Shankar ff223e2586 feat(M11c): crypto policy enforcement — CSR validation, MaxTTL caps, key metadata ...

Enforce certificate profile crypto constraints across all 5 issuance paths
(renewal, agent CSR, EST, SCEP). ValidateCSRAgainstProfile() rejects CSRs
with key algorithm/size that don't match profile rules. MaxTTL enforcement
caps certificate validity per issuer connector (Local CA, Vault, step-ca
enforce directly; ACME/DigiCert/Sectigo pass through). Key algorithm and
size are now persisted in certificate_versions for audit compliance.

16 new tests (12 service-layer + 4 Local CA connector). Removes hardcoded
version number from GUI sidebar. Documentation updated across architecture,
features, connectors, and README.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-04-15 21:05:14 -04:00

..

agent_group.go

feat: M11b — ownership tracking, agent groups, interactive renewal approval

2026-03-20 21:02:35 -04:00

agent.go

feat: M10 — agent metadata collection, Apache httpd + HAProxy target connectors

2026-03-20 02:19:28 -04:00

audit.go

Complete V1 scaffold

2026-03-14 20:01:53 -04:00

certificate.go

feat(M11c): crypto policy enforcement — CSR validation, MaxTTL caps, key metadata

2026-04-15 21:05:14 -04:00

db.go

fix: migration runner only executes .up.sql files, skips .down.sql and seeds

2026-03-24 12:08:12 -04:00

discovery.go

fix: use repository.DiscoveryFilter in postgres implementation to satisfy interface

2026-03-24 01:05:14 -04:00

issuer.go

feat(M34): dynamic issuer configuration with encrypted config storage

2026-04-04 00:20:13 -04:00

job.go

feat(M31): agent work routing — scope jobs to assigned agents

2026-03-30 14:10:42 -04:00

network_scan.go

feat: add network certificate discovery (M21) and Prometheus metrics (M22)

2026-03-24 23:37:47 -04:00

notification.go

Implement M3: expiration threshold alerting with dedup and status transitions

2026-03-15 00:03:43 -04:00

owner.go

Complete V1 scaffold

2026-03-14 20:01:53 -04:00

policy.go

Complete V1 scaffold

2026-03-14 20:01:53 -04:00

profile.go

feat: M11a — certificate profiles, crypto policy enforcement, short-lived cert expiry

2026-03-20 20:39:49 -04:00

renewal_policy.go

Implement M3: expiration threshold alerting with dedup and status transitions

2026-03-15 00:03:43 -04:00

repo_test.go

fix(ci): restore certs variable declaration in discovery repo test

2026-03-27 23:22:00 -04:00

revocation.go

feat: M15a — certificate revocation API, CRL endpoint, and revocation notifications

2026-03-22 10:59:18 -04:00

target.go

feat(M35): dynamic target configuration with encrypted config, test connection, and GUI updates

2026-04-04 01:09:53 -04:00

team.go

Complete V1 scaffold

2026-03-14 20:01:53 -04:00

testutil_test.go

fix: resolve test compilation and runtime failures across codebase

2026-03-27 22:53:46 -04:00