alexvanin/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity
1078 commits 34 branches 199 tags 41 MiB
Commit graph

1078 commits

This branch
This branch
All branches
Author SHA1 Message Date
David Cowden
a857c45847 acme/authority: Polymorph the challenge type 
Prior to validation, we must wrap the base challenge in the correct
concrete challenge type so that we dispatch the correct validation
method.
 2020-05-11 21:23:55 -07:00
David Cowden
2d0a00c4e1 acme/api: Add missing return 
Stop execution when the error happens. This was previously a typo.
 2020-05-11 21:22:40 -07:00
David Cowden
8326632f5b vscode: Ignore vscode binaries 
It might make sense to check in the vscode workspace file if we can make
everything relative to the project directory.
 2020-05-11 18:47:07 -07:00
David Cowden
9518ba44b1 provisioner/acme: Add TODO for retry restarts 
The comment in acme/authority directs users to this file so put a TODO
in for posterity.
 2020-05-11 18:46:15 -07:00
David Cowden
bdadea8a37 acme: go fmt 2020-05-07 09:27:16 -07:00
David Cowden
9af4dd3692 acme: Retry challenge validation attempts 
Section 8.2 of RFC 8555 explains how retries apply to the validation
process. However, much is left up to the implementer.

Add retries every 12 seconds for 2 minutes after a client requests a
validation. The challenge status remains "processing" indefinitely until
a distinct conclusion is reached. This allows a client to continually
re-request a validation by sending a post-get to the challenge resource
until the process fails or succeeds.

Challenges in the processing state include information about why a
validation did not complete in the error field. The server also includes
a Retry-After header to help clients and servers coordinate.

Retries are inherently stateful because they're part of the public API.
When running step-ca in a highly available setup with replicas, care
must be taken to maintain a persistent identifier for each instance
"slot". In kubernetes, this implies a *stateful set*.
 2020-05-06 07:39:13 -07:00
David Cowden
5e6a020da5 acme/authority: Add space around * 
Makes the line more readable.
 2020-04-30 04:44:36 -07:00
David Cowden
f56c449ea4 handler_test: Add BackoffChallenge 
The mock acme authority needs to in order to conform to the updated acme
authority interface.
 2020-04-30 04:44:08 -07:00
David Cowden
8fb558da10 handler_test: Remove unused field "Backoffs" 2020-04-30 04:44:08 -07:00
Wesley Graham
8d4356733e Implement standard backoff strategy 2020-04-30 04:44:08 -07:00
Wesley Graham
f9779d0bed Polish retry conditions 2020-04-30 04:44:08 -07:00
Wesley Graham
66b2c4b1a4 Add automated challenge retries, RFC 8555 2020-04-30 04:44:08 -07:00
Wesley Graham
40d7c42e33 Implement acme RFC 8555, challenge retries 2020-04-30 04:44:08 -07:00
David Cowden
6fdbd856f7 git: Ignore *.code-workspace 
These are visual studio code's workspace configuration files.
 2020-04-30 04:44:08 -07:00
max furman
d40c029582 Fix docs database link. 2020-04-28 10:42:05 -07:00
max furman
30e38dc501 Bumpt the version of cli for a certificates RC. 2020-04-28 09:34:10 -07:00
Mariano Cano
df3b9f637e Use a tagged version of nosql. 2020-04-27 18:13:54 -07:00
Mariano Cano
18869323f4
Merge pull request #234 from smallstep/oidc-multinenant 
Add support for multi-tenant OIDC provisioners
 2020-04-27 15:21:55 -07:00
Mariano Cano
4e9bff0986 Add support for OIDC multitoken tenants for azure. 2020-04-24 14:36:32 -07:00
Mariano Cano
c7907a4626
Merge pull request #233 from smallstep/oidc-add-user-cert 
Add support for user provisioner certificates on OIDC provisioners.
 2020-04-24 10:54:25 -07:00
Mariano Cano
8bc3b05232 Add new extra test case. 2020-04-24 10:27:44 -07:00
Mariano Cano
b0ff731d18 Add support for user provisioner certificates on OIDC provisioners. 
OIDC provisioners create an SSH certificate with two principals. This
was avoiding the creationg of user provisioner certificates for those
provisioners.

