Commit graph

12 commits

Author SHA1 Message Date
Herman Slatman
8c5b12e21d
Add non-TLS server and improve crypto.Decrypter interface
A server without TLS was added to serve the SCEP endpoints. According
to the RFC, SCEP has to be served via HTTP. The `sscep` client, for
example, will stop any URL that does not start with `http://` from
being used, so serving SCEP seems to be the right way to do it.

This commit adds a second server for which no TLS configuration is
configured. A distinct field in the configuration, `insecureAddress`
was added to specify the address for the insecure server.

The SCEP endpoints will also still be served via HTTPS. Some clients
may be able to work with that.

This commit also improves how the crypto.Decrypter interface is
handled for the different types of KMSes supported by step. The
apiv1.Decrypter interface was added. Currently only SoftKMS
implements this interface, providing a crypto.Decrypter required
for SCEP operations.
2021-03-12 14:18:36 +01:00
Herman Slatman
7ad90d10b3
Refactor initialization of SCEP authority 2021-02-26 00:32:21 +01:00
Mariano Cano
2ba4e37530 Add URI support to configure yubikeys. 2021-02-16 15:02:20 -08:00
Mariano Cano
4bec2b04ec Add support for retired key management slots on yubikey.
Fixes #461
2021-02-16 14:47:34 -08:00
Mariano Cano
f100b2d0e3 Make the YubiKey management key configurable.
With this change the default management key is not required as the
user is able to set its own.

Fixes #323
2020-09-17 16:07:32 -07:00
Pierre Laden
692f7692a2 fix #2 indentation 2020-09-16 22:26:53 +02:00
Pierre Laden
290d5ee979 fix gofmt complain 2020-09-16 22:15:42 +02:00
Pierre Laden
179e793f1a - provide PINpolicy always to piv-go to avoid trying to use attestation cert, which we might not have
- bump piv-go version to 1.6.0
2020-09-16 21:59:48 +02:00
Mariano Cano
012a4734bf Add better messaging when yubikey is not detected. 2020-05-15 11:33:04 -07:00
Mariano Cano
63e36ecd7a Refactor the initialization of KeyManagers. 2020-05-11 18:47:22 -07:00
Mariano Cano
677e99793e Create alternative yubikey file when cgo is not enabled.
This yubikey will always fail.
2020-05-07 18:35:10 -07:00
Mariano Cano
6868190fff Add initial support for yubikey. 2020-05-07 18:22:09 -07:00