5 Commits

Author	SHA1	Message	Date
Jeff Mitchell	435aefc072	A few things: ... * Add comments to every non-obvious (e.g. not basic read/write handler type) function * Remove revoked/ endpoint, at least for now * Add configurable CRL lifetime * Cleanup * Address some comments from code review Commit contents (C)2015 Akamai Technologies, Inc. <opensource@akamai.com>	2015-06-19 12:48:18 -04:00
Jeff Mitchell	23ba605068	Refactor to allow only issuing CAs to be set and not have things blow up. This is useful/important for e.g. the Cassandra backend, where you may want to do TLS with a specific CA cert for server validation, but not actually do client authentication with a client cert. ... Commit contents (C)2015 Akamai Technologies, Inc. <opensource@akamai.com>	2015-06-18 15:22:58 -04:00
Jeff Mitchell	a2b3e1302a	A bunch of cleanup and moving around. logical/certutil is a package that now has helper functions ... useful for other parts of Vault (including the API) to take advantage of. Commit contents (C)2015 Akamai Technologies, Inc. <opensource@akamai.com>	2015-06-16 13:43:12 -04:00
Jeff Mitchell	64c8a437e9	Add locking for revocation/CRL generation. I originally was going to use an RWMutex but punted, because it's not worth trying to save some milliseconds with the possibility of getting something wrong. So the entire operations are now wrapped, which is minimally slower but very safe. ... Commit contents (C)2015 Akamai Technologies, Inc. <opensource@akamai.com>	2015-06-11 22:28:13 -04:00
Jeff Mitchell	530b67bbb9	Initial PKI backend implementation. ... Complete: * Up-to-date API documents * Backend configuration (root certificate and private key) * Highly granular role configuration * Certificate generation * CN checking against role * IP and DNS subject alternative names * Server, client, and code signing usage types * Later certificate (but not private key) retrieval * CRL creation and update * CRL/CA bare endpoints (for cert extensions) * Revocation (both Vault-native and by serial number) * CRL force-rotation endpoint Missing: * OCSP support (can't implement without changes in Vault) * Unit tests Commit contents (C)2015 Akamai Technologies, Inc. <opensource@akamai.com>	2015-06-08 00:06:09 -04:00