pkictl

pkictl copied to clipboard

Move all configuration file in a subdirectory

1

This PR might be a bit complicated to accept as it change defaults paths for configuration and certificates. It would probably break compatibility with previous versions, even if it is...

mrjk

This allow to load a configuration file, after environment variable.

mrjk

This would allow a better system/OS integration, and make easier to maintain more than one PKI.

mrjk

It would be useful as I want to use this nifty tool with Ansible :)

mrjk

Use openssl random serial for certs

2

OpenSSL provides a secure built-in way of generating random serials for certificates, which avoids possible conflicts.

ruimarinho

Hello Brian, I have researched tools to use for our internal PKI and quite like pkictl. However I have noticed a problem. In https://github.com/brianclements/pkictl/blob/6d1e76ffa893b61f33107641c8d04017a26a65f3/myorg.local-node.tls.sub.root.ee.conf#L4 you specify a SAN. Doing it...

holmboe

For consistency with openssl's own random serial generator, the seed serial number for the crl database should also be a random.

ruimarinho

I did not have time to explore testing much further, so they are still a bit rough.

ruimarinho

Add env var to override default_days

1

This is interesting so that you can have a root CA signing certificates valid for a certain validity (e.g. `default_days = 5478` (~15 years) which would work for intermediate CAs,...

ruimarinho

Right now it's hardwired to split a file ending in "intermediates.pem." This is fine in most cases for new imports that have different files names. But in situations where you...

clemtibs