Archives/smallstep-certificates
2
0
Fork 0
mirror of https://github.com/smallstep/certificates.git synced 2024-10-31 03:20:16 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,280 Commits 37 Branches 223 Tags 44 MiB
e0215e7243
Commit Graph

305 Commits

Author SHA1 Message Date
Herman Slatman
ad2de16299
Merge branch 'master' into herman/allow-deny 2022-04-19 10:26:31 +02:00
Herman Slatman
7f9034d22a
Add additional policy options 2022-04-19 10:24:52 +02:00
Mariano Cano
fe9c3cf753
Merge branch 'master' into ahmet2mir-feat/vault 2022-04-18 15:35:26 -07:00
Herman Slatman
d6be9450be
Merge branch 'master' into herman/allow-deny 2022-04-15 11:57:05 +02:00
Mariano Cano
674dc3c844 Rename unreleased claim to allowRenewalAfterExpiry for consistency. 2022-04-13 15:11:54 -07:00
Mariano Cano
26e40068c8 Remove unnecessary dependencies. 2022-04-11 18:49:14 -07:00
Mariano Cano
37b521ec6c
Merge branch 'master' into feat/vault 2022-04-11 14:57:45 -07:00
Mariano Cano
d4013f0df6 Update linkedca 2022-04-07 18:19:56 -07:00
Herman Slatman
7df52dbb76
Add ACME EAB policy 2022-04-07 14:11:53 +02:00
Herman Slatman
235a2c9d04
Pin to specific version of go.step.sm/linkedca 2022-03-31 16:40:49 +02:00
Herman Slatman
5daa9fc0b1
Merge branch 'master' into herman/allow-deny 2022-03-31 16:13:50 +02:00
Mariano Cano
f5bf46b950 Upgrade go.step.sm/crypto 2022-03-30 18:24:17 -07:00
Herman Slatman
2fbdf7d5b0
Merge branch 'master' into herman/allow-deny 2022-03-30 14:50:14 +02:00
Herman Slatman
1dbaa62740
Update cloud.google.com/go/kms 2022-03-27 21:40:01 +02:00
Herman Slatman
dc23fd23bf
Merge branch 'master' into herman/allow-deny-next 2022-03-24 12:36:12 +01:00
Herman Slatman
81b0c6c37c
Add API implementation for authority and provisioner policy 2022-03-15 15:56:04 +01:00
Mariano Cano
c903f00cd4 Rename claim to allowRenewAfterExpiry. 2022-03-14 15:40:01 -07:00
Mariano Cano
616490a9c6 Refactor renew after expiry token authorization 
This changes adds a new authority method that authorizes the
renew after expiry tokens.
 2022-03-10 20:21:01 -08:00
Mariano Cano
3fb5e57f12 Upgrade nosql package 
The new version of the package allows filtering out database drivers
using Go tags.
 2022-03-04 10:56:09 -08:00
Mariano Cano
6f46cdb432
Merge pull request #829 from vijayjt/new-azure-token-authz-options 
Add subscription and object ID validation options to Azure provisioner
 2022-02-28 14:31:28 -08:00
vijayjt
7a32c312bf Update linkedca dependency version 2022-02-25 11:21:32 +00:00
max furman
9d885e6914 bump nosql for postgres support 2022-02-22 22:39:30 -08:00
Mariano Cano
c0525381eb Merge branch 'master' into feat/vault 2022-02-16 18:19:23 -08:00
Herman Slatman
c7c5c3c94e
Merge branch 'master' into herman/scep-macos-renewal-fixes 2022-01-31 13:20:16 +01:00
Mariano Cano
09a9b3e1c8 Upgrade go.step.sm/crypto 2022-01-27 13:12:50 -08:00
Herman Slatman
3b72d241e0
Add LinkedCA integration for improved SCEP provisioner 2022-01-21 16:07:50 +01:00
Ahmet DEMIR
d957a57e24
fix: apply mariano suggestions and fixes 
* use json.RawMessage to remote mapstructure in options
* use vault secretid structure to support multiple source aka string, file and env
* remove log prefix
* return raw cert on error on newline for cert and csr
* clean sans, commonName in createCertificate (bad copy/paste from StepCAS)
* verify authority fingerprint
* convert serial on revoke to bigint, bytes and vault dashed representation
 2022-01-20 10:16:47 +01:00
Ahmet DEMIR
16390694e1
feat(vault): adding hashicorp vault cas 2022-01-14 18:56:17 +01:00
Mariano Cano
01a76445ea Upgrade go.step.sm/crypto 2022-01-06 12:50:26 -08:00
Mariano Cano
98044cf08d Use a tagged version of linkedca 2022-01-06 12:04:57 -08:00
Mariano Cano
6a1d0cb9f8 Add linkedca conversions. 2022-01-04 18:42:57 -08:00
Mariano Cano
9ec0276887 Update certificate set with new api. 2022-01-03 18:54:01 -08:00
Mariano Cano
32390a2964 Add initial implementation of a nebula provisioner. 
