scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-11-02 03:27:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Minor follow-ups to #16865 (#20220) (#20222)

Browse Source 
* Minor follow-ups to #16865

Fix PKI issuer upgrade logic when upgrading to 1.12 or later, to
actually turn off the issuer crl-signing usage when it intended to.

Fix minor typo in docs.

* changelog

Co-authored-by: Max Bowsher <maxbowsher@gmail.com>
This commit is contained in:
hc-github-team-secure-vault-core
2023-04-18 09:24:44 -04:00
committed by GitHub
parent d8cf0fe646
commit 73f821307e
3 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
builtin/logical/pki/storage.go
View File

@@ -706,7 +706,7 @@ func (sc *storageContext) upgradeIssuerIfRequired(issuer *issuerEntry) *issuerEn
// Remove CRL signing usage if it exists on the issuer but doesn't
// exist in the KU of the x509 certificate.
if hadCRL && (cert.KeyUsage&x509.KeyUsageCRLSign) == 0 {
issuer.Usage.ToggleUsage(OCSPSigningUsage)
issuer.Usage.ToggleUsage(CRLSigningUsage)
}
// Handle our new OCSPSigning usage flag for earlier versions. If we

3
changelog/20220.txt Normal file
View File

@@ -0,0 +1,3 @@
```release-note:bug
pki: Fix automatically turning off CRL signing on upgrade to Vault >= 1.12, if CA Key Usage disallows it
```

2
website/content/api-docs/secret/pki.mdx
View File

@@ -2058,7 +2058,7 @@ imported entries present in the same bundle).
issuers. This means the returned certificate _may_ differ in encoding from
the one provided on subsequent re-imports of the same issuer or key.
~> Note: This import may fail due to CRL rebuilding issuers or other potential
~> Note: This import may fail due to CRL rebuilding issues or other potential
issues; this may impact long-term use of these issuers, but some issuers or
keys may still be imported as a result of this process.