Mariano Cano
725a913f66
Allow custom SCEP key manager
...
This commit allows to inject a custom key manger for SCEP.
2024-04-09 18:44:29 -07:00
Mariano Cano
10f6a901ec
Let the CA determine the RA lifetime
...
When the RA mode with StepCAS is used, let the CA decide which lifetime
the RA should get instead of requiring always 24h.
This commit also fixes linter warnings.
Related to #1094
2024-03-12 14:29:55 -07:00
Herman Slatman
f082cbc421
Denormalize provisioner name in SCEP webhook
2023-11-08 20:09:52 +01:00
Herman Slatman
9ebc8779f5
Normalize SCEP provisioner name in webhook body
2023-11-08 19:52:20 +01:00
Herman Slatman
de45d66cdb
Add provisionerName to webhook request body
2023-11-08 19:43:13 +01:00
Mariano Cano
52baf52f84
Change scep password type to string
...
This commit changes the type of the decrypter key password to string to
be consistent with other passwords in the ca.json
2023-09-26 10:36:58 -07:00
Herman Slatman
4554f86f16
Make SCEP decrypter properties use omitempty
2023-09-25 19:48:12 +02:00
Herman Slatman
3f3b67e05c
Merge branch 'herman/scep-provisioner-decrypter' into herman/scep-notifying-webhook
2023-09-22 12:44:11 +02:00
Herman Slatman
ba72710e2d
Address code review remarks
2023-09-22 12:40:14 +02:00
Herman Slatman
5f8e0de1c3
Fix duplicate import in SCEP provisioner
2023-09-22 11:46:51 +02:00
Herman Slatman
3ade92f8d5
Support both a decrypter key URI as well as PEM
2023-09-22 11:10:22 +02:00
Herman Slatman
b6c95d7be2
Add additional properties to SCEP notify webhook request body
2023-09-21 18:12:13 +02:00
Herman Slatman
63257e0576
Add full certificate DER bytes to success notification webhook
2023-09-21 12:05:58 +02:00
Herman Slatman
52bc96760b
Add SCEP certificate issuance notification webhook
2023-09-21 12:01:03 +02:00
Herman Slatman
36f1dd70bf
Add CSR to SCEPCHALLENGE webhook request body
2023-09-07 14:11:53 +02:00
Herman Slatman
98d015b5c3
Fix linting issues
2023-09-04 15:36:37 +02:00
Herman Slatman
9d3b78ae49
Add excludeIntermediate to SCEP provisioner
2023-09-04 14:55:27 +02:00
Herman Slatman
645b6ffc18
Ensure no prompt is fired for loading provisioner decrypter
2023-08-04 22:50:22 +02:00
Herman Slatman
e2e9bf5494
Clarify some SCEP properties
2023-08-04 01:55:52 +02:00
Herman Slatman
c0a1837cd9
Verify full decrypter/signer configuration at usage time
...
When changing the SCEP configuration it is possible that one
or both of the decrypter configurations required are not available
or have been provided in a way that's not usable for actual SCEP
requests.
Instead of failing hard when provisioners are loaded,
which could result in the CA not starting properly, this type of
problematic configuration errors will now be handled at usage
time instead.
2023-08-03 16:09:51 +02:00
Herman Slatman
569a1be12c
Merge branch 'master' into herman/scep-provisioner-decrypter
2023-08-02 15:45:45 +02:00
Mariano Cano
c7c7decd5e
Add support for the disableSmallstepExtensions claim
...
This commit adds a new claim to exclude the Smallstep provisioner
extension from the generated certificates.
Fixes #620
2023-07-27 15:05:01 -07:00
Herman Slatman
567fc25404
Use the RSA decryption configuration for signing responses too
2023-07-27 00:55:39 +02:00
Herman Slatman
6985b4be62
Clean up the SCEP authority and provisioner
2023-06-01 14:43:32 +02:00
Herman Slatman
180162bd6a
Refactor SCEP provisioner and decrypter
2023-06-01 12:10:54 +02:00
Herman Slatman
0377fe559b
Add basic version of provisioner specific SCEP decrypter
2023-05-26 23:52:49 +02:00
max furman
8b256f0351
address linter warning for go 1.19
2023-05-09 23:47:28 -07:00
Herman Slatman
0153ff4377
Remove superfluous GetChallengePassword
2023-05-04 11:43:57 +02:00
Herman Slatman
f9ec62f46c
Merge branch 'master' into herman/improve-scep-marshaling
2023-05-04 10:47:53 +02:00
Herman Slatman
c73f157ea4
Remove unused error from challenge validation controller creator
2023-05-02 00:52:11 +02:00
Herman Slatman
e8c1e8719d
Refactor SCEP webhook validation
2023-05-01 22:09:42 +02:00
Herman Slatman
f2e1c56c6c
Improve SCEP provisioner marshaling
2022-12-13 09:33:31 +01:00
Andrew Reed
7101fbb0ee
Provisioner webhooks ( #1001 )
2022-09-29 19:16:26 -05:00
Herman Slatman
5e9bce508d
Unexport GetPolicy()
2022-05-05 12:32:53 +02:00
Herman Slatman
c40a4d2694
Contain policy engines inside provisioner Controller
2022-04-22 01:20:38 +02:00
Herman Slatman
9797b3350e
Merge branch 'master' into herman/allow-deny
2022-04-08 16:01:56 +02:00
Herman Slatman
b49307f326
Fix ACME order tests with mock ACME CA
2022-03-24 18:34:04 +01:00
Herman Slatman
dc23fd23bf
Merge branch 'master' into herman/allow-deny-next
2022-03-24 12:36:12 +01:00
Mariano Cano
b401376829
Add current provisioner to AuthorizeSign SignOptions.
...
The original provisioner cannot be retrieved from a certificate
if a linked ra is used.
2022-03-21 19:21:40 -07:00
Mariano Cano
259e95947c
Add support for the provisioner controller
...
The claimer, audiences and custom callback methods are now managed
by the provisioner controller in an uniform way.
2022-03-09 18:43:45 -08:00
Herman Slatman
7c541888ad
Refactor configuration of allow/deny on authority level
2022-03-08 13:26:07 +01:00
Herman Slatman
acd13cb92d
Merge branch 'master' of github.com:smallstep/certificates into herman/allow-deny
2022-01-31 14:43:46 +01:00
Herman Slatman
512b8d6730
Refactor instantiation of policy engines
...
Instead of using the `base` struct, the x509 and SSH policy
engines are now added to each provisioner directly.
2022-01-25 16:45:25 +01:00
Herman Slatman
64680bb16d
Fix PR comments
2022-01-19 11:31:33 +01:00
Herman Slatman
3612eefc31
Cleanup
2022-01-18 15:54:18 +01:00
Herman Slatman
9c6580ccd2
Fix macOS SCEP client issues
...
Fixes #746
2022-01-14 10:48:23 +01:00
Herman Slatman
9539729bd9
Add initial implementation of x509 and SSH allow/deny policy engine
2022-01-03 12:25:24 +01:00
max furman
77fdfc9fa3
Merge branch 'master' into max/cert-mgr-crud
2021-07-02 20:26:46 -07:00
max furman
9fdef64709
Admin level API for provisioner mgmt v1
2021-07-02 19:05:17 -07:00
Herman Slatman
a64974c179
Fix small typo in divisible
2021-05-26 16:15:26 -07:00
