Mariano Cano
cb72796a2d
Fix decoding of certificate.
2021-12-29 16:07:05 -08:00
Mariano Cano
32390a2964
Add initial implementation of a nebula provisioner.
...
A nebula provisioner will generate a X509 or SSH certificate with
the identities in the nebula certificate embedded in the token.
The token is signed with the private key of the nebula certificate.
2021-12-29 14:12:03 -08:00
Herman Slatman
8473164b41
Merge pull request #773 from smallstep/herman/ip-sans-improvements
...
Improve IP SANS support
2021-12-20 19:56:55 +01:00
Herman Slatman
a5f2f004e3
Change name of IP Common Name test for clarity
2021-12-20 18:55:23 +01:00
Herman Slatman
80bebda69c
Fix code style issue
2021-12-20 13:40:17 +01:00
Mariano Cano
f7c1a328ed
Merge pull request #777 from smallstep/pkcs11-decrypter
...
Implement the kms.Decrypter with PKCS#11
2021-12-17 11:10:56 -08:00
Mariano Cano
d5c6572da4
Fix typo.
2021-12-17 10:55:23 -08:00
Mariano Cano
5a32401d23
Implement the kms.Decrypter with PKCS#11
...
This interface allows the use of SCEP with PKCS#11 modules.
2021-12-16 18:30:09 -08:00
Mariano Cano
ab44fbfb3f
Merge pull request #774 from smallstep/cm-roots
...
Avoid doing unauthenticated requests on the SDK
2021-12-15 12:22:36 -08:00
Mariano Cano
2c63abcf52
fix grammar
2021-12-15 12:16:21 -08:00
Mariano Cano
7c4e6dcc96
Remove duplicated code in bootstrap methods
2021-12-15 11:24:46 -08:00
Mariano Cano
64c19d4264
Fix subject in test, use ip
2021-12-14 15:27:18 -08:00
Mariano Cano
b0b2e77b0e
Avoid doing unauthenticated requests on the SDK
...
When step-ca runs with mTLS required on some endpoints, the SDK
used in autocert will fail to start because the identity certificate
is missing. This certificate is only required to retrieve all roots,
in most cases there's only one, and the SDK has access to it.
2021-12-14 14:42:38 -08:00
Herman Slatman
bc0875bd7b
Disallow email address and URLs in the CSR
...
Before this commit `step` would allow email addresses and URLs
in the CSR. This doesn't fit nicely with the rest of ACME, in which
identifiers need to be authorized before a certificate is issued.
2021-12-13 16:14:39 +01:00
Herman Slatman
13a31fd862
Merge branch 'master' into herman/ip-sans-improvements
2021-12-13 16:04:53 +01:00
Herman Slatman
ca707cbe05
Fix linting
2021-12-13 16:01:40 +01:00
Herman Slatman
a5d33512fe
Fix test
2021-12-13 15:59:01 +01:00
Herman Slatman
a2c9b5cd7e
Allow IP identifiers in subject, including authorization enforcement
...
To support IPs in the subject using `step-cli`, this PR ensures that
Subject Common Names that can be parsed as an IP are also checked
to have been authorized before.
The PR for `step-cli` is here: github.com/smallstep/cli/pull/576.
2021-12-13 15:34:56 +01:00
Herman Slatman
fbd3fd2145
Merge pull request #625 from hslatman/hs/acme-revocation
...
ACME Certificate Revocation
2021-12-09 09:48:02 +01:00
Herman Slatman
00539d07c9
Add changelog entry for ACME revocation
2021-12-09 09:42:38 +01:00
Herman Slatman
3bc3957b06
Merge branch 'master' into hs/acme-revocation
2021-12-09 09:36:52 +01:00
Herman Slatman
0524122191
Remove authorization flow for different Account private keys
...
As discussed in https://github.com/smallstep/certificates/issues/767 ,
we opted for not including this authorization flow to prevent users
from getting OOMs. We can add the functionality back when the
underlying data store can provide access to a long list of
Authorizations more efficiently, for example when a callback is
implemented.
