60 Commits

Author	SHA1	Message	Date
Kyle Havlovitz	45ec8849f3	connect/ca: add configurable leaf cert TTL	2018-07-16 13:33:37 -07:00
Matt Keeler	b3ba709b3d	Remove x509 name constraints ... These were only added as SPIFFE intends to use the in the future but currently does not mandate their usage due to patch support in common TLS implementations and some ambiguity over how to use them with URI SAN certificates. We included them because until now everything seem fine with it, however we've found the latest version of `openssl` (1.1.0h) fails to validate our certificats if its enabled. LibreSSL as installed on OS X by default doesn’t have these issues. For now it's most compatible not to have them and later we can find ways to add constraints with wider compatibility testing.	2018-06-25 12:26:10 -07:00
Kyle Havlovitz	f3089a6647	connect/ca: undo the interface changes and use sign-self-issued in Vault	2018-06-25 12:25:42 -07:00
Kyle Havlovitz	cea94d0bcf	connect/ca: update Consul provider to use new cross-sign CSR method	2018-06-25 12:25:41 -07:00
Kyle Havlovitz	a98b85b25c	connect/ca: add the Vault CA provider	2018-06-25 12:25:41 -07:00
Paul Banks	6ecc0c8099	Sign certificates valid from 1 minute earlier to avoid failures caused by clock drift	2018-06-25 12:25:41 -07:00
Kyle Havlovitz	4d46bba2c4	Support giving the duration as a string in CA config	2018-06-14 09:42:22 -07:00
Paul Banks	30d90b3be4	Generate CSR using real trust-domain	2018-06-14 09:42:16 -07:00
Paul Banks	c808833a78	Return TrustDomain from CARoots RPC	2018-06-14 09:42:15 -07:00
Kyle Havlovitz	d1265bc38b	Rename some of the CA structs/files	2018-06-14 09:42:15 -07:00

Renamed from agent/connect/ca/ca_provider_consul.go (Browse further)