f1ed12e2cf
Signing requests are expected to arrive at /v1/sign/<registration_authority> now. Virtual registration authority is a new concept which right now includes everything the original configuration included. That means for example each registration authority available within Anchor deployment can configure its own CA, auth, and validators. Clients request a specific registration authority via the URL. This does not mean they can just choose who signs the CSR - they still need to pass all checks. Only the guesswork of "which validation set applies to them" is gone because of this change. The previous concept of validator sets is gone. Each registration authority configures its own validators and all of them need to pass. Previous endpoint /sign will not work anymore. It's incompatible with the new design. The configuration file changes in the following way: 1. Registration authorities need to be defined in the main config. 2. Validator sets are not available anymore. 3. CA and auth settings at the top level need to be named. They can be referred to in the registration authority block. 4. Old names are removed. Any use of "auth", "ca", or "validators" at the top level will result in an error and explanation regarding the upgrade path. Further documentation and a sample config with the new layout can be found in the docs/configuration.rst file. Closes-bug: 1463752 Change-Id: I5a949e0c79a2d56eadadf5ece62bb8b8eea89e78
67 lines
1.4 KiB
JSON
Executable File
67 lines
1.4 KiB
JSON
Executable File
{
|
|
"auth": {
|
|
"static": {
|
|
"secret": "simplepassword",
|
|
"user": "myusername"
|
|
}
|
|
},
|
|
"ca": {
|
|
"cert_path": "CA/root-ca.crt",
|
|
"key_path": "CA/root-ca-unwrapped.key",
|
|
"output_path": "certs",
|
|
"signing_hash": "sha256",
|
|
"valid_hours": 24
|
|
},
|
|
"instances": {
|
|
"default": {
|
|
"validators": {
|
|
"common_name" : {
|
|
"allowed_domains": [
|
|
".example.com"
|
|
]
|
|
},
|
|
"alternative_names": {
|
|
"allowed_domains": [
|
|
".example.com"
|
|
]
|
|
},
|
|
"server_group": {
|
|
"group_prefixes": {
|
|
"bk": "Bock_Team",
|
|
"cs": "CS_Team",
|
|
"gl": "Glance_Team",
|
|
"mb": "MB_Team",
|
|
"nv": "Nova_Team",
|
|
"ops": "SysEng_Team",
|
|
"qu": "Neutron_Team",
|
|
"sw": "Swift_Team"
|
|
}
|
|
},
|
|
"extensions": {
|
|
"allowed_extensions": [
|
|
"keyUsage",
|
|
"subjectAltName",
|
|
"basicConstraints",
|
|
"subjectKeyIdentifier"
|
|
]
|
|
},
|
|
"key_usage": {
|
|
"allowed_usage": [
|
|
"Digital Signature",
|
|
"Key Encipherment",
|
|
"Non Repudiation"
|
|
]
|
|
},
|
|
"ca_status": {
|
|
"ca_requested": false
|
|
},
|
|
"source_cidrs": {
|
|
"cidrs": [
|
|
"127.0.0.0/8"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|