A nebula provisioner will generate a X509 or SSH certificate with
the identities in the nebula certificate embedded in the token.
The token is signed with the private key of the nebula certificate.
 2021-12-29 14:12:03 -08:00
Herman Slatman
06bb97c91e
Add logic for Account authorizations and improve tests 2021-12-02 16:25:35 +01:00
max furman
7fac8c96c3 Merge branch 'master' into max/context 2021-11-17 11:40:01 -08:00
max furman
196f6b45c9 bump cli-utils to 0.7.0 2021-11-16 21:49:18 -08:00
max furman
b5bf79b84e bump nosql library 2021-11-16 21:48:43 -08:00
max furman
555431448c bump version ofcli-utils 2021-11-16 21:48:38 -08:00
max furman
da74fa2eb9 Rename FullSnippet to Fragment and remove unused replace in go.mod 2021-11-16 21:47:14 -08:00
max furman
741ac64c61 change name of package cli-utils/config to cli-utils/step 2021-11-16 21:47:14 -08:00
Herman Slatman
2c05f488f6
Remove support for Go 1.15 2021-11-13 01:43:03 +01:00
Mariano Cano
62a20c7db5 Upgrade cli-utils with latest version of promptui 2021-11-01 10:08:48 -07:00
Mariano Cano
9958e0645f Replace promptui with apache-compatible fork. 
Promptui depends on github.com/juju/ansiterm that is licensed under
LGPL. The fork replaces ansiterm.TabWriter with the one in the
standard library.
 2021-10-27 12:38:16 -07:00
Mariano Cano
0927e0d22a Upgrade go.step.sm/crypto dependency 
The new version removes "env" and "expandenv" sprig functions.
 2021-10-27 11:48:29 -07:00
Mariano Cano
edd475b81b Allow to configure azurekms using the URI 
With an URI, azurekms can be configured with client credentials,
and it can define a default vault and protection level.
 2021-10-12 18:24:58 -07:00
Mariano Cano
e15b5faf7d Merge branch 'master' into keyvault 2021-10-12 15:15:35 -07:00
Mariano Cano
d8720c3723 Update linkedca package. 2021-10-07 17:21:40 -07:00
Mariano Cano
48549bf317 Initialize windows terminal on all binaries. 2021-10-07 11:09:32 -07:00
Mariano Cano
6389100325 Add unit tests for azurekms. 2021-10-05 20:35:52 -07:00
Mariano Cano
392a18465f Add initial implementation of Azure Key Vault KMS. 
Fixes #462
 2021-10-05 17:06:17 -07:00
Mariano Cano
ad82d8a250 Upgrade go.step.sm/crypto as long with go-jose.v2 
There was a typo in the OKP template causing bad fingerprints for
Ed25519 keys.

See a10ff54e00

Fixes #705
 2021-09-22 15:15:19 -07:00
Herman Slatman
73d0a11a20
Update github.com/micromdm/scep/v2 2021-09-16 08:29:25 +02:00
Herman Slatman
611859eec4
Update go.mozilla.org/pkcs7 
This includes the fix as described in https://github.com/mozilla-services/pkcs7/pull/59,
which was the reason a fork of the library was used.
