8e05bcbb1b
Export CRL and Database CA in DER format ( #22578 )
...
* feat(tctl): auth export type db der
* feat(tctl): add "crl" command to export revocation lists
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com >
* chore(tctl): change command description
* Apply suggestions from code review
Co-authored-by: Marek Smoliński <marek@goteleport.com >
* feat(auth): enable role admin to call generate crl
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com >
Co-authored-by: Marek Smoliński <marek@goteleport.com >
2023-03-10 14:30:07 +00:00
42cb80c3e4
Adding in a new SAML IdP certificate authority. ( #21159 )
...
* Adding in a new SAML IdP certificate authority.
A new SAML IdP certificate authority has been added. It has been added to
initialization, the cache, and the certificate can be rotated.
* Update lib/services/authority.go
Co-authored-by: Sam Freiberg <sfreiberg@goteleport.com >
* Update api/types/trust.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com >
* Only validate private key if it's present.
---------
Co-authored-by: Sam Freiberg <sfreiberg@goteleport.com >
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com >
2023-02-03 15:56:56 +00:00
Andrew LeFevre
e71f024a9f
Add OpenSSH CA ( #20020 )
...
* WIP adding OpenSSH CA
* fix creating OpenSSH CA for tests
* fix a test name and tctl usage flag
* fix 'tctl status' not displaying openssh CA sometimes
* add OpenSSH CA to TestInit_bootstrap, remove TLS key pair
* add OpenSSH CA to a few more places
* make help text of 'tctl auth rotate' more helpful and accurate
* fix web cert export test
* tbot doesn't need to know about OpenSSH CA
* address feedback
* fix comment formatting
2023-01-13 18:23:19 +00:00
Brian Joerger
488af75797
Client store generalization ( #19420 )
...
- Add a generalized client store made up of a key, profile, and trusted certs store. Each sub store can support different backends (~/.tsh, identity_file, in-memory).
- Replace custom identity file handling with in-memory client store.
- Fix issues with trusted certs handling.
2023-01-06 01:34:04 +00:00
Marco André Dinis
8bdcd197f1
Add separation between keys when exporting CAs ( #18562 )
...
Adding a new line was sometimes not enough to separate the keys.
This was causing our tests to sometimes fail.
2022-12-05 11:11:59 +00:00
Jakub Nyckowski
0ee91f6c37
Enable GCI linter ( #17894 )
2022-10-28 20:20:28 +00:00
Marco André Dinis
e86e3960d9
Expose tctl auth export as a public endpoint ( #15491 )
...
Public endpoint that exports CA Certificates
It supports the same types that we currently support when running `tctl auth export --type=t`
Fix https://github.com/gravitational/teleport/issues/7413
Demo
```
marco@lenix ~> curl --insecure "https://127.0.0.1.nip.io:3080/v1/webapi/sites/lenix/auth/export "
@cert-authority lenix,*.lenix ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0TxkYYZ+EKHdgA09h/fK0upJzaPe8Sxr63wxPLzqJNDr8O4mxy24UZ08t5tojyaEXHwRLvqOdUBXhbpQpmrUkuN2LLS/k1ijk+V98j+6vWaviL3fDPbZw4PRRl0QtCjAFE/kxH9uLmqvMwnCpeNOQaugq1slVOibDZDrP7FcKmrTzKldk5ohSJSTl0sH6TQzQG2Sj+awXLk7LWcYvE5PN0YVh/S9kzmTpCugaIGd5LOAL3JSuQJ+pwwKmVEg+EPYcbzv7lcLgnew9weCDK0uk4PuNnMXrt1KcCEFttMrceeGnnqOr5JogFLiWL/TP+9kBgleNZhXEaXSz2r1i7pNt type=host
cert-authority ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHoDSouxSrXq/X+qZWBM8saHEIb3O3dXOfpRtGrkV6LymPpojhzN1dcYKUqYvWYMw2+WOKIyeAgg9p0zrIQaP7AQPP42sjDhB4keJMbSHh43Hnb7pITRBBpsSCGYMr1U1utQDdz1dbzp96OlvXoNL+ltZKPYNBvG7obqlqhFhHV6ReNvb7FT1OSrtC7UEElPyrYgd3+QMBTTNNYg3Lu+712ySKHqjdM6mLG8XWfSbkmLVbKRTcV3qPj6vEnarXHOnATv+AJElkIlaJjx+RmIxEA9AlE+mjxm2PR+uwsFLV+YD20oPWHaqVyKzT3x7/UNQttBTZD1G0D2fwZg2lDO29 clustername=lenix&type=user
marco@lenix ~> curl --insecure "https://127.0.0.1.nip.io:3080/v1/webapi/sites/lenix/auth/export?type=db "
-----BEGIN CERTIFICATE-----
MIIDcDCCAligAwIBAgIQUppf1u3b6mtJig/5GwAUNjANBgkqhkiG9w0BAQsFADBS
MQ4wDAYDVQQKEwVsZW5peDEOMAwGA1UEAxMFbGVuaXgxMDAuBgNVBAUTJzEwOTc5
ODI1MzIyNzkzMDM5OTA4OTE3NjQ1MzMyMDAzMDU1NzIzODAeFw0yMjA4MzAxMDA5
NThaFw0zMjA4MjcxMDA5NThaMFIxDjAMBgNVBAoTBWxlbml4MQ4wDAYDVQQDEwVs
ZW5peDEwMC4GA1UEBRMnMTA5Nzk4MjUzMjI3OTMwMzk5MDg5MTc2NDUzMzIwMDMw
NTU3MjM4MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4AyI3MnQHLjv
hko3qE1F0SqlPMKfCPaBaCHZj5yI7Gm/U6BKx+mm4zl0R7xqDjUIQo751DUVQoJh
etuHOpgJ9OyzTYG8BqqhuuGFqWy9RkPcMSup2gQInpcma+iVs6HPYeIZa4MlnYJH
nBVjRgXyiURAtdg0wlq12SNh0R0FUBAo4i6bqNLlqQkA9WJkea5RxIk337qgYo/r
pRb0QlOWaeUYsVU4yn21h1dnrZCg21iaxLDjV97dV47BYcK5yPFFSRAVVgyR74r2
SF3p6R45qH1Ll+gEwxZf7M0IFPAUbWxaZ3KPz11BE+ISKH1NN7j/Aj5rPqwAULnp
e79S94asmQIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAaYwDwYDVR0TAQH/BAUwAwEB
/zAdBgNVHQ4EFgQUOXJtvj3lcOi/epoPRO32lEHgM8wwDQYJKoZIhvcNAQELBQAD
ggEBAMe0zhNLzNNlxYWTgD5uefhP1KPb/44gmh7n1/xF3Wd11QktDraPN9cyy30R
qeMdBmwgn6Ek7Dy+E22nPSVLh49DSRPrXATgRetNW4g4iMvQKnZi8k7agnXedxWq
irLUsFApAagKwFNJyQQsGpdUxUgZiK43JaZ/dAHGvXYEJA4BYepIQRtEdraa/T5h
M9HDWVHEuPCjMH8/10wTWjDiikVHPCwAAab6/r7WJ7Jn+Bv4PBOxYOwHeuboBNgl
khF9lGAqonSP6kx3gLSApLW5S3QX0U+4qukmIE970evwIAzc43hwaNaI8gM9nswE
dpX8vd+vaed76+ZzxQmBlh4hgQU=
-----END CERTIFICATE-----
marco@lenix ~>
```
2022-10-27 14:53:29 +00:00
