Commit graph

3039 commits

Author SHA1 Message Date
Herman Slatman
5b713a564c
Change CM link 2022-02-10 12:55:47 +01:00
Herman Slatman
5cb23c6029
Merge pull request #804 from smallstep/herman/normalize-ipv6-dns-names
Normalize IPv6 hostname addresses
2022-02-09 11:25:24 +01:00
Herman Slatman
d00729df0b
Refactor ACME Admin API 2022-02-08 13:26:30 +01:00
Mariano Cano
588c72c046
Merge pull request #817 from Cpcrook/chore/#816-provisioner-decryption-error-messaging
Add descriptive provisioner JWK decryption error messages
2022-02-07 10:14:36 -08:00
Ahmet DEMIR
a9550a746f
fix: add back commented tests 2022-02-06 23:35:17 +01:00
Ahmet DEMIR
ab5197500c
fix: a certificat must excldue the root and you should use verified chained intermediate 2022-02-06 23:29:49 +01:00
Chris Crook
11637b5793 Add descriptive provisioner JWK decryption error messages
Wrap other errors in decryption process with more helpful messaging.  This should help users troubleshoot misconfiguration more easily.

Fixes #816
2022-02-04 17:53:58 -05:00
max furman
039d2455d9 changelog update 2022-02-03 13:21:58 -08:00
max furman
5f4ac5beff Fix broken test due to linter fix 2022-02-03 12:43:53 -08:00
max furman
62690ab52e Fix linting errors and pin linter version in release action 2022-02-03 12:23:02 -08:00
Mariano Cano
d384b534c7
Merge pull request #814 from smallstep/x509-enforcer
Authority enforcer option
2022-02-03 10:53:04 -08:00
Herman Slatman
bfa2245abb
Merge branch 'master' into herman/normalize-ipv6-dns-names 2022-02-03 17:24:08 +01:00
Herman Slatman
e887ccaa07
Ensure the CA TLS certificate represents IPv6 DNS names as IP in cert
If an IPv6 domain name (i.e. [::1]) is provided manually in the `ca.json`,
this commit will ensure that it's represented as an IP SAN in the TLS
certificate. Before this change, the IPv6 would become a DNS SAN.
2022-02-03 14:21:23 +01:00
Herman Slatman
1fe7362bee
Normalize IPv6 addresses in ACME linker 2022-02-03 13:55:15 +01:00
Mariano Cano
300c19f8b9 Add a custom enforcer that can be used to modify a cert. 2022-02-02 14:36:58 -08:00
J. Hunter Hawke
808f039b09
Added some example ansible configs (#813) 2022-02-02 18:54:55 +01:00
Herman Slatman
88c7b63c9d
Split SSH user and cert policy configuration and execution 2022-02-01 15:18:39 +01:00
Herman Slatman
a7eb27d309
Fix URI domains IDNA support 2022-01-31 15:34:02 +01:00
Herman Slatman
acd13cb92d
Merge branch 'master' of github.com:smallstep/certificates into herman/allow-deny 2022-01-31 14:43:46 +01:00
Herman Slatman
c1424036bf
Merge branch 'master' into herman/allow-deny 2022-01-31 14:24:34 +01:00
Herman Slatman
4a0cfd24e5
Merge pull request #797 from smallstep/herman/scep-macos-renewal-fixes
Fix macOS SCEP client issues
2022-01-31 13:27:44 +01:00
Herman Slatman
c7c5c3c94e
Merge branch 'master' into herman/scep-macos-renewal-fixes 2022-01-31 13:20:16 +01:00
Herman Slatman
c57dfeec2d
Merge pull request #650 from hslatman/hs/acme-eab
ACME External Account Binding
2022-01-31 12:21:22 +01:00
Herman Slatman
bf21319e76
Fix PR comments and issue with empty string slices 2022-01-28 13:26:56 +01:00
Mariano Cano
09a9b3e1c8 Upgrade go.step.sm/crypto 2022-01-27 13:12:50 -08:00
Herman Slatman
5f42ae0bce
Remove unused function LoadProvisionerByID from SCEP 2022-01-27 21:06:55 +01:00
Herman Slatman
9617edf0c2
Improve internationalized domain name handling
This PR improves internationalized domain name handling according
to rules of IDNA and based on the description in RFC 5280, section 7:
https://datatracker.ietf.org/doc/html/rfc5280#section-7.

