diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-10-06 20:13:56 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2024-10-06 20:13:56 +0200 |
| commit | 875764b07f937fc599e2e62c667e7b811ddc2ed3 (patch) | |
| tree | 58815a75f483ec1ea24482cefd8f99da35402336 /src/op_mode | |
| parent | 17c9b444ecc7883f1d8af01fefc8d00f6f1ef49b (diff) | |
| download | vyos-1x-875764b07f937fc599e2e62c667e7b811ddc2ed3.tar.gz vyos-1x-875764b07f937fc599e2e62c667e7b811ddc2ed3.zip | |
pki: T6481: auto import ACME certificate chain into CLI
When using an ACME based certificate with VyOS we provide the necessary PEM
files opaque in the background when using the internal tools. This however will
not properly work with the CA chain portion, as the system is based on the
"pki certificate <name> acme" CLI node of a certificate but CA chains reside
under "pki ca".
This adds support for importing the PEM data of a CA chain issued via ACME into
the "pki ca AUTOCHAIN_<name> certificate" subsystem so it can be queried by
other daemons. Importing the chain only happens, when the chain was not already
added manually by the user.
ACME certificate chains that are automatically added to the CLI are all prefixed
using AUTOCHAIN_certname so they can be consumed by any daemon. This also adds
a safeguard when the intermediate CA changes, the referenced name on the CLI
stays consitent for any pending daemon updates.
Diffstat (limited to 'src/op_mode')
| -rwxr-xr-x | src/op_mode/pki.py | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py index ab613e5c4..5652a5d74 100755 --- a/src/op_mode/pki.py +++ b/src/op_mode/pki.py @@ -26,13 +26,22 @@ from cryptography.x509.oid import ExtendedKeyUsageOID from vyos.config import Config from vyos.config import config_dict_mangle_acme -from vyos.pki import encode_certificate, encode_public_key, encode_private_key, encode_dh_parameters +from vyos.pki import encode_certificate +from vyos.pki import encode_public_key +from vyos.pki import encode_private_key +from vyos.pki import encode_dh_parameters from vyos.pki import get_certificate_fingerprint -from vyos.pki import create_certificate, create_certificate_request, create_certificate_revocation_list +from vyos.pki import create_certificate +from vyos.pki import create_certificate_request +from vyos.pki import create_certificate_revocation_list from vyos.pki import create_private_key from vyos.pki import create_dh_parameters -from vyos.pki import load_certificate, load_certificate_request, load_private_key -from vyos.pki import load_crl, load_dh_parameters, load_public_key +from vyos.pki import load_certificate +from vyos.pki import load_certificate_request +from vyos.pki import load_private_key +from vyos.pki import load_crl +from vyos.pki import load_dh_parameters +from vyos.pki import load_public_key from vyos.pki import verify_certificate from vyos.utils.io import ask_input from vyos.utils.io import ask_yes_no |