Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue152 - this issue's problem was actually already resolved but in reading - some cleanup of text seemed proper. #215

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+8 −5
Open

Issue152 - this issue's problem was actually already resolved but in reading - some cleanup of text seemed proper. #215

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
945d0c5
Issue202: Add clarification on usage of ssl profiles.
morrowc Dec 28, 2024
4fa8718
Documentation Cleanup.
morrowc Dec 28, 2024
e249c77
Address comment.
morrowc Jan 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions certz/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,9 +38,10 @@ The normal use-case would be to:
SSL profiles logically group a certificate (private and public keys),
Certificate Authority chain of certificates (a.k.a. a CA trust bundle) and
a set of Certificate Revocation Lists into a set that then can be assigned
as a whole to a gRPC server.
as a whole to a gRPC service.

There is always at least one profile present on a target - the `system_default_profile` which is vendor provided.
There is always at least one profile present on a target - the `system_default_profile`
which is vendor provided.
This profile cannot be changed or deleted.
See the the [System default SSL profile](#system-default-ssl-profile) section below.

Expand All @@ -49,9 +50,9 @@ Profiles existing on a target can be discovered using the

A SSL profile can be added using the `Certz.AddProfile()` RPC.

When no longer a profile is needed it can be removed from the target via
`Certz.DeleteProfile()` RPC. Note that the gNxI SSL profile cannot be
removed.
When a profile is no longer needed it can be removed from the target via
`Certz.DeleteProfile()` RPC. Note that the system_default_profile SSL
profile cannot be removed.

The SSL profile ID of a gRPC server is exposed in the YANG leaf
`ssl-profile-id` which is an augment to the
Expand Down
2 changes: 2 additions & 0 deletions certz/certz.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,8 @@ option go_package = "github.com/openconfig/gnsi/cert";
// There is at least one SSL profile present on the target, the one that is used
// by all gNxI microservices. It is created during the bootstrap phase and
// cannot be removed.
// SSL profiles maybe used by client, server or both services on the target
// device.
// Other services that require credentials _can_ use the same SSL profile as
// the gNxI server or they can use a SSL profiles that is created using
// the `AddProfile()` RPC. In any case, the assignment of a SSL profile to
Expand Down
Loading