shankar0123 f2e60b93a3 feat(M11c): crypto policy enforcement — CSR validation, MaxTTL caps, key metadata ...

Enforce certificate profile crypto constraints across all 5 issuance paths
(renewal, agent CSR, EST, SCEP). ValidateCSRAgainstProfile() rejects CSRs
with key algorithm/size that don't match profile rules. MaxTTL enforcement
caps certificate validity per issuer connector (Local CA, Vault, step-ca
enforce directly; ACME/DigiCert/Sectigo pass through). Key algorithm and
size are now persisted in certificate_versions for audit compliance.

16 new tests (12 service-layer + 4 Local CA connector). Removes hardcoded
version number from GUI sidebar. Documentation updated across architecture,
features, connectors, and README.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-04-15 21:05:14 -04:00

..

issuer

feat(M11c): crypto policy enforcement — CSR validation, MaxTTL caps, key metadata

2026-04-15 21:05:14 -04:00

issuerfactory

test: comprehensive test gap closure across 24 packages

2026-04-09 23:09:40 -04:00

notifier

test: comprehensive test gap closure across 24 packages

2026-04-09 23:09:40 -04:00

target

fix: resolve 8 staticcheck lint errors in test files

2026-04-09 23:27:57 -04:00