Update more PKI documentation #14490
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Alexander Scheel <[email protected]>
GET-ing these URLs will return 404 until such time as a config is posted to them, even though (in the case of CRL), default values will be used. Signed-off-by: Alexander Scheel <[email protected]>
Signed-off-by: Alexander Scheel <[email protected]>
This unifies the description of key_bits to match the API description (which is consistent across all usages). Signed-off-by: Alexander Scheel <[email protected]>
Signed-off-by: Alexander Scheel <[email protected]>
Note that this field has no impact on the actual Serial Number field and only an attribute in the requested certificate's Subject. Signed-off-by: Alexander Scheel <[email protected]>
cipherboy
force-pushed
the
cipherboy-update-more-pki-docs
branch
from
7cd50df to
34ad5c3
Compare
Signed-off-by: Alexander Scheel <[email protected]>
stevendpclark
approved these changes
Mar 15, 2022
|
Thanks Steve! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Various changes here; would definitely like feedback on if these warrant a backport to 1.10 for clarity.
serialNumber=<value>attribute into the certificate's Subject. I've clarified it in both the website docs and the path-help docs.key_bitsneeded to be more consistently documented.GET pki/config/crlandGET pki/config/urlsbeing empty when nothing is written yet.pki/config/crl/rotateshould be called when the CRL is expired or close to expiring, if no revocations have happened.fetch/path segment that no longer exists.Not addressed in this PR (and definitely not a candidate for 1.10 backport) is that
pki/intermediate/generate/:typereturns help text withttlandnot_afterfields, but these fields cannot go into the CSR and thus shouldn't be exposed. However, TTL (and notnot_after, which is inconsistent with the rest of the API) is used bygetGenerationParamsto build a role for generation (and is also used bypki/root/generate/:type). That requires some more thought to fix.