vyos-1x.git/op-mode-definitions/pki.xml.in, branch feature/T9082-codeql-cpp

pki: T8165: Add ability to show certificate full chain in pem format

2026-06-04T23:33:41+00:00

Add op-mode command having ability to show certificate full chain in pem format as part of PKI configuration. The certificates are ordered beginning with the end entity (leaf) certificate, followed by any intermediate certificates and finally the private key if requested. This allows users to easily export a certificate along with its CA hierarchy for use in external applications, that require the full chain to be provided in a single file. One can now run the following commands: ``` show pki ca NAME pem full-chain show pki certificate NAME pem full-chain show pki certificate NAME private pem full-chain ```

pki: T8877: Add ability to show private key in pem format

2026-05-19T04:33:51+00:00

Add op-mode command having ability to show private key in pem format as part of PKI configuration. This is needed for users who want to render the certificate and its private key.

op-mode: T7560: add support for virtual tag nodes

2025-06-25T16:35:01+00:00

for cases when commands need both fixed and variable arguments

pki: T7574: add optional force argument to renew certbot-issued certificates

2025-06-23T20:45:32+00:00

Certbot renewal command in op-mode "renew certbot" only works if any of the certificates is up for renewal. There is no CLI option to forcefully renew a certificate. This is about adding a force option to the CLI and with this addition move the entire certbot renew handling to new-style op-mode commands. vyos@vyos:~$ renew certbot force - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /config/auth/letsencrypt/renewal/vyos.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Renewing an existing certificate for vyos.io - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations, all renewals succeeded: /config/auth/letsencrypt/live/vyos/fullchain.pem (success) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Hook 'post-hook' ran with output: Updating certificates in /etc/ssl/certs... 0 added, 0 removed; done. Running hooks in /etc/ca-certificates/update.d... done.

op-mode: T7459: eliminate direct use of sudo in op mode commands

2025-05-16T11:39:44+00:00

pki: T4914: Rewrite the PKI op mode in the new style

2024-10-18T12:42:59+00:00

op-mode: T6480: must call pki.py helper as root to work with ACME certificates

2024-06-14T10:36:43+00:00

This is an addition to commit 65fba1cd2 ("op-mode: T6377: must call pki.py helper as root to work with ACME certificates") which missed out the basic "show pki" command, as the XML node was deep down in the view.

op-mode: T6377: must call pki.py helper as root to work with ACME certificates

2024-05-25T19:26:42+00:00

This fixes the error: vyos@vyos:~$ show pki certificate Traceback (most recent call last): File "/usr/lib/python3/dist-packages/vyos/config.py", line 111, in config_dict_mangle_acme tmp = read_file(f'{vyos_certbot_dir}/live/{name}/cert.pem') ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/vyos/utils/file.py", line 44, in read_file raise e File "/usr/lib/python3/dist-packages/vyos/utils/file.py", line 38, in read_file with open(fname, 'r') as f: ^^^^^^^^^^^^^^^^ PermissionError: [Errno 13] Permission denied: '/config/auth/letsencrypt/live/vyos/cert.pem'

xml: T3642: improve PKI CLI help string

2024-03-14T20:17:05+00:00

pki: T6055: Cleanup unnecessary sudo, preserve env when sudo is needed

2024-02-23T12:14:12+00:00