forked from TrueCloudLab/certificates
add reload documentation
This commit is contained in:
parent
40d7959c6d
commit
5467536ad2
1 changed files with 31 additions and 3 deletions
34
README.md
34
README.md
|
@ -28,10 +28,10 @@ your local machine.
|
||||||
|
|
||||||
### Mac OS
|
### Mac OS
|
||||||
|
|
||||||
Install `step-ca` via [Homebrew](https://brew.sh/):
|
Install `step` via [Homebrew](https://brew.sh/):
|
||||||
|
|
||||||
```
|
```
|
||||||
brew install smallstep/smallstep/step-ca
|
brew install smallstep/smallstep/step
|
||||||
```
|
```
|
||||||
|
|
||||||
### Linux
|
### Linux
|
||||||
|
@ -231,9 +231,37 @@ $ step ca certificate "foo.example.com" foo.crt foo.key --token "$TOKEN" \
|
||||||
You can take a closer look at the contents of the certificate using `step certificate inspect`:
|
You can take a closer look at the contents of the certificate using `step certificate inspect`:
|
||||||
|
|
||||||
```
|
```
|
||||||
step certificate inspect foo.crt
|
$ step certificate inspect foo.crt
|
||||||
```
|
```
|
||||||
|
|
||||||
|
## Reload
|
||||||
|
|
||||||
|
It is important that the CA be able to handle configuration changes with no downtime.
|
||||||
|
Our CA has a built in `reload` feature allowing it to:
|
||||||
|
|
||||||
|
1. Finish processing existing connections while blocking new ones.
|
||||||
|
2. Re-read the configuration file and initialize the API.
|
||||||
|
3. Begin accepting blocked and new connections.
|
||||||
|
|
||||||
|
The `reload` feature is triggered by sending a SIGHUP to the PID of the
|
||||||
|
Step CA process. A few important details to note when using `reload`:
|
||||||
|
|
||||||
|
* The location of the modified configuration must be in the same location as it
|
||||||
|
was in the original invocation of the `step-ca`. So, if the original command was
|
||||||
|
|
||||||
|
```
|
||||||
|
$ step-ca ./.step/config/ca.json
|
||||||
|
```
|
||||||
|
|
||||||
|
then, upon reload, the Step CA will read it's new configuration from the same
|
||||||
|
configuration file.
|
||||||
|
|
||||||
|
* Step CA requires the password to decrypt the intermediate certificate again
|
||||||
|
upon `reload`. You can auotmate this in one of two ways:
|
||||||
|
|
||||||
|
* Use the `--password-file` flag in the original invocation.
|
||||||
|
* Use the toplevel `password` attribute in the `ca.json` configuration file.
|
||||||
|
|
||||||
## Versioning
|
## Versioning
|
||||||
|
|
||||||
We use [SemVer](http://semver.org/) for versioning. For the versions available,
|
We use [SemVer](http://semver.org/) for versioning. For the versions available,
|
||||||
|
|
Loading…
Add table
Reference in a new issue