[Feature Request] Allow loading signing config from environment variable
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
Research direction
Start at the cfssl sign command and its existing env:CA and env:CA_KEY handling. Trace how -config is loaded, then determine how the requested env:CONFIG_JSON form can supply the signing configuration without writing a file. Done means signing accepts configuration from an environment variable while preserving the existing file-based form.
Written by the indexing model from the issue text.
Description
I'm using CFSSL inside a docker container to sign leaf certificates. The container is configured with a CA, and provides a web API which uses CFSSL to sign CSRs.
The signed certificates inherit the not before/after dates from the CA. Currently this requires that the container write a config JSON file to disk on startup which contains the CA's not before/after dates.
{
"signing": {
"default": {
"not_before": "...",
"expiry": "..."
}
}
}
Which is then used in CFSSL like so:
cfssl sign -ca env:CA -ca-key env:CA_KEY -config /path/to/config.json -hostname example.com -
To improve container security I'd ideally like to run it atop a readonly filesystem, but writing the config file to disk prevents this.
Would it be possible to allow CFSSL to read the config file from an environment variable, similar to what is allowed for the -ca parameter?
cfssl sign -ca env:CA -ca-key env:CA_KEY -config env:CONFIG_JSON -hostname example.com -
Or indeed any other method of setting the configuration values without writing to disk would work.
Thanks,
Nathan
- Dominant language
- Go
- Stars
- 9.5k
- Forks
- 1.2k
- Avg merge
- 12h 48m
- Merged PRs (30d)
- 2
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from cloudflare/cfssl
-
gencrl: serial numbers that fail to parse are added to the CRL as 0 or a partial valuePossibly taken @sebxt claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
cloudflare/cfssl#1460 ·
Maintainers usually reply within 2 days
-
`Bundler.BundleFromRemote` fails for IPv6 address literalsPossibly taken @reginaldalfret claimed this 13 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
cloudflare/cfssl#1448 ·
Maintainers usually reply within 2 days
-
crl_override (and extensions) in /api/v1/sign request body are silently ignored by the HTTP APIPossibly taken @Hashim1999164 claimed this 69 days ago. Open
Difficulty 2/5 Half a day Newbie friendliness 78/100
cloudflare/cfssl#1439 ·
Maintainers usually reply within 2 days
-
gencrl silently revokes the wrong serial number when a line is not plain decimalPossibly taken @RaphaelFakhri claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 30/100
cloudflare/cfssl#1458 ·
Maintainers usually reply within 2 days
-
config: LoadConfig panics when not_after is before not_beforePossibly taken @sebxt claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 25/100
cloudflare/cfssl#1456 ·
Maintainers usually reply within 2 days
All issues in cloudflare/cfssl
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
grafana/tempo-operator#1691 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 1/5 Under an hour Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
hashicorp/terraform-mcp-server#583 ·
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
backend bug low-priority
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
lognorman20/monaco#6225 ·