Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Inlcude challenge password attribute if required by EST server #34

Closed
wants to merge 79 commits into from

Conversation

mobe1
Copy link

@mobe1 mobe1 commented Feb 27, 2024

The changes introduced come after an issue/feature request has been opened.
They allow us to enroll a CSR that includes the TLS-unique value as recommended by the RFC 7030

  • Because each http client instantiation results in a new TLS-unique, one way of including it would be to make EST requests from the same http client.
  • Because the standard crypto/x509 Go package does not handle the challenge password attribute (OID) the way an EST/CA server expects it, the CSR creation had to be wrapped.

paulgriffiths and others added 30 commits June 3, 2020 11:02
…tput

Break base64 HTTP messages into lines.
…ontent-types

Support more error content types.
Jmennius and others added 26 commits June 30, 2021 15:45
`rootOutFlag` is just a boolean flag and does not accept a path.

Signed-off-by: Ievgen Popovych <[email protected]>
…athFmt-from-rootOutFlag

cmd: estclient: flags: Remove path formatting from rootOutFlag
This implements filtering of CA certificates -
using one of `roots` or `intermediates` flags allows the user to output
only root or intermediate CA certificates respectively.

In contrast with `rootout` flag,
`roots` flag also supports outputting multiple root certificates.

`rootout` flag is now deprecated and will be removed in favor of `roots`
in the future.

Signed-off-by: Ievgen Popovych <[email protected]>
It is often required to have every CA certificate in its own file,
so instead of splitting them manually (which is clunky) - provide this option.

A new flag, `separate`, enables this mode.
It is possible to set filename prefix with `out` flag.
Files are written in a format `<prefix>-<index>.pem`,
`ca` is the default prefix, prefix can also end with `.pem`.
…dual-file-per-ca

cacerts - support individual file per CA, more flexible filtering
Next : try another go package
… argument type so that we don't depend on x509 package anymore, which today still ignores the challenge password attribute
- Update readme and documentation
@mobe1
Copy link
Author

mobe1 commented Feb 27, 2024

There has been a git branch filter command applied which accounts for all git history commits being displayed...

@mobe1
Copy link
Author

mobe1 commented Mar 4, 2024

PR is closed : once the PR is "clean" enough, new PR will be created.

@mobe1 mobe1 closed this Mar 4, 2024
@toddgaunt-gs
Copy link
Collaborator

Thank you for the contribution, yes a cleaner version would be great :)!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants