mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 17:41:29 +00:00
shankar0123
a579a84c7f
Add certificate profiles as named enrollment templates that control allowed key algorithms, max TTL, permitted EKUs, required SAN patterns, and optional SPIFFE URI SANs. CSR submissions are validated against profile rules at signing time (key type + minimum size). Short-lived certs (TTL < 1 hour) auto-expire via a new scheduler loop — expiry acts as revocation, no CRL/OCSP needed. New files: - Migration 000003: certificate_profiles table, FK columns on managed_certificates/renewal_policies, key metadata on certificate_versions - domain/profile.go: CertificateProfile + KeyAlgorithmRule structs - repository/postgres/profile.go: full CRUD with JSONB marshaling - service/profile.go: ProfileService with validation + audit logging - service/crypto_validation.go: CSR-against-profile validation (RSA/ECDSA/Ed25519) - handler/profiles.go: 5 HTTP endpoints under /api/v1/profiles - web/src/pages/ProfilesPage.tsx: profiles management page Modified: - renewal.go: CSR validation in CompleteAgentCSRRenewal, ExpireShortLivedCertificates - scheduler.go: 30s short-lived expiry check loop - certificate.go (repo): nullable profile FK, key metadata on versions - main.go: profile repo/service/handler wiring, 8-param NewRenewalService - router.go: 12-param RegisterHandlers with profile routes - seed_demo.sql: 4 demo profiles (standard, mtls, short-lived, high-security) - Frontend: types, API client, routing, sidebar nav Tests: 40 new tests across handler (15), service (13), crypto validation (12) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
14 lines
565 B
SQL
14 lines
565 B
SQL
-- Rollback: remove certificate profiles and associated columns
|
|
|
|
ALTER TABLE certificate_versions DROP COLUMN IF EXISTS key_algorithm;
|
|
ALTER TABLE certificate_versions DROP COLUMN IF EXISTS key_size;
|
|
|
|
ALTER TABLE renewal_policies DROP COLUMN IF EXISTS certificate_profile_id;
|
|
|
|
DROP INDEX IF EXISTS idx_managed_certificates_profile_id;
|
|
ALTER TABLE managed_certificates DROP COLUMN IF EXISTS certificate_profile_id;
|
|
|
|
DROP INDEX IF EXISTS idx_certificate_profiles_name;
|
|
DROP INDEX IF EXISTS idx_certificate_profiles_enabled;
|
|
DROP TABLE IF EXISTS certificate_profiles;
|