Remove 47 stale //nolint:gosec directives that are no longer needed
after gosec rule changes (nolintlint flagged them as unused). Add
//nolint:gosec annotations for 5 new findings: G117 on config struct
marshaling (password fields by design), G115 on intentional uint->byte
truncation in SCEP OID encoding, and G704 SSRF taint on the
user-configured CA HTTP client.
Co-authored-by: Claude <noreply@anthropic.com>
This commit adds the AWS auth method for Vault RA mode following similar
pattern in the existing approle and kubernetes methods.
This auth method supports both iam and ec2 auth type, see
https://developer.hashicorp.com/vault/docs/auth/aws for more info.
Implements #1946
When the RA mode with StepCAS is used, let the CA decide which lifetime
the RA should get instead of requiring always 24h.
This commit also fixes linter warnings.
Related to #1094
It supports renewing X.509 certificates when an RA is configured with stepcas.
This will only work when the renewal uses a token, and it won't work with mTLS.
The audience cannot be properly verified when an RA is used, to avoid this we
will get from the database if an RA was used to issue the initial certificate
and we will accept the renew token.
Fixes#1021 for stepcas
This commit adds some changes to PR #731, some of them are:
- Add distribution point to the CRL
- Properly stop the goroutine that generates the CRLs
- CRL config validation
- Remove expired certificates from the CRL
- Require enable set to true to generate a CRL
This last point is the principal change in behaviour from the previous
implementation. The CRL will not be generated if it's not enabled, and
if it is enabled it will always be regenerated at some point, not only
if there is a revocation.
When the root certificate has an EC key and he intermediate has an
RSA key, the signature algorithm of the leafs should be the default
one, SHA256WithRSA, instead of the one that the intermediate has.
Fixes#1033
