[GSoC] X.509 Certificate Generator Templates #1246
Replies: 4 comments 9 replies
-
|
The spec says the referenced certificate object is used "exclusively as a template" and is "never issued or assigned to devices |
Beta Was this translation helpful? Give feedback.
-
|
In the project description it is mentioned that
This is with reference to MAC address and uuid but currently, the |
Beta Was this translation helpful? Give feedback.
-
|
The spec says a template cert's non unique fields are copied when generating per device certs. validity_start and validity_end on BaseX509 are absolute DateTimeField values , so a template created 6 months ago with validity_end = now + 1 year would give a device cert only 6 months of validity at assignment time not 1 year. |
Beta Was this translation helpful? Give feedback.
-
|
I am interested in pursuing this project. The project idea page mentions two things:-
While tracing the execution path for existing OpenVPN clients, I noticed that unassignment actually revokes the underlying Cert object (leaving it in the database for the CRL) rather than deleting it. Which makes sense, so instead of deleting the certificate shouldnt we be leaving it in the db for the CRL. Used in @classmethod
def post_delete(cls, instance, **kwargs):
"""Receiver of ``post_delete`` signal.
Automatically deletes related certificates
and ip addresses if necessary.
"""
# only invalidates, does not regenerate the cache
# to avoid generating high load during bulk deletes
instance.vpn._invalidate_peer_cache()
# Zt network member should leave the
# network after deletion of vpn client object
if instance.vpn._is_backend_type("zerotier"):
instance.vpn._remove_zt_network_member(instance.zerotier_member_id)
try:
# For OpenVPN, the related certificates are revoked, not deleted.
# This is because if the device retains a copy of the certificate,
# it could continue using it against the OpenVPN CA.
# By revoking the certificate, it gets added to the
# Certificate Revocation List (CRL). OpenVPN can then use this
# CRL to reject the certificate, thereby ensuring its invalidation.
if instance.cert and instance.auto_cert:
instance.cert.revoke()
except ObjectDoesNotExist:
pass
try:
if instance.ip:
instance.ip.delete()
except ObjectDoesNotExist:
pass |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Official thread for this GSoC idea, ask questions and announce your interest here.
Beta Was this translation helpful? Give feedback.
All reactions