alexvanin/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity
2913 commits 34 branches 199 tags 41 MiB
Commit graph

129 commits

Author SHA1 Message Date
Herman Slatman
583d60dc0d
Address (most) PR comments 2021-03-21 16:42:41 +01:00
Herman Slatman
8c5b12e21d
Add non-TLS server and improve crypto.Decrypter interface 
A server without TLS was added to serve the SCEP endpoints. According
to the RFC, SCEP has to be served via HTTP. The `sscep` client, for
example, will stop any URL that does not start with `http://` from
being used, so serving SCEP seems to be the right way to do it.

This commit adds a second server for which no TLS configuration is
configured. A distinct field in the configuration, `insecureAddress`
was added to specify the address for the insecure server.

The SCEP endpoints will also still be served via HTTPS. Some clients
may be able to work with that.

This commit also improves how the crypto.Decrypter interface is
handled for the different types of KMSes supported by step. The
apiv1.Decrypter interface was added. Currently only SoftKMS
implements this interface, providing a crypto.Decrypter required
for SCEP operations.
 2021-03-12 14:18:36 +01:00
Herman Slatman
7948f65ac0
Merge branch 'master' into hs/scep 2021-02-26 00:41:33 +01:00
Herman Slatman
7ad90d10b3
Refactor initialization of SCEP authority 2021-02-26 00:32:21 +01:00
Max
8ead310d24
Merge pull request #485 from smallstep/max/actions 
Convert to github actions
 2021-02-22 22:23:48 -08:00
Mariano Cano
163eb7029c Refactor cloudkms signer to return an error on the constructor. 2021-02-19 15:36:55 -08:00
Mariano Cano
cae08bff80 Validate that the signer can get the public key. 2021-02-19 11:28:35 -08:00
max furman
f88f58440f add //nolint for new 1.16 deprecation warnings 
- dsa
- pem.DecryptPEMBlock
 2021-02-18 20:14:20 -08:00
Mariano Cano
2ba4e37530 Add URI support to configure yubikeys. 2021-02-16 15:02:20 -08:00
Mariano Cano
4c562160fc Fix typo. 2021-02-16 14:52:55 -08:00
Mariano Cano
4bec2b04ec Add support for retired key management slots on yubikey. 
Fixes #461
 2021-02-16 14:47:34 -08:00
Mariano Cano
a947779795 Add uri support initializing cloudkms. 2021-02-16 13:11:47 -08:00
Mariano Cano
4902e45729 Add URI support initializing an awskms. 2021-02-16 13:10:53 -08:00
Mariano Cano
1ddddb6bc7 Permit linting and testing without CGO support. 
Use CGO for testing and building in travis.
Fixes #471
 2021-02-12 13:18:30 -08:00
Mariano Cano
d03c088ab7 Add test cases for uris with only the schema. 2021-02-11 19:14:35 -08:00
Mariano Cano
f6cbd9dc88 Fix typos. 2021-02-11 19:14:15 -08:00
Mariano Cano
ebaeae9008 Avoid closing pkcs#11 context twice. 2021-02-08 19:16:57 -08:00
Mariano Cano
f425a81d36 Enforce the use of id and label when generating objects. 2021-02-04 12:53:08 -08:00
Mariano Cano
dd6a43ad13 Add fake implementation of pkcs11 key manager without cgo. 
This allows other binaries to import pkcs11 directly even if they
are compiled without cgo.
 2021-02-04 12:32:30 -08:00
Mariano Cano
3fdab93ab8 Add missing file. 2021-02-01 15:27:53 -08:00
Mariano Cano
a8260a3289 Add missing test. 2021-02-01 14:25:49 -08:00
Mariano Cano
41eff69fb3 Fix linting errors. 2021-02-01 14:22:53 -08:00
Mariano Cano
128d07f148 Use new GetEncoded method. 2021-02-01 14:17:39 -08:00
Mariano Cano
b28db61d5d Add missing close causing panic with softhsm2. 2021-02-01 14:16:55 -08:00
Mariano Cano
a74fc7a0b2 Remove unnecessary methods and add missing tests. 2021-02-01 14:16:08 -08:00
Mariano Cano
50e9018a44 Fix missing return. 2021-01-28 19:53:25 -08:00
Mariano Cano
84a3c8c984 Rename nitrokey initialization to opensc. 2021-01-28 19:51:17 -08:00
Mariano Cano
b7afc92758 Complete tests. 2021-01-28 19:48:08 -08:00
Mariano Cano
3a479cb0e8 Add support for nitrokey. 2021-01-28 19:47:44 -08:00
Mariano Cano
e78d45a060 Add benchmarks for signing operations. 2021-01-28 19:46:48 -08:00
Mariano Cano
673675fa89 Convert pkcs11 tests to use tags. 2021-01-28 14:43:22 -08:00
Mariano Cano
6c113542c8 Fix ecdsa signature verification test. 2021-01-28 11:38:21 -08:00
Mariano Cano
35bf9b787e Implement ecdsa.VerifyASN1 to be compatible with go < 1.15 2021-01-27 20:35:42 -08:00
Mariano Cano
d9da150a5f Fix test. 2021-01-27 20:23:45 -08:00
Mariano Cano
294f84b8d4 Add initial set of unit tests for pkcs11 kms. 2021-01-27 20:17:14 -08:00
Mariano Cano
a6c784d5dd Add missing pkcs11 package. 2021-01-26 20:15:57 -08:00
Mariano Cano
8dca652bc7 Add support for PKCS #11 KMS. 
The implementation works with YubiHSM2. Unit tests are still pending.

