- 21 Sep, 2017 3 commits
-
-
Vincent Pelletier authored
-
Vincent Pelletier authored
So tests ran on an older system fail with a clean error.
-
Vincent Pelletier authored
"Monitor" is too vague.
-
- 14 Sep, 2017 2 commits
-
-
Vincent Pelletier authored
-
Vincent Pelletier authored
Remove this outdated mention.
-
- 29 Aug, 2017 1 commit
-
-
Vincent Pelletier authored
libssl is the exception, as the idea here is that it is a foreign piece of software which makes the call.
-
- 23 Aug, 2017 1 commit
-
-
Vincent Pelletier authored
- Re-evaluate feature set and REST API. - switch duration units to days, which are more meaningful than sticking to ISO units in this context. - Implement the "cau" half of "caucase". As a consequence flask password authentication mechanism is not needed anymore. As HTML UI is not required internally to caucase, and as sqlalchemy is not used to its full extend, get rid of these dependencies altogether. - Implement REST HTTP/HTTPS stand-alone server as a layer above WSGI application, and integrate HTTPS certificate issuance and renewal mechanism to simplify deployment: no middleware needed, so from gunicorn dependency. - Use standard python modules for http client needs. - Re-evaluate data retention options: - unsigned CSRs are kept forever - CRTs are stored in CSR table, and a 24 hour expiration is set - CA CRTs: (unchanged, expire when past validity period) - CRLs: (unchanged, expire when past validity period) - Redispatch housekeeping tasks: - CA renewal happens when caucase is used and renewal is needed - CRL is flushed when re-generated - CSR table (containing CRTs) is cleaned when a new CSR is received removing completely the need for these special periodic tasks. - Storage parameters are not stored persistently anymore, instead their effect (time offsets) is applied before storing (to protect against transient retention period reconfiguration from wiping data). - Rework storage schema. - Implement certificate extension propagation & filtering. - Implement "Certificate was auto-signed" extension. - More docstrings. - Use a CSR as a subject & extensions template instead of only allowing to override the subject. Useful when renewing a certificate and when authenticated client wants to force (ex) a CommonName in the subject. - Reorganise cli executable arguments to have more possible actions. Especially, make CA renewal systematic on command start (helps validating caucase URL). - Increase the amount of sanity checks against user-provided data (ex: do not upload a private key which would be in the same file as the CRT to renew). - Extend package classifiers. - Get rid of revocation reason, as it seems unlikely to be filled, and even less likely to be read later. - (almost) stop using pyOpenSSL. Use cryptography module instead. cryptography has many more features than pyOpenSSL (except for certificate validation, sadly), so use it. It completely removes the need to poke at ASN.1 ourselves, which significantly simplifies utils module, and certificate signature. Code is a bit more verbose when signing, but much simpler than before. - add the possibility to revoke by certificate serial - update gitignore - include coverage configuration - include pylint configuration - integrate several secondary command: - caucase-probe to quickly check server presence and basic functionality, so automated deployments can easily auto-check - caucase-monitor to automate key initial request and renewal - caucase-rerequest to allow full flexibility over certificate request content without ever transfering private keys - add a secure backup generation mechanism - add a README describing the design
-
- 21 Jul, 2017 2 commits
-
-
Alain Takoudjou authored
-
Alain Takoudjou authored
-
- 30 Jun, 2017 4 commits
-
-
Alain Takoudjou authored
-
Alain Takoudjou authored
when calling cliweb command with option --updateÃ-cr the crl file will be downloaded from URL/crl and save only if the previous crl file don't exists or if there is an old crl file and the new one is different. if option --on-crl-update SCRIPT_FILE is passed with --update-crl SCRIPT_FILE will be executed if the crl is updated.
-
Alain Takoudjou authored
-
Alain Takoudjou authored
-
- 28 Jun, 2017 3 commits
-
-
Alain Takoudjou authored
-
Alain Takoudjou authored
-
Alain Takoudjou authored
-
- 30 May, 2017 3 commits
-
-
Alain Takoudjou authored
-
Alain Takoudjou authored
Split cli_flask functions used to renew, sign and revoke certificate. Allow to revoke a certificate by serial PUT /crt/revoke/serial, this method required admin authentication. Also add GET /crt/serial/<string:serial>
-
Alain Takoudjou authored
-
- 12 May, 2017 4 commits
-
-
Alain Takoudjou authored
-
Alain Takoudjou authored
-
Alain Takoudjou authored
-
Alain Takoudjou authored
-
- 27 Apr, 2017 5 commits
-
-
Alain Takoudjou authored
-
Alain Takoudjou authored
-
Alain Takoudjou authored
-
Alain Takoudjou authored
The certificate authority is used to generate and sign certificate, there is 3 parts: - web: which contains API to submit certificate signature request and to download signed certificate - cliweb: which is a command line tool used to quickly generate private key and send certificate signature request, he will also downlaod automatically the signed certificate as well as ca certificate. - cli: is used to garbage collect certificate authority, all expired certificate, csr, crl and revocation will be trashed using this tool. The first csr can be automatically signed, the rest will be signed by the adminitrator, first connection to /admin/ will ask to set password the admin can see all csr (pending) then sign them. As soon as csr is signed, the client will download (cliweb) the certificate. client can also renew or revoke his certificate using CA API. Renew and revoke are immediate, there is no admin approval. on server side, the storage storage.py use sqlite to store all informations (certificat, csr, crl and revocations), there is no use of openssl here. ca.py will invoke the storage to store or to get certificates. the client store certificate directly on filesystem, so it can be read by apache, nginx, etc.
-
Alain Takoudjou authored
-
- 31 Mar, 2017 1 commit
-
-
Vincent Pelletier authored
-
- 29 Mar, 2017 3 commits
-
-
Vincent Pelletier authored
-
Vincent Pelletier authored
-
Vincent Pelletier authored
-