Commit graph

2901 commits

Author SHA1 Message Date
Herman Slatman
479c6d2bf5
Fix ACME IPv6 HTTP-01 challenges
Fixes #890
2022-04-07 12:37:34 +02:00
Mariano Cano
db337debcd Load provisioner from the database instead of the extension. 2022-04-05 19:25:47 -07:00
Mariano Cano
7d6116c3d0 Add GetCertificateData and refactor x509_certs_data. 2022-04-05 19:24:53 -07:00
Mariano Cano
41c6ded85e Store in the db the provisioner that granted a cert. 2022-04-05 18:00:01 -07:00
Mariano Cano
df8ffb35af Remove unnecessary database in provisioner config. 2022-04-05 17:39:06 -07:00
Carl Tashian
949c29d7db
Merge pull request #862 from smallstep/startup-info
Print some basic configuration info on startup
2022-04-05 15:33:59 -07:00
Carl Tashian
2e61e01f41 Linted. 2022-04-05 10:59:35 -07:00
Carl Tashian
150eee70df Updates based on Herman's feedback 2022-04-05 10:59:25 -07:00
Carl Tashian
acc75bc679 Add context name to startup info 2022-04-04 12:29:27 -07:00
Carl Tashian
4b9f44982d Merge branch 'master' into startup-info 2022-04-04 12:19:55 -07:00
Carl Tashian
43f2c655b9 More info on startup 2022-04-04 12:16:37 -07:00
Carl Tashian
7ebb2e4c74
Update ca/ca.go
Co-authored-by: Herman Slatman <hslatman@users.noreply.github.com>
2022-04-04 11:14:04 -07:00
Herman Slatman
679e2945f2
Disallow name constraint wildcard notation 2022-04-04 15:35:49 +02:00
Herman Slatman
96f4c49b0c
Improve how policy errors are returned and used 2022-04-04 13:58:16 +02:00
Herman Slatman
d8776d8f7f
Add K8sSA SSH user policy back
According to the docs, the K8sSA provisioner can be configured
to issue SSH user certs.
2022-04-01 15:37:48 +02:00
Herman Slatman
5f0dc42b1e
Fix tests on Go 1.18 due to IDNA deviations
In Go 1.18 the behavior for looking up domains with non-ASCII
characters was changed to be in accordance with UTS#46
(https://unicode.org/reports/tr46/). There's a slight difference
in how IDNA2003 and IDNA2008 process these. Go 1.18 handles
the deviations in accordance with IDNA2008 now.
2022-03-31 17:16:11 +02:00
Herman Slatman
235a2c9d04
Pin to specific version of go.step.sm/linkedca 2022-03-31 16:40:49 +02:00
Herman Slatman
5daa9fc0b1
Merge branch 'master' into herman/allow-deny 2022-03-31 16:13:50 +02:00
Herman Slatman
571b21abbc
Fix (most) PR comments 2022-03-31 16:12:29 +02:00
Mariano Cano
dc9db5fbba
Merge pull request #882 from smallstep/dep/crypto
Upgrade go.step.sm/crypto
2022-03-30 18:31:07 -07:00
Mariano Cano
f5bf46b950 Upgrade go.step.sm/crypto 2022-03-30 18:24:17 -07:00
Carl Tashian
1ba1584c7a Formatted. 2022-03-30 16:08:10 -07:00
Carl Tashian
a13e58e340 Update GetAuthorityInfo -> GetInfo 2022-03-30 16:07:16 -07:00
Carl Tashian
90cb6315b1 Progress. 2022-03-30 16:05:26 -07:00
Carl Tashian
055e75f394 Progress? 2022-03-30 15:48:42 -07:00
Herman Slatman
bfa4d809fd
Improve middleware test coverage 2022-03-30 18:21:25 +02:00
Herman Slatman
6da243c34d
Add policy precheck for all admins 2022-03-30 15:39:03 +02:00
Herman Slatman
628d7448de
Don't return policy in provisioner JSON 2022-03-30 15:20:38 +02:00
Herman Slatman
2fbdf7d5b0
Merge branch 'master' into herman/allow-deny 2022-03-30 14:50:14 +02:00
Herman Slatman
0e052fe299
Add authority policy API 2022-03-30 14:21:39 +02:00
Panagiotis Siatras
00634fb648
api/render, api/log: initial implementation of the packages (#860)
* api/render: initial implementation of the package