Fixes #301
 2021-01-26 20:03:53 -08:00
Mariano Cano
ccc403cf89 Fix comments, and return an error instead of fatal. 2020-11-18 17:50:21 -08:00
Anton Lundin
3e6137110b Add support for using ssh-agent as a KMS 
This adds a new KMS, SSHAgentKMS, which is a KMS to provide signing keys
for issuing ssh certificates signed by a key managed by a ssh-agent. It
uses the golang.org/x/crypto package to get a native Go implementation
to talk to a ssh-agent.

This was primarly written to be able to use gpg-agent to provide the
keys stored in a YubiKeys openpgp interface, but can be used for other
setups like proxying a ssh-agent over network.

That way the signing key for ssh certificates can be kept in a
"sign-only" hsm.

This code was written for my employer Intinor AB, but for simplicity
sake gifted to me to contribute upstream.

Signed-off-by: Anton Lundin <glance@acc.umu.se>
 2020-11-04 09:06:23 +01:00
Mariano Cano
40d0596b71 Use smallstep/cli-utils instead of smallstep/cli 2020-10-29 13:10:03 -07:00
Mariano Cano
f100b2d0e3 Make the YubiKey management key configurable. 
With this change the default management key is not required as the
user is able to set its own.

Fixes #323
 2020-09-17 16:07:32 -07:00
Pierre Laden
692f7692a2 fix #2 indentation 2020-09-16 22:26:53 +02:00
Pierre Laden
290d5ee979 fix gofmt complain 2020-09-16 22:15:42 +02:00
Pierre Laden
179e793f1a - provide PINpolicy always to piv-go to avoid trying to use attestation cert, which we might not have 
- bump piv-go version to 1.6.0
 2020-09-16 21:59:48 +02:00
Mariano Cano
d30a95236d Use always go.step.sm/crypto 2020-08-14 15:33:50 -07:00
Mariano Cano
ddb4ca7a74 Move load of kms to main package. 
With this change packages that import the authority won't load by
default all the supported kms with all its dependencies.

