May 2016 - Pki-devel - Dogtag Pki List Archives

by Fraser Tweedale

Hullo all, FreeIPA Lightweight CAs implementation is progressing well. The remaining big unknown in the design is how to do renewal. I have put my ideas into the design page[1] and would appreciate any and all feedback! [1] http://www.freeipa.org/page/V4/Sub-CAs#Renewal Some brief commentary on the options: I intend to implement approach (1) as a baseline. Apart from implementing machinery in Dogtag to actually perform the renewal - which is required for all the approaches - it's not much work and gets us over the "lightweight CAs can be renewed easily" line, even if it is a manual process. For automatic renewal, I am leaning towards approach (2). Dogtag owns the lightweight CAs so I think it makes sense to give Dogtag the ability to renew them automatically (if configured to do so), without relying on external tools i.e. Certmonger. But as you will see from the outlines, each approach has its upside and downside. Cheers, Fraser

8 years, 6 months

3
8
0 / 0

[PATCH] 0113..0114 Lightweight CAs: renewal support

by Fraser Tweedale

Attached patches implement LWCA renewal support (https://fedorahosted.org/pki/ticket/2327). It includes REST API POST /ca/rest/authorities/<id>/renew But not implemented in CLI tool yet. If we decide to make it a first-class CLI feature (cf certmonger, IPA, etc managing the renewal) then I'll file the ticket and implement it at that time. Cheers, Fraser

8 years, 6 months

2
4
0 / 0

[PATCH] 0115 Include serial of revoked cert in CertRequestInfo

by Fraser Tweedale

Please review the attached patch, which addresses https://fedorahosted.org/pki/ticket/1073 Cheers, Fraser

8 years, 6 months

2
2
0 / 0

[PATCH] 0112 Return 410 Gone if target CA of request has been deleted

by Fraser Tweedale

Hi all, attached patch fixes https://fedorahosted.org/pki/ticket/2332 Cheers, Fraser

8 years, 6 months

2
2
0 / 0

[PATCH] 0111 Lightweight CAs: remove NSSDB material when processing deletion

by Fraser Tweedale

The attached patch makes clones delete lightweight CA keys/certs from local NSSDB when processing LWCA deletion. Ticket: https://fedorahosted.org/pki/ticket/2328 Thanks, Fraser

8 years, 6 months

2
2
0 / 0

[PATCH] 0110 Lightweight CAs: remove redundant deletePrivateKey invocation

by Fraser Tweedale

Hi team, The attached patch fixes https://fedorahosted.org/pki/ticket/1640. Cheers, Fraser

8 years, 6 months

2
2
0 / 0

[PATCH] 757 Added TPS token state transition validation.

by Endi Sukma Dewata

The TPSSubsystem has been modified to load and validate the token state transition lists during initialization. If any of the lists is empty or any of the transitions is invalid, the initialization will fail and the subsystem will not start. https://fedorahosted.org/pki/ticket/2334 -- Endi S. Dewata

8 years, 6 months

1
2
0 / 0

[PATCH] 760 Fixed invalid TPS VLV indexes.

by Endi Sukma Dewata

The TPS VLV indexes have been fixed to use the correct vlvScope (i.e. one level). The unsupported minus sign in vlvSort and the redundant vlvEnabled have been removed. https://fedorahosted.org/pki/ticket/2342 -- Endi S. Dewata

8 years, 6 months

2
2
0 / 0

[PATCH] 754-755 Fixed problem submitting renewal request.

by Endi Sukma Dewata

Attached are patches to fix a problem with submitting renewal request. https://fedorahosted.org/pki/ticket/999 -- Endi S. Dewata

8 years, 6 months

1
1
0 / 0

db changes

by Ade Lee

Hey guys, I had some time during layovers/flights and threw a couple of ideas together about how to handle the DB changes we have to perform for fine grained authz and sub CAs, and other future changes .. http://pki.fedoraproject.org/wiki/Tracking_db_migrations Please take a look and comment. Thanks, Ade

8 years, 6 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

Pki-devel May 2016