26 Commits (512b8d673083f0b61d1642e09575a8629629b2e3)

Author	SHA1	Message	Date
Mariano Cano	7ec1424cb6	Fix help.	3 years ago
Mariano Cano	8366b7ddf1	Revert "Remove extractable from StoreCertificate." ... This reverts commit 614ee79489.	3 years ago
Mariano Cano	614ee79489	Remove extractable from StoreCertificate.	3 years ago
Mariano Cano	aa80bf9f07	Merge branch 'smallstep_master' into extractable	3 years ago
Mariano Cano	c638c282d8	Add omitempty to KMS options.	3 years ago
Mariano Cano	2240ebbadc	Add NameValidator interface and implement it for azurekms.	3 years ago
Mariano Cano	656099c4f0	Add type for azurekms.	3 years ago
Gary Belvin	22b471acf9	Extractable certs	3 years ago
Gary Belvin	be89459524	Set key export bit	3 years ago
Herman Slatman	583d60dc0d	Address (most) PR comments	3 years ago
Herman Slatman	8c5b12e21d	Add non-TLS server and improve crypto.Decrypter interface ... A server without TLS was added to serve the SCEP endpoints. According to the RFC, SCEP has to be served via HTTP. The `sscep` client, for example, will stop any URL that does not start with `http://` from being used, so serving SCEP seems to be the right way to do it. This commit adds a second server for which no TLS configuration is configured. A distinct field in the configuration, `insecureAddress` was added to specify the address for the insecure server. The SCEP endpoints will also still be served via HTTPS. Some clients may be able to work with that. This commit also improves how the crypto.Decrypter interface is handled for the different types of KMSes supported by step. The apiv1.Decrypter interface was added. Currently only SoftKMS implements this interface, providing a crypto.Decrypter required for SCEP operations.	3 years ago
Herman Slatman	7ad90d10b3	Refactor initialization of SCEP authority	3 years ago
Mariano Cano	a8260a3289	Add missing test.	3 years ago
Mariano Cano	d9da150a5f	Fix test.	3 years ago
Mariano Cano	294f84b8d4	Add initial set of unit tests for pkcs11 kms.	3 years ago
Mariano Cano	8dca652bc7	Add support for PKCS #11 KMS. ... The implementation works with YubiHSM2. Unit tests are still pending. Fixes #301	3 years ago
Anton Lundin	3e6137110b	Add support for using ssh-agent as a KMS ... This adds a new KMS, SSHAgentKMS, which is a KMS to provide signing keys for issuing ssh certificates signed by a key managed by a ssh-agent. It uses the golang.org/x/crypto package to get a native Go implementation to talk to a ssh-agent. This was primarly written to be able to use gpg-agent to provide the keys stored in a YubiKeys openpgp interface, but can be used for other setups like proxying a ssh-agent over network. That way the signing key for ssh certificates can be kept in a "sign-only" hsm. This code was written for my employer Intinor AB, but for simplicity sake gifted to me to contribute upstream. Signed-off-by: Anton Lundin <glance@acc.umu.se>	4 years ago
Mariano Cano	f100b2d0e3	Make the YubiKey management key configurable. ... With this change the default management key is not required as the user is able to set its own. Fixes #323	4 years ago
Mariano Cano	82fb96588e	Fix unit tests.	4 years ago
Mariano Cano	c32abb76cd	Add initial implementation to support AWS KMS.	4 years ago
Mariano Cano	63e36ecd7a	Refactor the initialization of KeyManagers.	4 years ago
Mariano Cano	6868190fff	Add initial support for yubikey.	4 years ago
Mariano Cano	264179cda3	Add tests for kms and kms/apiv1 packages.	5 years ago
Mariano Cano	927a3b3a86	Return crypto.PublicKey on kms.GetPublicKey.	5 years ago
Mariano Cano	3f8de17a40	Cleanup types and add initial support for the options required for PKCS11.	5 years ago
Mariano Cano	d13754166a	Add support for cloudkms and softkms.	5 years ago