* acme/api: refactored to support api/render

* authority/admin: refactored to support api/render

* ca: refactored to support api/render

* api: refactored to support api/render

* api/render: implemented Error

* api: refactored to support api/render.Error

* acme/api: refactored to support api/render.Error

* authority/admin: refactored to support api/render.Error

* ca: refactored to support api/render.Error

* ca: fixed broken tests

* api/render, api/log: moved error logging to this package

* acme: refactored Error so that it implements render.RenderableError

* authority/admin: refactored Error so that it implements render.RenderableError

* api/render: implemented RenderableError

* api/render: added test coverage for Error

* api/render: implemented statusCodeFromError

* api: refactored RootsPEM to work with render.Error

* acme, authority/admin: fixed pointer receiver name for consistency

* api/render, errs: moved StatusCoder & StackTracer to the render package
2022-03-30 11:22:22 +03:00
Mariano Cano
abf5fc32a3 Format comment. 2022-03-29 14:26:17 -07:00
Mariano Cano
b42c1dfe64
Merge pull request #879 from smallstep/feat/WithX509SignerFunc
Add authority.WithX509SignerFunc
2022-03-29 14:23:33 -07:00
Mariano Cano
c480936ba4 Split comments. 2022-03-29 12:02:17 -07:00
Mariano Cano
0b388942e8 Upgrade linkedca package. 2022-03-28 18:23:36 -07:00
Mariano Cano
955d4cf80d Add authority.WithX509SignerFunc
This change adds a new authority option that allows to pass a callback
that returns the certificate chain and signer used to sign X.509
certificates.

This option will be used by Caddy, they renew the intermediate
certificate weekly and there's no other way to replace it without
re-creating the embedded CA.

Fixes #874
2022-03-28 17:54:35 -07:00
Mariano Cano
8d1ce3133a Merge branch 'master' into feat/linkedra 2022-03-28 15:07:36 -07:00
Mariano Cano
6851842841 Fix unit tests. 2022-03-28 15:06:56 -07:00
Mariano Cano
580a9c1476 Get linked RA configuration using the linked ca client. 2022-03-28 14:55:40 -07:00
Herman Slatman
4cde2696e5 Update cloud.google.com/go/kms 2022-03-28 14:55:40 -07:00
Andrew Reed
52d7f084d2 Add /roots.pem handler (#866)
* Add /roots.pem handler

* Review changes

* Remove no peer cert test case
2022-03-28 14:55:40 -07:00
Mariano Cano
750e9ee2f8 Attempt to fix TestBootstrapClientServerRotation
This change attempts to fix the test TestBootstrapClientServerRotation.
Due to the backdate, the renew options get too large, causing
continuous renewals, and random errors. After experimenting with
different options, truncating durations to seconds have shown better
results than rounding or just use the plain time.
2022-03-28 14:55:40 -07:00
Panagiotis Siatras
27c1d0afc3 add --context flag to step-ca command (#851)
* added the --context flag

* apply the context and allow for different ca.json

* amended usage for consistency

* added an extra example

* added an extra example

* reordered and reworded examples
2022-03-28 14:55:40 -07:00
Panagiotis Siatras
a852223717 scep: remove Interface and the dependency to pkg/errors (#872)
* scep: documented the package

* scep/api: removed some top level constants

* scep: removed dependency to pkg/errors

* scep/api: documented the package
2022-03-28 14:55:40 -07:00
Panagiotis Siatras
bca74cb6a7 scep: minor cleanup (#867)
* api, scep: removed scep.Error

* scep/api: replaced nextHTTP with http.HandlerFunc

* scep/api: renamed writeSCEPResponse to writeResponse

* scep/api: renamed decodeSCEPRequest to decodeRequest

* scep/api: renamed writeError to fail

* scep/api: replaced pkg/errors with errors

* scep/api: formatted imports

* scep/api: do not export SCEPRequest & SCEPResponse

* scep/api: do not export Handler

* api: flush errors better
2022-03-28 14:55:40 -07:00
vijayjt
37207793f9 Pass in the resource name regardless of if its a VM or managed identity 2022-03-28 14:55:40 -07:00
vijayjt
7e47c70af2 Remove redundant parameter type declaration 2022-03-28 14:55:40 -07:00
vijayjt
7b605b2d16 Support Azure tokens from managed identities not associated with a VM 2022-03-28 14:55:39 -07:00
Mariano Cano
76ea1635a7 Change golang to Go 2022-03-28 14:55:39 -07:00
Mariano Cano
5ab79f53be Fix linter errors 2022-03-28 14:55:39 -07:00