diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-10-06 20:13:56 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2024-10-06 20:13:56 +0200 |
| commit | 875764b07f937fc599e2e62c667e7b811ddc2ed3 (patch) | |
| tree | 58815a75f483ec1ea24482cefd8f99da35402336 /src/etc/security/capability.conf | |
| parent | 17c9b444ecc7883f1d8af01fefc8d00f6f1ef49b (diff) | |
| download | vyos-1x-875764b07f937fc599e2e62c667e7b811ddc2ed3.tar.gz vyos-1x-875764b07f937fc599e2e62c667e7b811ddc2ed3.zip | |
pki: T6481: auto import ACME certificate chain into CLI
When using an ACME based certificate with VyOS we provide the necessary PEM
files opaque in the background when using the internal tools. This however will
not properly work with the CA chain portion, as the system is based on the
"pki certificate <name> acme" CLI node of a certificate but CA chains reside
under "pki ca".
This adds support for importing the PEM data of a CA chain issued via ACME into
the "pki ca AUTOCHAIN_<name> certificate" subsystem so it can be queried by
other daemons. Importing the chain only happens, when the chain was not already
added manually by the user.
ACME certificate chains that are automatically added to the CLI are all prefixed
using AUTOCHAIN_certname so they can be consumed by any daemon. This also adds
a safeguard when the intermediate CA changes, the referenced name on the CLI
stays consitent for any pending daemon updates.
Diffstat (limited to 'src/etc/security/capability.conf')
0 files changed, 0 insertions, 0 deletions