crypt/step-ca
1
0
Fork 0
mirror of synced 2026-10-24 12:59:18 +03:00
Code Activity
5,735 Commits 50 Branches 245 Tags
est
Commit Graph

5735 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Herman Slatman
6c4515dfff Serve EST endpoints on /.well-known/{label}/est 
The EST RFC describes that EST is always served on a well known path:

  `https://host:port/.well-known/est`

It also supports paths that contain a label, supporting multiple
authorities:

  `https://host:port/.well-known/some-label/est`

Clients may be forming the URL to use based on just the base host
URL, and may or may not support using a label. We'll thus have to
keep that into account when serving EST.

The fact that the label comes after `.well-known` is not great, as
the label is then not namespaced. Anything else that we may want to
serve there could now be pointing to an EST provisioner too.

We currently don't know if EST clients support `/.well-known` to not
sit at the root, or whether they support suffix path parts and/or
query parameters. For now this is the conservative choice.
 2026-09-03 19:35:20 +02:00
Herman Slatman
2d22b8f7aa Cleanup EST authority and provisioner configuration 
This removes some functionality that is not used with EST, simplifying
the configuration and validation of the authority and EST provisioner.

It stubs out some parts too, so that the code compiles again, albeit
with a non-complete EST implementation.
 2026-09-03 19:35:20 +02:00
Jean-Baptiste Pin
1a06dbc94e fix: build 2026-09-03 19:35:20 +02:00
Jean-Baptiste Pin
187599fb1e fix: EST accept proxy certificate as valid authz 2026-09-03 19:35:19 +02:00
Jean-Baptiste Pin
f3b4078b54 remove log 2026-09-03 19:35:19 +02:00
Jean-Baptiste Pin
1587afce96 add support for tls client certificate forwarded by proxy 2026-09-03 19:35:19 +02:00
Jean-Baptiste Pin
b496d2fa55 Add support for Bearer token and Authentication header in webhook requests 
Clean up code implementation
 2026-09-03 19:35:19 +02:00
Jean-Baptiste Pin
fa55ba7302 refactor EST auth and add support for signOpts 2026-09-03 19:35:19 +02:00
Jean-Baptiste Pin
955a9c52e5 add linkedca support for EST 
need for db migration and authority startup

use replace in go.mod to use a linkedca version compatible (need for the build)
 2026-09-03 19:35:17 +02:00
Jean-Baptiste Pin
7804f0b93b add EST provisioner 
Implementation of [RFC 7030] (https://datatracker.ietf.org/doc/html/rfc7030).
Support TLS client certificate authentication and basic auth.   Support webhook for authentication, notification and data.
Not covered :
* full CMC
* server-side key generation
 2026-09-03 19:34:55 +02:00
step-ci
bb481fbf67 Merge pull request #2781 from smallstep/dependabot/go_modules/github.com/go-chi/chi/v5-5.3.2 
build(deps): bump github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2
 2026-09-02 06:21:09 -05:00
dependabot[bot]
3b56548462 build(deps): bump github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2 
Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.3.1 to 5.3.2.
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](https://github.com/go-chi/chi/compare/v5.3.1...v5.3.2)

---
updated-dependencies:
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-02 11:06:51 +00:00
step-ci
c401ad9387 Merge pull request #2780 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.89.0 
build(deps): bump go.step.sm/crypto from 0.87.0 to 0.89.0
 2026-09-02 06:01:36 -05:00
dependabot[bot]
1ab72a4f4b build(deps): bump go.step.sm/crypto from 0.87.0 to 0.89.0 
Bumps [go.step.sm/crypto](https://github.com/smallstep/crypto) from 0.87.0 to 0.89.0.
- [Release notes](https://github.com/smallstep/crypto/releases)
- [Commits](https://github.com/smallstep/crypto/compare/v0.87.0...v0.89.0)

