentityCertificate []Certificate `json:"identityCrt,omitempty"`
}
// SSHRekey is an HTTP handler that reads an RekeySSHRequest with a one-time-token
@ -72,7 +73,14 @@ func (h *caHandler) SSHRekey(w http.ResponseWriter, r *http.Request) {
return
}
JSONStatus(w, &SSHSignResponse{
Certificate: SSHCertificate{newCert},
identity, err := h.renewIdentityCertificate(r)
if err != nil {
WriteError(w, errs.Forbidden(err))
return
}
JSONStatus(w, &SSHRekeyResponse{
Certificate: SSHCertificate{newCert},
IdentityCertificate: identity,
}, http.StatusCreated)
}

26
api/sshRenew.go
View file

@ -26,7 +26,8 @@ func (s *SSHRenewRequest) Validate() error {
// SSHRenewResponse is the response object that returns the SSH certificate.
type SSHRenewResponse struct {
Certificate SSHCertificate `json:"crt"`
Certificate SSHCertificate `json:"crt"`
IdentityCertificate []Certificate `json:"identityCrt,omitempty"`
}
// SSHRenew is an HTTP handler that reads an RenewSSHRequest with a one-time-token
@ -62,7 +63,28 @@ func (h *caHandler) SSHRenew(w http.ResponseWriter, r *http.Request) {
return
}
identity, err := h.renewIdentityCertificate(r)
if err != nil {
WriteError(w, errs.Forbidden(err))
return
}
JSONStatus(w, &SSHSignResponse{
Certificate: SSHCertificate{newCert},
Certificate: SSHCertificate{newCert},
IdentityCertificate: identity,
}, http.StatusCreated)
}
// renewIdentityCertificate request the client TLS certificate if present.
func (h *caHandler) renewIdentityCertificate(r *http.Request) ([]Certificate, error) {
if r.TLS == nil || len(r.TLS.PeerCertificates) == 0 {
return nil, nil
}
certChain, err := h.Authority.Renew(r.TLS.PeerCertificates[0])
if err != nil {
return nil, err
}
return certChainToPEM(certChain), nil
}