 2021-09-16 08:24:28 +02:00
Mariano Cano
9e7a3cd897 Update go.step.sm/crypto 2021-08-26 18:12:37 -07:00
Mariano Cano
352acf8faa Upgrade golang.org/x/crypto 2021-08-26 11:29:13 -07:00
Mariano Cano
42fde8ba28
Merge branch 'master' into linkedca 2021-08-25 15:56:50 -07:00
max furman
2317bf183b Nosql and badger bump 2021-08-25 10:32:12 -07:00
max furman
cc9bc9c84b Bump Badger 2021-08-25 10:24:18 -07:00
max furman
f53f78974e Badger bump to fix issue with caddy build 2021-08-18 11:38:31 -07:00
Mariano Cano
456ffd8806 Use linkedca v0.5.0 2021-08-11 15:33:34 -07:00
Mariano Cano
28e882c9b3 Add deployment type to export. 2021-08-10 17:14:17 -07:00
Mariano Cano
798b90c359 Move linkedca configuration to the main package. 2021-08-04 20:15:04 -07:00
Mariano Cano
de292fbed6 Use branch version of linkedca. 2021-08-02 16:08:54 -07:00
Mariano Cano
dc1ec18b52 Create a way to export ca configurations. 2021-07-26 19:01:56 -07:00
Mariano Cano
d0c1530f89 Remove replace of linkedca package. 2021-07-26 14:48:01 -07:00
Mariano Cano
4ad82a2f76 Check linkedca for revocation. 2021-07-23 16:10:13 -07:00
Mariano Cano
71f8019243 Store x509 and ssh certificates on linkedca if enabled. 2021-07-20 18:16:24 -07:00
Mariano Cano
17eef81c91 Remove linkerd replace. 2021-07-20 14:55:07 -07:00
Mariano Cano
a72eab915b Use linkedca v0.1.0 2021-07-20 12:59:59 -07:00
Mariano Cano
8fb5340dc9 Use a token at start time to configure linkedca. 
Instead of using `step-ca login` we will use a new token provided
as a flag to configure and start linkedca. Certificates will be kept
in memory and refreshed automatically.
 2021-07-19 19:28:06 -07:00
Mariano Cano
f7e09af9df Implement the login command. 
The login commands creates a new certificate for the linked ca.
This certificate will be used to sync data with the linkedca
endpoint.
 2021-07-12 15:28:13 +02:00
max furman
77fdfc9fa3 Merge branch 'master' into max/cert-mgr-crud 2021-07-02 20:26:46 -07:00
max furman
9fdef64709 Admin level API for provisioner mgmt v1 2021-07-02 19:05:17 -07:00
Mariano Cano
65dacc2795 Replace golint with revive 2021-06-23 09:53:26 +02:00
Mariano Cano
2a97389f1b Upgrade dependencies. 2021-06-08 17:47:26 -07:00
Mariano Cano
072bd0dcf4 Add support for Google CAS v1 2021-06-03 19:31:19 -07:00
Herman Slatman
66a67ed691 Update to v2.0.0 of github.com/micromdm/scep 2021-05-26 16:15:24 -07:00
Herman Slatman
75cd3ab0ac Change to a fixed fork of go.mozilla.org/pkcs7 
Hopefully this will be a temporary change until
the fix is merged in the upstream module.
 2021-05-26 16:07:37 -07:00
Herman Slatman
2a249d20de Refactor initialization of SCEP authority 2021-05-26 16:04:19 -07:00
Herman Slatman
48c86716a0 Add rudimentary (and incomplete) support for SCEP 2021-05-26 15:58:04 -07:00
Herman Slatman
bc2bb53009
Merge branch 'master' into hs/scep 2021-05-20 21:35:44 +02:00
Mariano Cano
f84c8f846a Upgrade x/crypto 
Although this does not affects us the old version had the vulnerability
CVE-2020-29652
 2021-05-18 19:16:13 -07:00
max furman
b205f50412 bump crypto to 0.8.3 and go mod tidy 2021-05-13 12:14:11 -07:00
Herman Slatman
c3d9cef497
Update to v2.0.0 of github.com/micromdm/scep 2021-03-26 22:04:18 +01:00
Herman Slatman
c5e4ea08b3
Merge branch 'master' into hs/scep 2021-03-26 15:22:41 +01:00
Mariano Cano
561341a6f2 Update go.step.sm/crypto. 2021-03-18 18:04:38 -07:00
Herman Slatman
efd5501aca
Merge branch 'master' into hs/scep 2021-03-12 12:16:10 +01:00
Mariano Cano
d74f1fa55e Use cli-utils v0.2.0 2021-03-10 12:53:25 -08:00
Mariano Cano
a1a7e38a49 Add support for cli-utils with powershell support. 2021-03-10 12:34:47 -08:00
Herman Slatman
9df5f513e7
Change to a fixed fork of go.mozilla.org/pkcs7 
Hopefully this will be a temporary change until
the fix is merged in the upstream module.