---
updated-dependencies:
- dependency-name: go.step.sm/crypto
  dependency-version: 0.89.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-02 10:53:30 +00:00
step-ci
0bbcd8ac66 Merge pull request #2779 from smallstep/dependabot/go_modules/google.golang.org/protobuf-1.36.12 
build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12
 2026-09-02 05:52:04 -05:00
step-ci
7915c531cf Merge pull request #2778 from smallstep/dependabot/go_modules/github.com/sirupsen/logrus-1.10.2 
build(deps): bump github.com/sirupsen/logrus from 1.10.0 to 1.10.2
 2026-09-02 05:51:23 -05:00
Mariano Cano
07284b3c79 Merge pull request #2784 from smallstep/mariano/panic 
Fix panic when ssh certificate is nil due to an error
 2026-09-01 13:39:36 -07:00
Mariano Cano
4cc5c5356a Fix panic when ssh certificate is nil due to an error 2026-09-01 13:32:47 -07:00
dependabot[bot]
c1e5821df4 build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 
Bumps google.golang.org/protobuf from 1.36.11 to 1.36.12.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-31 15:32:50 +00:00
dependabot[bot]
be9bb668c6 build(deps): bump github.com/sirupsen/logrus from 1.10.0 to 1.10.2 
Bumps [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) from 1.10.0 to 1.10.2.
- [Release notes](https://github.com/sirupsen/logrus/releases)
- [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sirupsen/logrus/compare/v1.10.0...v1.10.2)

---
updated-dependencies:
- dependency-name: github.com/sirupsen/logrus
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-31 15:32:48 +00:00
Herman Slatman
3f006a5d32 Merge pull request #2768 from smallstep/herman/acme-android-format-enabled-check 
Use `IsAttestationFormatEnabled` to check `android-key` format
 2026-08-24 23:12:39 +02:00
step-ci
38bdf087f4 Merge pull request #2771 from smallstep/dependabot/go_modules/github.com/fxamacker/cbor/v2-2.9.3 
build(deps): bump github.com/fxamacker/cbor/v2 from 2.9.2 to 2.9.3
 2026-08-24 15:20:22 -05:00
Mariano Cano
c58f4b21dd Merge branch 'master' into dependabot/go_modules/github.com/fxamacker/cbor/v2-2.9.3 2026-08-24 13:20:14 -07:00
step-ci
9d3b1456b1 Merge pull request #2772 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.83.1 
build(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1
 2026-08-24 15:18:38 -05:00
Mariano Cano
4e32549e40 Merge branch 'master' into dependabot/go_modules/google.golang.org/grpc-1.83.1 2026-08-24 13:18:19 -07:00
step-ci
2780b76379 Merge pull request #2773 from smallstep/dependabot/go_modules/cloud.google.com/go/security-1.27.0 
build(deps): bump cloud.google.com/go/security from 1.26.0 to 1.27.0
 2026-08-24 15:16:54 -05:00
dependabot[bot]
470b6959f8 build(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.0 to 1.83.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.83.0...v1.83.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-24 20:05:34 +00:00
Mariano Cano
bdcc57edfe Merge branch 'master' into dependabot/go_modules/cloud.google.com/go/security-1.27.0 2026-08-24 13:03:31 -07:00
step-ci
ad75a34cdc Merge pull request #2774 from smallstep/dependabot/go_modules/github.com/stretchr/testify-1.12.1 
build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1
 2026-08-24 15:03:11 -05:00
Mariano Cano
3d8e039692 Merge branch 'master' into dependabot/go_modules/github.com/stretchr/testify-1.12.1 2026-08-24 13:03:04 -07:00
Mariano Cano
923e8b3e6c Merge pull request #2775 from smallstep/mariano/deprecated 
Remove deprecated tls.Config and net.Dialer properties
 2026-08-24 13:01:59 -07:00
Mariano Cano
c480a31833 Remove deprecated tls.Config and net.Dialer properties 
Remove the deprecated PreferServerCipherSuites and DualStack properties
to fix linter errors. They do not have any effect on newer versions of Go.
 2026-08-24 12:52:50 -07:00
dependabot[bot]
6d428cad1b build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.12.0 to 1.12.1.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-24 15:33:05 +00:00
dependabot[bot]
3e56667352 build(deps): bump cloud.google.com/go/security from 1.26.0 to 1.27.0 
Bumps [cloud.google.com/go/security](https://github.com/googleapis/google-cloud-go) from 1.26.0 to 1.27.0.
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md)
- [Commits](https://github.com/googleapis/google-cloud-go/compare/kms/v1.26.0...kms/v1.27.0)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/security
  dependency-version: 1.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-24 15:33:01 +00:00
dependabot[bot]
f745424cf9 build(deps): bump github.com/fxamacker/cbor/v2 from 2.9.2 to 2.9.3 
Bumps [github.com/fxamacker/cbor/v2](https://github.com/fxamacker/cbor) from 2.9.2 to 2.9.3.
- [Release notes](https://github.com/fxamacker/cbor/releases)
- [Commits](https://github.com/fxamacker/cbor/compare/v2.9.2...v2.9.3)