Fixes smallstep/cli#268
 2020-04-23 19:42:55 -07:00
Max
59a57d487b
Merge pull request #232 from wishdev/fingerprint 
Add root fingerprint to pki if certificate given
 2020-04-23 14:49:06 -07:00
John W Higgins
d1f78cf6d2 Add root fingerprint to pki if certificate given 
If a root certificate is provided to init an authority the fingerprint
is not currently stored in the default.json file. This patch simply
stores the fingerprint of the supplied certificate.
 2020-04-23 13:47:41 -07:00
Max
00998d053d
Merge pull request #231 from smallstep/badgerV1+V2 
Simultaneous support for Badger V1+V2 and ...
 2020-04-21 10:16:22 -07:00
max furman
95b931bb52 Increase linter timeout limit ... 
* Breaking in Travis
 2020-04-21 10:10:33 -07:00
max furman
1a34e64c65 Try old method of installing golang linter ... 
* Method from docs is broken in travis.
 2020-04-21 09:59:54 -07:00
max furman
a179a72342 Update installer location of golangci-lint. 2020-04-21 09:39:48 -07:00
max furman
3c0970c28a Bump golangci-lint to v1.24.0 2020-04-21 09:35:57 -07:00
max furman
3be95a82d0 Update version of nosql. 2020-04-21 09:27:42 -07:00
Mariano Cano
7861069018 Fix command in distribution.md. 2020-04-20 17:42:29 -07:00
max furman
d51f254ee4 ValueLogLoadingMode -> FileLoading Mode badger 2020-04-20 16:09:07 -07:00
Mariano Cano
2993ccf16d
Merge pull request #230 from smallstep/empty-common-names 
Remove the requirement for CSR to have a common name
 2020-04-20 15:53:14 -07:00
Mariano Cano
a2dfa6faa8 Fix unit tests. 2020-04-20 12:29:23 -07:00
max furman
0573c00bd3 Simultaneous support for Badger V1+V2 and ... 
* valueLogLoadingMode config for low RAM badger environments
 2020-04-20 11:46:47 -07:00
Mariano Cano
13507efb35 Remove the requirement for CSR to have a common name. 
Fixes #226
 2020-04-20 10:43:33 -07:00
Mariano Cano
bcc5a91d17
Merge pull request #227 from smallstep/disable-forward-agent 
Do not enable by default ForwardAgent
 2020-04-15 17:27:18 -07:00
Mariano Cano
02ed784a9b Do not enable by default ForwardAgent. 2020-04-15 11:17:24 -07:00
max furman
348cf9b4e6 Small helm-chart distribuion update 2020-04-10 09:24:17 -07:00
max furman
fc50523779 go mod tidy 2020-04-09 20:57:04 -07:00
max furman
9679299a89 Fix version and travis_tag vars in build pipeline 2020-04-09 20:46:01 -07:00
max furman
4b8e2f5948 Tag v0.14.2 2020-04-09 18:14:24 -07:00
max furman
e03ce33cd9 go mod tidy and verify 2020-04-09 11:21:03 -07:00
max furman
17097eb9f0 Bump cli to v0.14.1 to break dependency cycle. 2020-04-09 11:04:28 -07:00
max furman
344e7b99fb bump cli dependency 2020-04-09 09:34:20 -07:00
max furman
aecddecf22 Simplify make bundling and generate ARM tarballs. 2020-04-08 14:20:58 -07:00
David Cowden
eb42ea90db ssh/api: Use host tags instead of groups 
Tags are more flexible and what we use in the managed offering.
 2020-04-03 12:11:19 -07:00
Mariano Cano
1d9edcd48f
Merge pull request #220 from smallstep/identity-cert-duration 
Enforce a duration for identity certificates
 2020-03-31 13:02:23 -07:00
Mariano Cano
bfe1f4952d Rename interface to CertificateEnforcer and add tests. 2020-03-31 11:41:36 -07:00
Mariano Cano
64f26c0f40 Enforce a duration for identity certificates. 2020-03-30 17:33:04 -07:00