 2021-03-06 22:35:41 +01:00
Herman Slatman
7ad90d10b3
Refactor initialization of SCEP authority 2021-02-26 00:32:21 +01:00
Herman Slatman
9e43dc85d8
Merge branch 'master' into hs/scep-master 2021-02-19 10:16:39 +01:00
Mariano Cano
3eb24d7d01 Remove duplicated replace. 2021-02-16 17:14:15 -08:00
Herman Slatman
ffdd58ea3c
Add rudimentary (and incomplete) support for SCEP 2021-02-12 12:03:08 +01:00
Mariano Cano
f289d1ee1f Update to crypto11 v1.2.4 
This version now includes my changes to delete a certificate.
 2021-02-08 12:01:21 -08:00
Mariano Cano
4fbf7569fa Merge branch 'master' into pkcs11 2021-02-01 18:13:16 -08:00
Mariano Cano
1d47a7284d Upgrade nosql with a version of badger compatible with 32bits 2021-02-01 18:09:28 -08:00
Mariano Cano
6c0cf99b24 Upgrade nosql with a 32-bit version of badger. 2021-01-27 11:02:56 -08:00
Mariano Cano
8dca652bc7 Add support for PKCS #11 KMS. 
The implementation works with YubiHSM2. Unit tests are still pending.

Fixes #301
 2021-01-26 20:03:53 -08:00
Mariano Cano
c61222de1d Upgrade nosql version. 
nosql has newer version of badgers v1 and v2.
 2021-01-21 18:03:55 -08:00
Derek Gaffney
8416bd633d Bump go-piv to v1.7.0 for x32 overflow fix 2020-12-27 20:27:39 -05:00
Mariano Cano
86c947babc Upgrade crypto and fix test. 2020-12-17 14:17:08 -08:00
Mariano Cano
d6ea8b13ab Upgrade crypto. 
Related to #435
 2020-12-17 13:34:50 -08:00
Mariano Cano
921de7e07f Upgrade crypto to v0.7.1 
Add basic constraints extensions if defined.
 2020-11-17 11:43:12 -08:00
Mariano Cano
736a6fb64e Fix rebase. 2020-11-03 12:49:04 -08:00
Mariano Cano
b275758018 Complete CloudCAS tests. 
Upgrade cloud.google.com/go
 2020-11-03 12:45:31 -08:00
Mariano Cano
b2ae112dd2 Add initial tests for CreateCertificateAuthority. 2020-11-03 12:44:54 -08:00
Mariano Cano
461735718d Update go.step.sm/crypto dependency. 2020-11-03 12:44:54 -08:00
Mariano Cano
2b4b902975 Add initial support for step ca init with cloud cas. 
Fixes smallstep/cli#363
 2020-11-03 12:44:28 -08:00
Mariano Cano
b79701202b Use cli-utils@v0.1.0 2020-10-29 15:07:14 -07:00
Mariano Cano
40d0596b71 Use smallstep/cli-utils instead of smallstep/cli 2020-10-29 13:10:03 -07:00
max furman
81a0df9e45 go mod tidy 2020-10-21 20:42:23 -07:00
max furman
bf45e6ff16 Bump cli to v0.15.3 2020-10-21 16:40:06 -07:00
max furman
3f4d041082 bump cli to master 2020-10-20 22:38:59 -07:00
Mariano Cano
647b9b4541
Merge pull request #367 from smallstep/cas 
Support for CAS Interface and CloudCAS
 2020-10-05 18:09:01 -07:00
Mariano Cano
4c8bf87dc1 Use new admin template for K8ssa and admin-OIDC provisioners. 
This change replaces the .Insecure.CR template to one that sets
all the SANs, but uses key usages and extended key usages for
regular TLS certificates.
 2020-09-21 12:49:16 -07:00
Mariano Cano
a332c40530 Merge branch 'master' into cas 2020-09-17 14:46:52 -07:00
Pierre Laden
179e793f1a - provide PINpolicy always to piv-go to avoid trying to use attestation cert, which we might not have 
- bump piv-go version to 1.6.0
 2020-09-16 21:59:48 +02:00
Mariano Cano
c8d9cb0a1d Complete cloudcas using CAS v1beta1. 2020-09-10 16:19:18 -07:00
Mariano Cano
1b1f73dec6 Early attempt to develop a CAS interface. 2020-09-08 19:26:32 -07:00
Mariano Cano
3ac0ef2eaa Update crypto to v0.6.0 2020-09-02 18:08:24 -07:00
Mariano Cano
f3b65e54ac Update go.step.sm to v0.5.0 
Solves the problem of enforcing the signature algorithm. This
causes issues if the intermediate key is not an ECDSA key.