---
updated-dependencies:
- dependency-name: github.com/fxamacker/cbor/v2
  dependency-version: 2.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-24 15:32:43 +00:00
Herman Slatman
d04da87b3f Use IsAttestationFormatEnabled to check android-key format 2026-08-17 22:45:25 +02:00
step-ci
1c44aeca5f Merge pull request #2765 from smallstep/dependabot/go_modules/golang.org/x/net-0.58.0 
build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0
 2026-08-17 14:28:27 -05:00
dependabot[bot]
28e8558f3b build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.57.0 to 0.58.0.
- [Commits](https://github.com/golang/net/compare/v0.57.0...v0.58.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-17 18:37:27 +00:00
step-ci
4959af38d5 Merge pull request #2766 from smallstep/dependabot/go_modules/github.com/sirupsen/logrus-1.10.0 
build(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0
 2026-08-17 12:04:09 -05:00
step-ci
e99f43d709 Merge pull request #2764 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.55.0 
build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0
 2026-08-17 12:02:48 -05:00
step-ci
6c4f87559f Merge pull request #2767 from smallstep/dependabot/go_modules/github.com/stretchr/testify-1.12.0 
build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0
 2026-08-17 12:02:15 -05:00
dependabot[bot]
785234039a build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.11.1 to 1.12.0.
- [Commits](https://github.com/stretchr/testify/compare/v1.11.1...v1.12.0)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-17 15:33:30 +00:00
dependabot[bot]
228d6bbe01 build(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 
Bumps [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) from 1.9.4 to 1.10.0.
- [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sirupsen/logrus/compare/v1.9.4...v1.10.0)

---
updated-dependencies:
- dependency-name: github.com/sirupsen/logrus
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-17 15:33:11 +00:00
dependabot[bot]
2b827f35a9 build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.54.0 to 0.55.0.
- [Commits](https://github.com/golang/crypto/compare/v0.54.0...v0.55.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-17 15:32:51 +00:00
step-ci
6669f8ff39 Merge pull request #2761 from smallstep/dependabot/go_modules/google.golang.org/api-0.292.0 
build(deps): bump google.golang.org/api from 0.291.0 to 0.292.0
 2026-08-12 04:40:45 -05:00
dependabot[bot]
0b6b5c8052 build(deps): bump google.golang.org/api from 0.291.0 to 0.292.0 
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.291.0 to 0.292.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.291.0...v0.292.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-version: 0.292.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 23:08:49 +00:00
step-ci
a3aa8a1fec Merge pull request #2759 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.83.0 
build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0
 2026-08-11 18:07:34 -05:00
step-ci
18dd915ca0 Merge pull request #2757 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.87.0 
build(deps): bump go.step.sm/crypto from 0.85.0 to 0.87.0
 2026-08-11 18:07:13 -05:00
step-ci
96d749f99c Merge pull request #2758 from smallstep/dependabot/go_modules/github.com/smallstep/pkcs7-0.2.3 
build(deps): bump github.com/smallstep/pkcs7 from 0.2.2 to 0.2.3
 2026-08-11 18:06:52 -05:00
dependabot[bot]
9173bfc5e9 build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.82.1...v1.83.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 15:33:18 +00:00