github-personal/certificates
1
0
Fork 0
mirror of https://github.com/outbackdingo/certificates.git synced 2026-01-27 18:18:30 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,310 Commits 1 Branch 0 Tags
master
Commit Graph

103 Commits

Author SHA1 Message Date
Herman Slatman
f4736325fa Use github.com/smallstep/linkedca @ v0.23.0 2025-01-03 18:24:19 +01:00
Mariano Cano
ff37bf1811 Add unit tests for scepchallenge webhooks 2024-11-12 13:15:11 -08:00
Mariano Cano
f2663dd9d9 Add data support on SCEPCHALLENGE webhooks 
This commit adds support for using template data from SCEPCHALLENGE
webhooks.
 2024-11-11 18:35:28 -08:00
Herman Slatman
35a4d6e6a4 Fix typo in legacy X509 certificate parser comment 2024-09-13 23:52:02 +02:00
Herman Slatman
f088f92aee Fix for failing Windows SCEP enrollment certificates 2024-09-13 23:47:59 +02:00
Mariano Cano
f3f484cee2 Log errors using slog.Logger 
This commit allows logging errors in a slog.Logger injected in the
context. This type of logger is not currently used directly in step-ca,
but this will change in the future.
 2024-05-15 15:40:40 -07:00
Herman Slatman
6bc0a86207 Fix CA startup with Vault RA configuration 2024-04-18 16:12:30 +02:00
Herman Slatman
b226b6eb4c Prevent exposing any internal details in SCEP failure message 
To be on the safe side, block errors from signing operations from
being returned to the client. We should revisit, and make it return
a more informative error, but with high assurance that no sensitive
information is added to the message.
 2024-04-10 01:59:56 +02:00
Herman Slatman
037554e774 Fix the id-scep-failInfoText OID 2024-04-10 01:19:17 +02:00
Herman Slatman
041b486c55 Remove usages of Sign without context 2024-02-27 14:16:21 +01:00
Herman Slatman
2a8b80a3e1 Merge branch 'master' into herman/webhook-request-id 2024-02-27 12:17:10 +01:00
Max
d34f0f6a97 Fix linter warnings (#1634) 2023-11-28 20:58:58 -08:00
Herman Slatman
1abada69b0 Update import aliases from microscep to smallscep 2023-10-24 21:48:24 +02:00
Herman Slatman
4c17f25389 Replace MicroMDM and Mozilla libraries with Smallstep forks 2023-10-24 21:44:34 +02:00
Herman Slatman
25f4b4014d Add base64 to the raw message decoding error 2023-10-04 13:34:26 +02:00
Herman Slatman
965d7aa7f4 Fix linting issues 2023-10-04 13:33:01 +02:00
Herman Slatman
cd78b9fd43 Implement workaround for weird macOS SCEP message in query 
Apparently the macOS SCEP client sends a SCEP message in the query
that's not fully escaped. Only the base64 padding is escaped, the
'+' and '/' characters aren't.

This is a bit of a special case, because the macOS SCEP client
will default to using HTTP POST for the PKIOperation. But if the
CA is configured without the POSTPKIOperation capability, the
macOS SCEP client will use HTTP GET instead. This behavior might
be the same on iOS.
 2023-10-04 13:16:48 +02:00
Herman Slatman
3c12b4f5ad Improve decoding SCEP requests 2023-10-03 16:32:55 +02:00
Herman Slatman
ffe079f31b Merge branch 'master' into herman/scep-provisioner-decrypter 2023-09-23 00:06:56 +02:00
Herman Slatman
ba72710e2d Address code review remarks 2023-09-22 12:40:14 +02:00
Herman Slatman
6d2d21e989 Fix undefined and unused variables 
Forgot to save the latest version...
 2023-09-21 18:15:03 +02:00
Herman Slatman
b6c95d7be2 Add additional properties to SCEP notify webhook request body 2023-09-21 18:12:13 +02:00
Herman Slatman
52bc96760b Add SCEP certificate issuance notification webhook 2023-09-21 12:01:03 +02:00
Dominic Evans
231b5d8406 chore(deps): upgrade github.com/go-chi/chi to v5 
Upgrade chi to the v5 module path to avoid deprecation warning about v4
and earlier on the old module path.