Fixes #228
 2020-06-12 14:55:35 -07:00
Mariano Cano
6c9cd7050c Add test with query strings. 2020-05-26 11:13:07 -07:00
Mariano Cano
dfe8e11e44 Remove anchor from link. 2020-05-26 10:55:26 -07:00
Mariano Cano
7104588fcb Fix linter error. 2020-05-20 17:58:37 -07:00
Mariano Cano
aaf71ce66a Add unit tests for awskms. 2020-05-20 17:04:01 -07:00
Mariano Cano
d4cb9f4ac7 Define an interface for kms operations. 
This interface will be used for unit testing.
 2020-05-20 12:43:14 -07:00
Mariano Cano
82fb96588e Fix unit tests. 2020-05-19 17:45:15 -07:00
Mariano Cano
c32abb76cd Add initial implementation to support AWS KMS. 2020-05-19 17:35:36 -07:00
Mariano Cano
b0f768a3fb Add implementation of URIs for KMS. 
Implementation is based on the PKCS #11 URI Scheme RFC
https://tools.ietf.org/html/rfc7512
 2020-05-19 17:32:52 -07:00
Mariano Cano
012a4734bf Add better messaging when yubikey is not detected. 2020-05-15 11:33:04 -07:00
Mariano Cano
7d61c0003c Enable softkms and cloudkms. 2020-05-15 11:32:12 -07:00
Mariano Cano
63e36ecd7a Refactor the initialization of KeyManagers. 2020-05-11 18:47:22 -07:00
Mariano Cano
029483463b Remove extra +build statement. 2020-05-07 18:51:41 -07:00
Mariano Cano
677e99793e Create alternative yubikey file when cgo is not enabled. 
This yubikey will always fail.
 2020-05-07 18:35:10 -07:00
Mariano Cano
6868190fff Add initial support for yubikey. 2020-05-07 18:22:09 -07:00
Mariano Cano
1138cc4207 Retry CloudKMS GetPublicKey. 
On HSM keys are not generated instantly and the GetPublicKey fails
with a FailedPrecondition error. This change will retry GetPublicKey
if this happens.
 2020-02-21 12:36:29 -08:00
Mariano Cano
5c8c741fab Fix linting issues. 2020-02-14 11:46:31 -08:00
Mariano Cano
dd5a96a42e Fix typo. 2020-02-14 10:42:50 -08:00
Mariano Cano
b724f5a338 Fix typos. 2020-02-14 10:24:56 -08:00
Mariano Cano
6987a46b76 Skip test on travis. 2020-02-13 18:38:00 -08:00
Mariano Cano
b11bbd5728 Fix typo. 2020-02-13 18:34:43 -08:00
Mariano Cano
cff346e7fd Skip test on travis, it won't fail because they have access to the KMS. 2020-02-13 15:49:16 -08:00
Mariano Cano
fa8116497c Make Signer public and add contructor NewCloudKMS. 2020-01-21 19:09:21 -08:00
Mariano Cano
5d5ee68d88 Make GCP client public to facilitate extensibility. 2020-01-21 12:50:21 -08:00
Mariano Cano
dff498f17f Add tests for cloudkms. 2020-01-15 19:32:26 -08:00
Mariano Cano
264179cda3 Add tests for kms and kms/apiv1 packages. 2020-01-15 17:56:50 -08:00
Mariano Cano
c250c6ad91 Add unit tests for softkms. 2020-01-15 17:30:17 -08:00
Mariano Cano
a773977a81 Fix interface change. 2020-01-15 17:29:34 -08:00
Mariano Cano
927a3b3a86 Return crypto.PublicKey on kms.GetPublicKey. 2020-01-15 17:27:21 -08:00
Mariano Cano
a9c2db8f98 Add close method and fix types in softkms. 2020-01-14 18:46:18 -08:00
Mariano Cano
a3128a26bb Add Close method to the key manager interface. 2020-01-14 18:46:01 -08:00
Mariano Cano
e60beeb7fc Make cloudkms more robust. 
* Automatically create key rings if needed.
* User CryptoKeyVersions if needed.
* Add support to close the client.
* Add new pareters to CreateKey responses to make things easier.
 2020-01-14 18:43:39 -08:00
Mariano Cano
3f8de17a40 Cleanup types and add initial support for the options required for PKCS11. 2020-01-14 18:42:14 -08:00
Mariano Cano
d13754166a Add support for cloudkms and softkms. 2020-01-09 18:41:13 -08:00