Commit graph

179 commits

Author SHA1 Message Date
Herman Slatman
4bb88adf63
Move SCEP checks after reload of provisioners in CA initialization 2023-05-01 23:59:48 +02:00
Mariano Cano
ddd5057f63
Allow root and federated root bundles
This commit changes the parsing of root and federated roots to support
a bundle of certificates, this makes easier to configure a root rotation
when using helm charts, just appending the old root.
2022-11-08 17:06:22 -08:00
Mariano Cano
812fee7630
Start crl generator before setting initOnce 2022-10-27 11:38:30 -07:00
Mariano Cano
59775fff0c
Merge branch 'master' into crl-support 2022-10-27 10:13:19 -07:00
Mariano Cano
8200d19894
Improve CRL implementation
This commit adds some changes to PR #731, some of them are:
- Add distribution point to the CRL
- Properly stop the goroutine that generates the CRLs
- CRL config validation
- Remove expired certificates from the CRL
- Require enable set to true to generate a CRL

This last point is the principal change in behaviour from the previous
implementation. The CRL will not be generated if it's not enabled, and
if it is enabled it will always be regenerated at some point, not only
if there is a revocation.
2022-10-26 18:55:24 -07:00
Herman Slatman
9d04e7d1dc
Remove period in log output 2022-10-24 15:33:48 +02:00
Herman Slatman
fd38dd34f9
Fix PR comments 2022-10-24 14:51:27 +02:00
Herman Slatman
49718f1bbb
Fix some comments 2022-10-21 11:48:59 +02:00
Herman Slatman
d981b9e0dc
Add --admin-subject flag to ca init
The first super admin subject can now be provided through the
`--admin-subject` flag when initializing a CA.

It's not yet possible to configure the subject of the first
super admin when provisioners are migrated from `ca.json` to the
database. This effectively limits usage of the flag to scenarios
in which the provisioners are written to the database immediately,
so when `--remote-management` is enabled. It currently also doesn't
work with Helm deployments, because there's no mechanism yet to
pass this type of option to the Helm chart.

This commit partially addresses https://github.com/smallstep/cli/issues/697
2022-10-14 16:03:41 +02:00
Herman Slatman
674206320c
Write updated CA configuration after migrating provisioners 2022-10-11 14:12:06 +02:00
Herman Slatman
c9ee4a9f9d
Disable initialization log output if started with --quiet 2022-10-11 12:19:48 +02:00
Raal Goff
f7df865687 refactor crl config, add some tests 2022-10-07 10:30:00 +08:00
Herman Slatman
cebb7d7ef0
Add automatic migration of provisioners
Provisioners stored in the CA configuration file are
automatically migrated to the database.

Currently no cleanup of the provisioners in the
configuration file yet. In certain situations this
may not work as expected, for example if the CA can't
write to the file. But it's probalby good to try it, so
that we can keep the configuration state of the CA consistent.
2022-10-06 17:14:02 +02:00
Raal Goff
d0e81af524 Merge branch 'master' into crl-support 2022-09-30 08:45:48 +08:00
Andrew Reed
7101fbb0ee
Provisioner webhooks (#1001) 2022-09-29 19:16:26 -05:00
Mariano Cano
965d59c0a8 Fix comment typos and extra white spaces 2022-09-23 10:50:44 -07:00
Mariano Cano
23045e1812 Clarify comments by code review 2022-09-22 11:05:06 -07:00
Mariano Cano
325d8bca4f Merge branch 'master' into name-constraints 2022-09-21 13:29:44 -07:00
Mariano Cano
debe565e42 Validate constraints on Sign and Renew/Rekey
Fixes #1060
2022-09-20 18:52:47 -07:00
max furman
ab0d2503ae
Standardize linting file and fix or ignore lots of linting errors 2022-09-20 16:35:41 -07:00
Mariano Cano
2a15e3eee1 Rename constraint.Service to constraint.Engine 2022-09-20 11:38:32 -07:00
Raal Goff
40baf73dff remove incorrect check on revoked certificate dates, add mutex lock for generating CRLs, 2022-09-15 15:03:42 +08:00
Mariano Cano
4a4f7ca9ba Fix panic if cacheDuration is not set 2022-09-14 11:16:47 -07:00
Raal Goff
924082bb49 fix linter errors 2022-09-08 10:09:37 +08:00
Raal Goff
d2483f3a70 Merge branch 'master' into crl-support
# Conflicts:
#	authority/config/config.go
2022-09-08 09:45:04 +08:00
Mariano Cano
0c7467ceb2 Allow to automatically configure and linked RA 2022-08-16 14:39:02 -07:00
Mariano Cano
369b8f81c3 Use go.step.sm/crypto/kms
Fixes #975
2022-08-08 17:58:18 -07:00
Mariano Cano
9408d0f24b Send RA provisioner information to the CA 2022-08-02 19:28:49 -07:00
Raal Goff
60671b07d7 Merge branch 'master' into crl-support
# Conflicts:
#	api/api.go
#	authority/config/config.go
#	cas/softcas/softcas.go
#	db/db.go
2022-07-13 08:52:58 +08:00
Mariano Cano
94f5b92513 Use proper context in authority package 2022-05-23 15:31:43 -07:00
Mariano Cano
26dd97e718 Merge branch 'master' into context-authority 2022-05-23 12:36:16 -07:00
Max
f8148071fb
Merge pull request #915 from smallstep/max/removing-beta
exposing authority configuration for provisioner cli commands
2022-05-19 22:53:59 -07:00
max furman
25b8d196d8 Couple changes in response to PR
- add skipInit option to skip authority initialization
- check admin API status when removing provisioners - no need to check
  admins when not using Admin API
2022-05-11 17:04:43 -07:00
Mariano Cano
8942422973 Add GetID() and add authority to initial context 2022-05-10 16:51:09 -07:00
Mariano Cano
d461918eb0 Merge branch 'master' into context-authority 2022-05-06 13:21:41 -07:00
max furman
4cb74e7d8b fix linter warnings 2022-04-30 13:08:28 -07:00
Mariano Cano
48e2fabeb8 Add authority.MustFromContext 2022-04-27 11:38:06 -07:00
Mariano Cano
9628fa3562 Add methods to store and retrieve an authority from the context. 2022-04-26 12:54:54 -07:00
Herman Slatman
6e1f8dd7ab
Refactor policy engines into container 2022-04-26 13:12:16 +02:00
max furman
b91affdd34 exposing authority configuration for provisioner cli commands 2022-04-25 10:23:07 -07:00
Herman Slatman
3eecc4f7bb
Improve test coverage for reloadPolicyEngines 2022-04-19 17:10:13 +02:00
Herman Slatman
9797b3350e
Merge branch 'master' into herman/allow-deny 2022-04-08 16:01:56 +02:00
Mariano Cano
b7e11da480 Merge branch 'master' into feat/linkedra 2022-04-07 18:19:04 -07:00
Herman Slatman
034b7943fe
Merge branch 'master' into herman/allow-deny 2022-04-07 14:12:20 +02:00
Raal Goff
53dbe2309b implemented some requested changes 2022-04-06 08:24:49 +08:00
Raal Goff
a607ab189a requested changes 2022-04-06 08:23:55 +08:00
Raal Goff
d417ce3232 implement changes from review 2022-04-06 08:23:53 +08:00
Carl Tashian
150eee70df Updates based on Herman's feedback 2022-04-05 10:59:25 -07:00
Carl Tashian
43f2c655b9 More info on startup 2022-04-04 12:16:37 -07:00
Herman Slatman
96f4c49b0c
Improve how policy errors are returned and used 2022-04-04 13:58:16 +02:00