 2020-09-01 12:44:46 -07:00
Mariano Cano
8ee246edda Upgrade go.step.sm to v0.4.0 2020-08-31 12:30:54 -07:00
Mariano Cano
ef86bedb2c Upgrade go.step.sm dependency to v0.3.0 2020-08-25 11:46:04 -07:00
Mariano Cano
c94a1c51be Merge branch 'master' into ssh-cert-templates 2020-08-24 15:08:28 -07:00
Mariano Cano
ba918100d0 Use go.step.sm/crypto/jose 
Replace use of github.com/smallstep/cli/crypto with the new package
go.step.sm/crypto/jose.
 2020-08-24 14:44:11 -07:00
Mariano Cano
03d642e59c Update go.step.sm/crypto to v0.2.0 
Fixes #302
 2020-08-20 16:02:45 -07:00
max furman
cb594ed2e0 go mod tidy and golang 1.15.0 cleanup ... 
- cs.NegotiatedProtocolIsMutual has been deprecated but we still build
in travis with 1.14 so for now we'll ignore this linting error
- string(int) was resolving to string of a single rune rather than
string of digits -> use fmt.Sprint
 2020-08-17 13:48:37 -07:00
max furman
795648e5d5 bump cli to v0.15.0 2020-08-16 21:04:12 -07:00
Mariano Cano
32ba80f446 Use pemutil branch. 2020-08-14 15:44:18 -07:00
Mariano Cano
d30a95236d Use always go.step.sm/crypto 2020-08-14 15:33:50 -07:00
Mariano Cano
aaaa7e9b4e Merge branch 'master' into cert-templates 2020-08-14 10:45:41 -07:00
Mariano Cano
533ad0ca20 Use always go.step.sm/crypto/x509util 2020-08-11 17:59:33 -07:00
Mariano Cano
4943ae58d8 Move TLSOption, TLSVersion, CipherSuites and ASN1DN to certificates. 2020-08-10 15:29:18 -07:00
Mariano Cano
e83e47a91e Use sshutil and randutil from go.step.sm/crypto. 2020-08-10 11:26:51 -07:00
Mariano Cano
c8d225a763 Use x509util from go.step.sm/crypto/x509util 2020-08-05 16:02:46 -07:00
max furman
3f844c5e23 Update the way SubjectKeyId is calculated, and more ... 
- swith lint to first in line for `make all`
- update tests to conform with new subjectkeyid
 2020-07-28 12:00:07 -07:00
David Cowden
dc39eef721 aws: test badIDMS functional path 
The existing test only covers the constructor logic. Also test the live
code path that is executed when a bad IDMS version is supplied.
 2020-07-22 17:40:26 -07:00
Mariano Cano
978ad7e2b6 Fix merged tests. 2020-07-21 14:34:55 -07:00
Mariano Cano
0de15b0a42 Update cli dependency to master. 2020-07-21 14:20:27 -07:00
Mariano Cano
6736ddee69 Use smallstep/cli v0.14.6 2020-07-02 13:55:00 -07:00
max furman
e1fdd9300c go mod tidy 2020-06-30 18:01:31 -07:00
max furman
f5da56e19f Bump version of cli to v0.14.5. 2020-06-30 16:25:58 -07:00
max furman
b200e84967 Pull most recent cli and go mod tidy 2020-06-25 15:36:35 -07:00
Mariano Cano
c32abb76cd Add initial implementation to support AWS KMS. 2020-05-19 17:35:36 -07:00
Mariano Cano
6868190fff Add initial support for yubikey. 2020-05-07 18:22:09 -07:00
max furman
c1a84c1405 go mod tidy 2020-04-30 18:59:41 -07:00
max furman
1b6bf38b52 Bump cli to v0.14.3 2020-04-30 17:48:58 -07:00
max furman
30e38dc501 Bumpt the version of cli for a certificates RC. 2020-04-28 09:34:10 -07:00
Mariano Cano
df3b9f637e Use a tagged version of nosql. 2020-04-27 18:13:54 -07:00