2021-12-08 16:28:14 +01:00
Carl Tashian
53ebd85327
Update star gif size
2021-12-07 10:17:48 -08:00
Carl Tashian
c0255b7caa
Update star gif
2021-12-07 10:07:50 -08:00
Carl Tashian
accb0710a1
Star gif
2021-12-07 10:02:44 -08:00
Mariano Cano
94afec7e1f
Merge pull request #758 from smallstep/errors-forbidden
...
Forbidden errors and more
2021-12-06 16:01:19 -08:00
Mariano Cano
e0fee84694
Add comment about public key validator.
2021-12-03 15:24:42 -08:00
Mariano Cano
0cebde3db5
Change fallback message on RekeySSH.
2021-12-03 15:12:00 -08:00
Herman Slatman
004fc054d5
Fix PR comments
2021-12-03 15:06:28 +01:00
Mariano Cano
9fd147f3da
Change error message.
2021-12-02 16:44:57 -08:00
Herman Slatman
47a8a3c463
Add test case for ACME Revoke to Authority
2021-12-02 17:11:36 +01:00
Herman Slatman
06bb97c91e
Add logic for Account authorizations and improve tests
2021-12-02 16:25:35 +01:00
Herman Slatman
bae1d256ee
Improve tests for JWK vs. KID revoke auth flow
...
The logic for both test cases is fairly similar, but with some
small differences. Made those clearer by means of some comments.
Also added some comments to the middleware logic that decided
whether to extract JWK or lookup by KID.
2021-12-02 10:59:56 +01:00
Herman Slatman
a7fbbc4748
Add tests for GetCertificateBySerial
2021-11-28 21:20:57 +01:00
Herman Slatman
4d01cf8135
Increase test code coverage
2021-11-28 20:30:36 +01:00
Herman Slatman
2d357da99b
Add tests for ACME revocation
2021-11-26 17:27:42 +01:00
Herman Slatman
ed295ca15d
Fix linting issue
2021-11-25 00:44:21 +01:00
Herman Slatman
c9cd876a7d
Merge branch 'master' into hs/acme-revocation
2021-11-25 00:40:56 +01:00
Mariano Cano
78acf35bf4
Merge pull request #753 from scattered-network/docker-compose-go-mod-updates
...
Docker Example Fix: Remove Step Build
2021-11-24 14:42:44 -08:00
Mariano Cano
d35848f7a9
Fix unit tests.
2021-11-24 11:43:24 -08:00
Mariano Cano
c3f98fd04d
Change some bad requests to forbidded.
...
Change in the sign options bad requests to forbidded if is the
provisioner the one adding a restriction, e.g. list of dns names,
validity, ...
2021-11-24 11:32:35 -08:00
JJ
cbb0f40696
Revert "Update Go Modules: Fixes Docker Example"
...
This reverts commit 11a1297bf5
2021-11-24 04:45:51 +00:00
JJ
3c5d1c9d3f
Use smallstep/small-cli as base image, remove step cli build
2021-11-24 04:44:28 +00:00
Mariano Cano
ff04873a2a
Change the default error type to forbidden in Sign.
...
The errors will also be propagated from sign options.
2021-11-23 18:58:16 -08:00
Mariano Cano
b9beab071d
Fix unit tests.
2021-11-23 18:43:36 -08:00
Mariano Cano
507a272b4d
Return always http errors in sign options.
2021-11-23 18:32:33 -08:00
Carl Tashian
d83ca96d2a
Fixes #757
2021-11-23 18:12:31 -08:00
Mariano Cano
a33709ce8d
Fix sign ssh options tests.
2021-11-23 18:06:18 -08:00
Mariano Cano
1da7ea6646
Return always http errors in sign ssh options.
2021-11-23 17:52:39 -08:00
Mariano Cano
031d4d7000
Return BadRequest when validating sign options.
2021-11-23 17:52:17 -08:00
