[change] Use Standalone Certificate Templates as the underlying base for VpnClient certificate management
I maintainer di solito rispondono entro 1 giorno
@stktyagi ci sta già lavorando.
Dal 30/7/2026.
Valutazione
Questa issue non è ancora stata valutata.
Descrizione
Is your feature request related to a problem? Please describe.
Currently, VpnClient handles certificate management through custom, tied-in logic (calls on save and specific signal handlers for VPN clients). With the introduction of standalone Certificate Generator Templates and the DeviceCertificate model, we now have a generalized framework for generating, binding, renewing, and revoking device certificates. Maintaining two parallel paths for certificate generation creates code duplication, increases the maintenance burden, and introduces the risk that bug fixes or performance improvements made to one won't automatically benefit the other.
Describe the solution you'd like
Refactor the VpnClient certificate lifecycle logic to build upon or reuse the newly established Standalone Certificate Generator Template infrastructure.
- Abstract Core Lifecycle Logic: Decouple the certificate creation, renewal, and revocation routines currently housed within
VpnClientarchitecture and migrate them into a shared base class or utility that bothVpnClientandDeviceCertificatecan inherit from. - Unified Signal Management & Atomicity: Standardize the signal handlers across both implementations. Ensure that the transaction atomicity introduced in the standalone templates is actively applied to
VpnClientoperations to prevent partial database writes during certificate generation. - Synchronized CRL Updates: Tie the current newly added revocation logic to
VpnClientcertificates and make it consistent and error free across bothDeviceCertificateandVpnClient. - Consistent renewal and regeneration: Implement shared methods to update and regenerate certificate details based on
VpnClientattributes updation.
Certificate integrity bugs to fix during this refactor
The current VpnClient certificate handling has concrete gaps that the DeviceCertificate architecture already avoids. These should be addressed as part of this work:
- Cascading certificate deletion: Deleting a certificate currently cascades to and silently deletes the bound
VpnClient(along with its assigned IP, keys, etc.).DeviceCertificateusesRESTRICT, so a certificate that is still bound cannot be deleted.VpnClientshould adopt the same protection. - Organization move of in-use certificates: A certificate bound to a
VpnClientcan be moved to another organization while still in use, risking cross-organization exposure of certificate and key material.DeviceCertificatelocks the organization of a bound certificate;VpnClientshould apply the same guard. - Revoked certificates still delivered: Revoked certificates (and their private keys) are still injected into the VPN client configuration context sent to devices.
DeviceCertificateexcludes revoked certificates from the configuration context;VpnClientshould do the same.
Additional context
Unifying this under the hood adheres to DRY (Don't Repeat Yourself) principles and simplifies future maintainability.
- Lingua principale
- Python
- Stelle
- 779
- Fork
- 328
- Merge medio
- 2g 19h
- PR unite (30g)
- 7
Preparare l'ambiente
- Include un Dockerfile o un file Docker Compose
- Ha un modello di pull request
- Leggi la guida per i contributori
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di openwisp/openwisp-controller
-
[fix] Recent Commands row uses "created" timestamp for the "Modified" fieldForse già presa @xovishnukosuri l’ha presa 216 giorni fa. Apertabug
Difficoltà 1/5 Meno di un'ora Idoneità per principianti 78/100
openwisp/openwisp-controller#1263 · 4 commenti ·
I maintainer di solito rispondono entro 1 giorno
-
[feature] Emit a signal when a device operating system changesForse già presa @Vara715 l’ha presa oggi. Apertaenhancement
Difficoltà 3/5 Mezza giornata Idoneità per principianti 65/100
openwisp/openwisp-controller#1506 · 4 commenti ·
I maintainer di solito rispondono entro 1 giorno
-
[feature] Add board_name field to Device model for DTB board identificationForse di nuovo libera @atif09 l’ha presa 28 giorni fa e non c’è nessuna pull request aperta. Apertaenhancement gsoc
openwisp/openwisp-controller#1491 · 2 commenti · 1 assegnatario ·
I maintainer di solito rispondono entro 1 giorno
-
[bug:gsoc26] Mass command wizards started in two browser tabs overwrite each otherForse già presa @dee077 l’ha presa 30 giorni fa. Apertabug
openwisp/openwisp-controller#1489 · 2 commenti · 1 assegnatario ·
I maintainer di solito rispondono entro 1 giorno
-
enhancement
Difficoltà 5/5 Più di una settimana Idoneità per principianti 30/100
openwisp/openwisp-controller#1484 · 1 commento ·
I maintainer di solito rispondono entro 1 giorno
Tutte le issue di openwisp/openwisp-controller
Issue simili
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 65/100
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
UKGovernmentBEIS/control-arena#917 ·
I maintainer di solito rispondono entro 1 giorno
-
Difficoltà 1/5 Meno di un'ora Idoneità per principianti 88/100
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 82/100
debpalash/VoiceStudio#2937 ·
I maintainer di solito rispondono entro 1 giorno
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
aws-samples/sample-per-model-bedrock#261 ·
I maintainer di solito rispondono entro 1 giorno