Commit Graph

198 Commits

Author SHA1 Message Date
Herman Slatman
113a6dd8ab
Remove reporting the CA mode from startup logs 2024-04-20 00:19:26 +02:00
Herman Slatman
6bc0a86207
Fix CA startup with Vault RA configuration 2024-04-18 16:12:30 +02:00
Herman Slatman
f1a2c68f43
Merge pull request #1798 from smallstep/herman/fix-instrumented-key-manager
Add support for `kmsapi.Decrypter` to instrumented key manager
2024-04-15 15:32:56 +02:00
Herman Slatman
d6bbe5b06b
Add support for kmsapi.Decrypter to instrumented key manager 2024-04-10 16:38:31 +02:00
Mariano Cano
725a913f66
Allow custom SCEP key manager
This commit allows to inject a custom key manger for SCEP.
2024-04-09 18:44:29 -07:00
Panagiotis Siatras
dd1ff9c15b
Implementation of the Prometheus endpoint (#1669)
Implementation of the http://{metricsAddress}/metrics Prometheus endpoint.
2024-01-25 23:47:27 -08:00
Max
d34f0f6a97
Fix linter warnings (#1634) 2023-11-28 20:58:58 -08:00
Herman Slatman
c0fbace882
Address review remarks 2023-09-26 00:00:08 +02:00
Herman Slatman
4dc5a688fd
Set SCEP authority options once 2023-09-25 22:24:13 +02:00
Herman Slatman
15c46ebbaa
Switch logic for SCEP initialization around 2023-09-25 22:00:30 +02:00
Herman Slatman
f1da256ca4
Change SCEP authority initialization 2023-09-25 21:55:19 +02:00
Herman Slatman
e2e9bf5494
Clarify some SCEP properties 2023-08-04 01:55:52 +02:00
Herman Slatman
fc1fb51854
Improve SCEP authority initialization and reload 2023-08-02 18:35:38 +02:00
Herman Slatman
557672bb4b
Add some notes for SCEP provisioners 2023-07-26 19:11:51 +02:00
Herman Slatman
b2bf2c330b
Simplify SCEP provisioner context handling 2023-06-01 16:22:00 +02:00
Herman Slatman
8fc3a46387
Refactor the SCEP authority initialization
Instead of relying on an intermediate `scep.Service` struct,
initialize the `scep.Authority` directly. This removes one redundant
layer of indirection.
2023-06-01 15:50:51 +02:00
Herman Slatman
6985b4be62
Clean up the SCEP authority and provisioner 2023-06-01 14:43:32 +02:00
Herman Slatman
180162bd6a
Refactor SCEP provisioner and decrypter 2023-06-01 12:10:54 +02:00
Herman Slatman
0377fe559b
Add basic version of provisioner specific SCEP decrypter 2023-05-26 23:52:49 +02:00
Herman Slatman
4bb88adf63
Move SCEP checks after reload of provisioners in CA initialization 2023-05-01 23:59:48 +02:00
Mariano Cano
ddd5057f63
Allow root and federated root bundles
This commit changes the parsing of root and federated roots to support
a bundle of certificates, this makes easier to configure a root rotation
when using helm charts, just appending the old root.
2022-11-08 17:06:22 -08:00
Mariano Cano
812fee7630
Start crl generator before setting initOnce 2022-10-27 11:38:30 -07:00
Mariano Cano
59775fff0c
Merge branch 'master' into crl-support 2022-10-27 10:13:19 -07:00
Mariano Cano
8200d19894
Improve CRL implementation
This commit adds some changes to PR #731, some of them are:
- Add distribution point to the CRL
- Properly stop the goroutine that generates the CRLs
- CRL config validation
- Remove expired certificates from the CRL
- Require enable set to true to generate a CRL

This last point is the principal change in behaviour from the previous
implementation. The CRL will not be generated if it's not enabled, and
if it is enabled it will always be regenerated at some point, not only
if there is a revocation.
2022-10-26 18:55:24 -07:00
Herman Slatman
9d04e7d1dc
Remove period in log output 2022-10-24 15:33:48 +02:00
Herman Slatman
fd38dd34f9
Fix PR comments 2022-10-24 14:51:27 +02:00
Herman Slatman
49718f1bbb
Fix some comments 2022-10-21 11:48:59 +02:00
Herman Slatman
d981b9e0dc
Add --admin-subject flag to ca init
The first super admin subject can now be provided through the
`--admin-subject` flag when initializing a CA.

