scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-10-30 02:02:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Minor follow-ups to #16865 (#20220)

Browse Source 
* Minor follow-ups to #16865

Fix PKI issuer upgrade logic when upgrading to 1.12 or later, to
actually turn off the issuer crl-signing usage when it intended to.

Fix minor typo in docs.

* changelog
This commit is contained in:
Max Bowsher
2023-04-18 12:39:05 +01:00
committed by GitHub
parent aae6c65c09
commit acfc862b4b
3 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
builtin/logical/pki/storage.go
View File

@@ -709,7 +709,7 @@ func (sc *storageContext) upgradeIssuerIfRequired(issuer *issuerEntry) *issuerEn
// Remove CRL signing usage if it exists on the issuer but doesn't // Remove CRL signing usage if it exists on the issuer but doesn't
// exist in the KU of the x509 certificate. // exist in the KU of the x509 certificate.
if hadCRL && (cert.KeyUsage&x509.KeyUsageCRLSign) == 0 { if hadCRL && (cert.KeyUsage&x509.KeyUsageCRLSign) == 0 {
issuer.Usage.ToggleUsage(OCSPSigningUsage) issuer.Usage.ToggleUsage(CRLSigningUsage)
} }
// Handle our new OCSPSigning usage flag for earlier versions. If we // Handle our new OCSPSigning usage flag for earlier versions. If we

3
changelog/20220.txt Normal file
View File

@@ -0,0 +1,3 @@
```release-note:bug
pki: Fix automatically turning off CRL signing on upgrade to Vault >= 1.12, if CA Key Usage disallows it
```

2
website/content/api-docs/secret/pki.mdx
View File

@@ -2058,7 +2058,7 @@ imported entries present in the same bundle).
issuers. This means the returned certificate _may_ differ in encoding from issuers. This means the returned certificate _may_ differ in encoding from
the one provided on subsequent re-imports of the same issuer or key. the one provided on subsequent re-imports of the same issuer or key.
~> Note: This import may fail due to CRL rebuilding issuers or other potential ~> Note: This import may fail due to CRL rebuilding issues or other potential
issues; this may impact long-term use of these issuers, but some issuers or issues; this may impact long-term use of these issuers, but some issuers or
keys may still be imported as a result of this process. keys may still be imported as a result of this process.