Support for internationalized URI(s), so-called IRIs, still needs to
be done.
2022-01-27 17:18:33 +01:00
Ahmet DEMIR
782ff76963
fix: apply suggestion to use cr only 2022-01-27 11:19:31 +01:00
Ahmet DEMIR
b49ac2501b
feat: enhance options and fix revoke plus more tests 2022-01-27 11:14:19 +01:00
Ahmet DEMIR
8ef3abf6d9
fix: minus d on Ed 2022-01-26 11:29:21 +01:00
Herman Slatman
512b8d6730
Refactor instantiation of policy engines
Instead of using the `base` struct, the x509 and SSH policy
engines are now added to each provisioner directly.
2022-01-25 16:45:25 +01:00
Herman Slatman
066bf32086
Fix part of PR comments 2022-01-25 15:00:07 +01:00
Herman Slatman
fd9845e9c7
Add cursor and limit to ACME EAB DB interface 2022-01-24 14:03:56 +01:00
Herman Slatman
ad041d6bb7
Fix deprecation of grpc.WithInsecure option
With the update of go.step.sm/linkedca grpc.WithInsecure was
deprecated. This commit fixes this by setting up the (insecure)
connection using the new method.
2022-01-21 16:17:40 +01:00
Herman Slatman
3b72d241e0
Add LinkedCA integration for improved SCEP provisioner 2022-01-21 16:07:50 +01:00
Herman Slatman
c3f2fd8ef0
Add RW locks to prevent concurrent updates to the DB
Although this may slow certain API calls down and may not be, strictly
necessary, I think it's best to put all the ACME EAB operations behind
RW locks to prevent concurrent updates to the DB and guarantee
consistent result sets.
2022-01-20 17:25:15 +01:00
Herman Slatman
868cc4ad7f
Increase test coverage for additional indexes 2022-01-20 17:06:23 +01:00
Herman Slatman
8838961b68
Merge branch 'master' into hs/acme-eab 2022-01-20 11:05:28 +01:00
Herman Slatman
c0eb420806
Remove special case for empty slices 2022-01-20 11:03:49 +01:00
Ahmet DEMIR
d957a57e24
fix: apply mariano suggestions and fixes
* use json.RawMessage to remote mapstructure in options
* use vault secretid structure to support multiple source aka string, file and env
* remove log prefix
* return raw cert on error on newline for cert and csr
* clean sans, commonName in createCertificate (bad copy/paste from StepCAS)
* verify authority fingerprint
* convert serial on revoke to bigint, bytes and vault dashed representation
2022-01-20 10:16:47 +01:00
Herman Slatman
716b946e7a
Normalize IPv6 hostname addresses 2022-01-19 17:14:45 +01:00
Herman Slatman
64680bb16d
Fix PR comments 2022-01-19 11:31:33 +01:00
Carl Tashian
262375577a
Merge pull request #794 from smallstep/create-db-folder
Create the db directory on step ca init
2022-01-18 16:11:07 -08:00
Herman Slatman
3612eefc31
Cleanup 2022-01-18 15:54:18 +01:00
Herman Slatman
ff08b5055e
Fix linting issues 2022-01-18 14:42:56 +01:00
Herman Slatman
6440870a80
Clean up, improve test cases and coverage 2022-01-18 14:39:21 +01:00
Herman Slatman
1e808b61e5
Merge logic for X509 and SSH policy 2022-01-17 23:36:13 +01:00
Herman Slatman
6bc301339f
Improve test case and code coverage 2022-01-17 22:55:28 +01:00
Ahmet DEMIR
16390694e1
feat(vault): adding hashicorp vault cas 2022-01-14 18:56:17 +01:00
Herman Slatman
91d51c2b88
Add allow/deny to Nebula provisioner 2022-01-14 13:06:32 +01:00