It's not yet possible to configure the subject of the first
super admin when provisioners are migrated from `ca.json` to the
database. This effectively limits usage of the flag to scenarios
in which the provisioners are written to the database immediately,
so when `--remote-management` is enabled. It currently also doesn't
work with Helm deployments, because there's no mechanism yet to
pass this type of option to the Helm chart.

This commit partially addresses https://github.com/smallstep/cli/issues/697
2022-10-14 16:03:41 +02:00
Herman Slatman
674206320c
Write updated CA configuration after migrating provisioners 2022-10-11 14:12:06 +02:00
Herman Slatman
c9ee4a9f9d
Disable initialization log output if started with --quiet 2022-10-11 12:19:48 +02:00
Raal Goff
f7df865687 refactor crl config, add some tests 2022-10-07 10:30:00 +08:00
Herman Slatman
cebb7d7ef0
Add automatic migration of provisioners
Provisioners stored in the CA configuration file are
automatically migrated to the database.

Currently no cleanup of the provisioners in the
configuration file yet. In certain situations this
may not work as expected, for example if the CA can't
write to the file. But it's probalby good to try it, so
that we can keep the configuration state of the CA consistent.
2022-10-06 17:14:02 +02:00
Raal Goff
d0e81af524 Merge branch 'master' into crl-support 2022-09-30 08:45:48 +08:00
Andrew Reed
7101fbb0ee
Provisioner webhooks (#1001) 2022-09-29 19:16:26 -05:00
Mariano Cano
965d59c0a8 Fix comment typos and extra white spaces 2022-09-23 10:50:44 -07:00
Mariano Cano
23045e1812 Clarify comments by code review 2022-09-22 11:05:06 -07:00
Mariano Cano
325d8bca4f Merge branch 'master' into name-constraints 2022-09-21 13:29:44 -07:00
Mariano Cano
debe565e42 Validate constraints on Sign and Renew/Rekey
Fixes #1060
2022-09-20 18:52:47 -07:00
max furman
ab0d2503ae
Standardize linting file and fix or ignore lots of linting errors 2022-09-20 16:35:41 -07:00
Mariano Cano
2a15e3eee1 Rename constraint.Service to constraint.Engine 2022-09-20 11:38:32 -07:00
Raal Goff
40baf73dff remove incorrect check on revoked certificate dates, add mutex lock for generating CRLs, 2022-09-15 15:03:42 +08:00
Mariano Cano
4a4f7ca9ba Fix panic if cacheDuration is not set 2022-09-14 11:16:47 -07:00
Raal Goff
924082bb49 fix linter errors 2022-09-08 10:09:37 +08:00
Raal Goff
d2483f3a70 Merge branch 'master' into crl-support
# Conflicts:
#	authority/config/config.go
2022-09-08 09:45:04 +08:00
Mariano Cano
0c7467ceb2 Allow to automatically configure and linked RA 2022-08-16 14:39:02 -07:00
Mariano Cano
369b8f81c3 Use go.step.sm/crypto/kms
Fixes #975
2022-08-08 17:58:18 -07:00
Mariano Cano
9408d0f24b Send RA provisioner information to the CA 2022-08-02 19:28:49 -07:00
Raal Goff
60671b07d7 Merge branch 'master' into crl-support
# Conflicts:
#	api/api.go
#	authority/config/config.go
#	cas/softcas/softcas.go
#	db/db.go
2022-07-13 08:52:58 +08:00
Mariano Cano
94f5b92513 Use proper context in authority package 2022-05-23 15:31:43 -07:00
Mariano Cano
26dd97e718 Merge branch 'master' into context-authority 2022-05-23 12:36:16 -07:00