Commit graph

16 commits

Author SHA1 Message Date
Herman Slatman
2d85d4c1c1 Add non-TLS server and improve crypto.Decrypter interface
A server without TLS was added to serve the SCEP endpoints. According
to the RFC, SCEP has to be served via HTTP. The `sscep` client, for
example, will stop any URL that does not start with `http://` from
being used, so serving SCEP seems to be the right way to do it.

This commit adds a second server for which no TLS configuration is
configured. A distinct field in the configuration, `insecureAddress`
was added to specify the address for the insecure server.

The SCEP endpoints will also still be served via HTTPS. Some clients
may be able to work with that.

This commit also improves how the crypto.Decrypter interface is
handled for the different types of KMSes supported by step. The
apiv1.Decrypter interface was added. Currently only SoftKMS
implements this interface, providing a crypto.Decrypter required
for SCEP operations.
2021-05-26 16:09:38 -07:00
Herman Slatman
2a249d20de Refactor initialization of SCEP authority 2021-05-26 16:04:19 -07:00
Mariano Cano
a8260a3289 Add missing test. 2021-02-01 14:25:49 -08:00
Mariano Cano
d9da150a5f Fix test. 2021-01-27 20:23:45 -08:00
Mariano Cano
294f84b8d4 Add initial set of unit tests for pkcs11 kms. 2021-01-27 20:17:14 -08:00
Mariano Cano
8dca652bc7 Add support for PKCS #11 KMS.
The implementation works with YubiHSM2. Unit tests are still pending.

Fixes #301
2021-01-26 20:03:53 -08:00
Anton Lundin
3e6137110b Add support for using ssh-agent as a KMS
This adds a new KMS, SSHAgentKMS, which is a KMS to provide signing keys
for issuing ssh certificates signed by a key managed by a ssh-agent. It
uses the golang.org/x/crypto package to get a native Go implementation
to talk to a ssh-agent.

This was primarly written to be able to use gpg-agent to provide the
keys stored in a YubiKeys openpgp interface, but can be used for other
setups like proxying a ssh-agent over network.

That way the signing key for ssh certificates can be kept in a
"sign-only" hsm.

This code was written for my employer Intinor AB, but for simplicity
sake gifted to me to contribute upstream.

Signed-off-by: Anton Lundin <glance@acc.umu.se>
2020-11-04 09:06:23 +01:00
Mariano Cano
f100b2d0e3 Make the YubiKey management key configurable.
With this change the default management key is not required as the
user is able to set its own.

Fixes #323
2020-09-17 16:07:32 -07:00
Mariano Cano
82fb96588e Fix unit tests. 2020-05-19 17:45:15 -07:00
Mariano Cano
c32abb76cd Add initial implementation to support AWS KMS. 2020-05-19 17:35:36 -07:00
Mariano Cano
63e36ecd7a Refactor the initialization of KeyManagers. 2020-05-11 18:47:22 -07:00
Mariano Cano
6868190fff Add initial support for yubikey. 2020-05-07 18:22:09 -07:00
Mariano Cano
264179cda3 Add tests for kms and kms/apiv1 packages. 2020-01-15 17:56:50 -08:00
Mariano Cano
927a3b3a86 Return crypto.PublicKey on kms.GetPublicKey. 2020-01-15 17:27:21 -08:00
Mariano Cano
3f8de17a40 Cleanup types and add initial support for the options required for PKCS11. 2020-01-14 18:42:14 -08:00
Mariano Cano
d13754166a Add support for cloudkms and softkms. 2020-01-09 18:41:13 -08:00