See https://github.com/go-chi/chi/blob/v4.1.3/go.mod#L1-L4

Signed-off-by: Dominic Evans <dominic.evans@uk.ibm.com>
 2023-09-20 11:26:32 +01:00
Herman Slatman
9e3807eaa3 Use SignWithContext in the critical paths 2023-09-19 16:34:29 +02:00
Herman Slatman
36f1dd70bf Add CSR to SCEPCHALLENGE webhook request body 2023-09-07 14:11:53 +02:00
Herman Slatman
d9f56cdbdc Merge branch 'master' into herman/scep-provisioner-decrypter 2023-09-04 15:24:19 +02:00
Herman Slatman
9d3b78ae49 Add excludeIntermediate to SCEP provisioner 2023-09-04 14:55:27 +02:00
Max
116ff8ed65 bump go.mod to go1.20 and associated linter fixes (#1518) 2023-08-29 11:52:13 -07:00
Herman Slatman
0d09f3e202 Prevent data races with multiple PKCS7 encryption operations 2023-08-04 12:14:29 +02:00
Herman Slatman
e2e9bf5494 Clarify some SCEP properties 2023-08-04 01:55:52 +02:00
Herman Slatman
c0a1837cd9 Verify full decrypter/signer configuration at usage time 
When changing the SCEP configuration it is possible that one
or both of the decrypter configurations required are not available
or have been provided in a way that's not usable for actual SCEP
requests.

Instead of failing hard when provisioners are loaded,
which could result in the CA not starting properly, this type of
problematic configuration errors will now be handled at usage
time instead.
 2023-08-03 16:09:51 +02:00
Herman Slatman
0f35bb1af5 Defer missing decrypter/signer configuration errors to SCEP authority 2023-08-03 15:34:20 +02:00
Herman Slatman
fc1fb51854 Improve SCEP authority initialization and reload 2023-08-02 18:35:38 +02:00
Herman Slatman
7163c4f95f Add helper for getting the appropriate SCEP response signer 2023-08-02 16:01:58 +02:00
Herman Slatman
567fc25404 Use the RSA decryption configuration for signing responses too 2023-07-27 00:55:39 +02:00
Herman Slatman
557672bb4b Add some notes for SCEP provisioners 2023-07-26 19:11:51 +02:00
Herman Slatman
b2bf2c330b Simplify SCEP provisioner context handling 2023-06-01 16:22:00 +02:00
Herman Slatman
8fc3a46387 Refactor the SCEP authority initialization 
Instead of relying on an intermediate `scep.Service` struct,
initialize the `scep.Authority` directly. This removes one redundant
layer of indirection.
 2023-06-01 15:50:51 +02:00
Herman Slatman
6985b4be62 Clean up the SCEP authority and provisioner 2023-06-01 14:43:32 +02:00
Herman Slatman
180162bd6a Refactor SCEP provisioner and decrypter 2023-06-01 12:10:54 +02:00
Herman Slatman
0377fe559b Add basic version of provisioner specific SCEP decrypter 2023-05-26 23:52:49 +02:00
max furman
8b256f0351 address linter warning for go 1.19 2023-05-09 23:47:28 -07:00
Herman Slatman
e8c1e8719d Refactor SCEP webhook validation 2023-05-01 22:09:42 +02:00
Herman Slatman
668ff9b515 Cleanup some comments and tests 2023-05-01 11:55:05 +02:00
Herman Slatman
5f0f0f4bcc Add SCEP webhook validation tests 2023-05-01 11:14:50 +02:00
Herman Slatman
ad4d8e6c68 Add SCEPCHALLENGE as valid webhook type in admin API 2023-04-29 01:40:03 +02:00
Herman Slatman
419478d1e5 Make SCEP webhook validation look better 2023-04-29 01:15:39 +02:00
Herman Slatman
27cdcaf5ee Integrate the SCEP webhook with the existing webhook logic 2023-04-28 17:15:05 +02:00
Herman Slatman
05f7ab979f Create basic webhook for SCEP challenge validation 2023-04-28 15:47:22 +02:00