Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update readme to use agreed upon profile name and clarify the #167

Merged
merged 1 commit into from
Mar 5, 2024
Merged

Update readme to use agreed upon profile name and clarify the #167

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions certz/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,10 +40,9 @@ Certificate Authority chain of certificates (a.k.a. a CA trust bundle) and
a set of Certificate Revocation Lists into a set that then can be assigned
as a whole to a gRPC server.

There is at least one profile present on a target - the one that is used by
the gNxI server. Its ID is `gNxI` but when the `ssl_profile_id` field in the
There is always at least one profile present on a target - the `system_default_profile` which is vendor provided. This profile cannot be changed. If the use but when the `ssl_profile_id` field in the
`RotateCertificateRequest` message is not set (or set to an empty string) it
also refers this SSL profile.
also refers this SSL profile. (This statement will be deprecated once all vendors standardize on the key name)

Profiles existing on a target can be discovered using the
`Certz.GetProfileList()` RPC.
Expand Down Expand Up @@ -97,10 +96,12 @@ policy before accepting the connection.

The system will always provide a default TLS profile that uses the IDevID cert.
This profile will always be available and cannot be changed. It should use the name
"gNxI".
"system_default_profile".

An attempt to change or delete this profile will return an error.

The system will start with this profile and either bootz or enrollz will be responsible for creating an alternate profile during device turnup if those workflows are used.

#### Create a SSL profile

Call `Certz.AddProfile` RPC with the `ssl_profile_id` field specifying the ID
Expand Down
3 changes: 2 additions & 1 deletion certz/certz.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,8 @@ option go_package = "github.com/openconfig/gnsi/cert";
//
// Target (as seen from gNSI.certificate microservice point of view)
// |
// +-+ SSL profile for gNXI; always present; ssl_profile_id := "gNxI"
// +-+ SSL profile for gNXI; always present and immutable;
// | ssl_profile_id := "system_default_profile"
// | |
// | +-+ certificate
// | | +- certificate (with public key)
Expand Down
Loading