Mariano Cano
6b3a8f22f3
Add provisioner to SSH renewals
...
This commit allows to report the provisioner to the linkedca when
a SSH certificate is renewed.
2022-05-20 14:41:44 -07:00
Mariano Cano
3c4d0412ef
Merge pull request #941 from smallstep/ssh-provisioner
...
Report SSH provisioner
2022-05-20 12:24:30 -07:00
Mariano Cano
eebbd65dd5
Fix linter error
2022-05-20 12:03:36 -07:00
Max
f8148071fb
Merge pull request #915 from smallstep/max/removing-beta
...
exposing authority configuration for provisioner cli commands
2022-05-19 22:53:59 -07:00
max furman
5443aa073a
gofmt -s
2022-05-19 22:46:25 -07:00
max furman
8ca9442fe9
Add -s to make fmt and bump golangci-lint to 1.45.2
2022-05-19 22:40:47 -07:00
Max
586e4fd3b5
Update authority/options.go
...
Co-authored-by: Mariano Cano <mariano@smallstep.com>
2022-05-19 22:26:20 -07:00
Mariano Cano
1ad75a3bdb
Skip failing test for now
...
This test fails randomly on VMs, there's an issue to fix this so
skipping it for now
2022-05-19 18:51:51 -07:00
Mariano Cano
dd985ce154
Clarify errors when sending renewed certificates
2022-05-19 18:41:13 -07:00
Mariano Cano
a627f21440
Fix AuthorizeSSHSign tests with extra SignOption
2022-05-18 18:51:36 -07:00
Mariano Cano
e7d7eb1a94
Add provisioner as a signOption for SSH
2022-05-18 18:42:42 -07:00
Mariano Cano
293586079a
Store provisioner with SignSSH
...
This change also allows to store the old certificate on renewal on
linkedca or if the db interface supports it.
2022-05-18 18:33:53 -07:00
Mariano Cano
c8d7ad7ab9
Fix store certificates methods with new interface
2022-05-18 18:33:22 -07:00
Mariano Cano
de99c3cac0
Report provisioner and parent on linkedca
2022-05-18 18:30:53 -07:00
Mariano Cano
20b2c6a201
Extract cert storer methods from AuthDB
...
To be able to extend the AuthDB with methods that also extend the
provisioner we need to either create a new method or to split the
interface. This change splits the interface so we can have a cleaner
implementation.
2022-05-18 18:27:37 -07:00
Herman Slatman
9e05cc4d51
Merge pull request #940 from smallstep/herman/improve-renew-expired-cert-error
...
Improve error message when client renews with expired certificate
2022-05-19 01:46:01 +02:00
Herman Slatman
479eda7339
Improve error message when client renews with expired certificate
...
When a client provides an expired certificate and `AllowAfterExpiry`
is not enabled, the client would get a rather generic error with
instructions to view the CA logs. Viewing the CA logs can be done
when running `step-ca`, but they can't be accessed easily in the
hosted solution.
This commit returns a slightly more informational message to the
client in this specific situation.
2022-05-19 01:25:30 +02:00
max furman
fff00aca78
Updates to issue templates
2022-05-18 15:56:40 -07:00
max furman
bfb406bf70
Fixes for PR review
2022-05-18 09:43:32 -07:00
Herman Slatman
14524d7916
Merge pull request #938 from smallstep/herman/update-crypto-0.16.2
...
Update go.step.sm/crypto to v0.16.2
2022-05-18 09:15:18 +02:00
Herman Slatman
d1ab1d5431
Merge branch 'master' into herman/update-crypto-0.16.2
2022-05-18 09:11:38 +02:00
Herman Slatman
984e4fcff8
Merge pull request #932 from smallstep/herman/pkcs7-patches
...
Use github.com/smallstep/pkcs7 fork with (selected) patches applied
2022-05-18 09:10:48 +02:00
Herman Slatman
b75ce3acbd
Update to go.step.sm/crypto v0.16.2
...
This patch release of go.step.sm/crypto fixes an issue with
not all `Subject` names being available for usage in a template
as `ExtraNames`.
2022-05-17 23:39:01 +02:00
Herman Slatman
ea084d71fb
Merge pull request #933 from smallstep/herman/allow-deny
...
Fix check for admin not belonging to provisioner that policy applies to
2022-05-12 16:42:26 +02:00
Herman Slatman
c695b23e24
Fix check for admin not belonging to policy
2022-05-12 16:33:32 +02:00
max furman
25b8d196d8
Couple changes in response to PR
...
- add skipInit option to skip authority initialization
- check admin API status when removing provisioners - no need to check
admins when not using Admin API
2022-05-11 17:04:43 -07:00
Mariano Cano
d0c0733691
Merge pull request #924 from vijayjt/vijayt/helmchart-kms
...
Allow KMS type to be specified in the helm chart values YAML
2022-05-11 14:14:25 -07:00
Herman Slatman
7030dbb7a1
Use github.com/smallstep/pkcs7 fork with patches applied
2022-05-11 21:18:47 +02:00
Herman Slatman
d51913f62a
Merge pull request #917 from smallstep/herman/scep-get
...
Add SCEP GET requests
2022-05-11 15:32:45 +02:00
Herman Slatman
688ae837a4
Add some tests for SCEP request decoding
2022-05-07 00:26:18 +02:00
Herman Slatman
c9a89d13ee
Merge branch 'master' into herman/scep-get
2022-05-06 23:49:53 +02:00
Herman Slatman
65090daac3
Merge pull request #788 from smallstep/herman/allow-deny
...
Add allow/deny policy for x509 SANs and SSH Principals
2022-05-06 19:11:34 +02:00
Herman Slatman
cc26a0b394
Explicitly disable wildcard Common Name constraint
2022-05-06 13:58:48 +02:00
Herman Slatman
0f4ffa504a
Fix linting issues
2022-05-06 13:23:09 +02:00
Herman Slatman
7104299119
Add full policy validation in API
2022-05-06 13:12:13 +02:00
Herman Slatman
ed231d29e2
Update to go.step.sm/linkedca@v0.16.1
2022-05-05 15:57:47 +02:00
Herman Slatman
105211392c
Don't rely on linkedca model stability in API response bodies
2022-05-05 14:10:52 +02:00
Herman Slatman
5e9bce508d
Unexport GetPolicy()
2022-05-05 12:32:53 +02:00
Herman Slatman
f0272dc717
Fix import replacement of linkedca
2022-05-05 11:10:21 +02:00
Herman Slatman
60d8b22d89
Change context retrievers to MustTFromContext
2022-05-05 11:05:57 +02:00
vijayjt
02c0ae81ac
Allow KMS type to be specified in the helm chart template if specified on the command line.
2022-05-05 00:10:59 +01:00
Herman Slatman
723c4c14c0
Merge branch 'master' into herman/allow-deny
2022-05-02 16:29:00 +02:00
Herman Slatman
77893ea55c
Change authority policy to use dbPolicy model
2022-05-02 15:55:26 +02:00
Herman Slatman
13173ec8a2
Fix SCEP GET requests
2022-05-01 22:29:17 +02:00
max furman
4cb74e7d8b
fix linter warnings
2022-04-30 13:08:28 -07:00
Herman Slatman
d82e51b748
Update AllowWildcardNames configuration name
2022-04-29 15:08:19 +02:00
Herman Slatman
2b7f6931f3
Change Subject Common Name verification
...
Subject Common Names can now also be configured to be allowed or
denied, similar to SANs. When a Subject Common Name is not explicitly
allowed or denied, its type will be determined and its value will be
validated according to the constraints for that type of name (i.e. URI).
2022-04-28 14:49:23 +02:00
max furman
88a1bf17cf
Update to pull request template
2022-04-27 11:40:43 -07:00
Carl Tashian
c82296b7cd
Merge pull request #910 from jschlyter/docker_hsm
...
Dockerfile for HSM-enabled Step CA
2022-04-27 09:37:43 -07:00
Herman Slatman
74a6e59b1f
Add tests for ProtoJSON and bad proto messages
2022-04-26 14:56:42 +02:00
