Right way to create an intermediate certificate authority which is created through CLI without db connection
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 20/100
Research direction
Start by tracing the CLI commands cfssl gencert -initca, cfssl serve, and the /api/v1/cfssl/newcert endpoint, then inspect how the PostgreSQL database records certificates and supports revocation. Determine whether intermediate CAs created outside the API are supported for revocation, and document the confirmed setup or the missing behavior.
Written by the indexing model from the issue text.
Description
Hi CFSSL Team,
First of all CFSSL is a lovely piece of software. Thank you so much for building and open sourcing it.
To start an API server and let it handle signing using intermediate certificate we first need
- Create a self signed root ca using CLI cfssl gencert -initca
- Create an intermediate ca using cli which is signed by root ca
- Start api server with cfssl serve -ca and -ca-key option of the intermediate certificate along with a db config option.(I am using postgresql for my setup.)
Post which all certificates created using the api will store the cert details without private key in the postgresdb. This will enable us to call revoke on those certificates.
Since Root and IntermediateCA themselves were created using cli they were not added to the DB. What is the right way to setup so that intermediateCAs can be revoked as well in case of a breach since intermediate pem and keys are on the server and not air gapped like root ca?
One approach is
- create root ca
- start api server with root ca
- call /api/v1/cfssl/newcert api with profile of intermediate CA
- stop api server and then start apiserver with intermediate ca as -ca and -ca-key options.
Is this the correct way to do it?
- Dominant language
- Go
- Stars
- 9.5k
- Forks
- 1.2k
- Avg merge
- 12h 48m
- Merged PRs (30d)
- 2
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from cloudflare/cfssl
-
gencrl: serial numbers that fail to parse are added to the CRL as 0 or a partial valuePossibly taken @sebxt claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
cloudflare/cfssl#1460 ·
Maintainers usually reply within 2 days
-
`Bundler.BundleFromRemote` fails for IPv6 address literalsPossibly taken @reginaldalfret claimed this 14 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
cloudflare/cfssl#1448 ·
Maintainers usually reply within 2 days
-
crl_override (and extensions) in /api/v1/sign request body are silently ignored by the HTTP APIPossibly taken @Hashim1999164 claimed this 69 days ago. Open
Difficulty 2/5 Half a day Newbie friendliness 78/100
cloudflare/cfssl#1439 ·
Maintainers usually reply within 2 days
-
gencrl silently revokes the wrong serial number when a line is not plain decimalPossibly taken @RaphaelFakhri claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 30/100
cloudflare/cfssl#1458 ·
Maintainers usually reply within 2 days
-
config: LoadConfig panics when not_after is before not_beforePossibly taken @sebxt claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 25/100
cloudflare/cfssl#1456 ·
Maintainers usually reply within 2 days
All issues in cloudflare/cfssl
Similar issues
-
usage: a custom provider's balance meters ("…%" in the balance path) ignore the Left/Used switchOpen
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
bug iam-service
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
platform-mesh/platform-mesh#425 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
grafana/tempo-operator#1691 ·
Maintainers usually reply within 1 day
-
fix: presentation.go with mcp-table.go: the message for each MCP server comes backPossibly taken @mge1512 claimed this today. Openbug
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
mark3labs/kit#242 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
slavakurilyak/awesome-ai-agents#827 ·
Maintainers usually reply within 1 day