gsadmin/ziti
1
0
Fork 0
mirror of https://github.com/openziti/ziti.git synced 2026-10-12 15:28:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

remove 1.0.5 identity info

Browse Source
This commit is contained in:
Andrew Martinez
2022-07-14 15:27:47 -04:00
parent 636eca05d6
commit ee7ed76e8f
1 changed files with 2 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+2 -78
View File
@@ -4,86 +4,10 @@ There was a missed dependency update for xweb in 0.26.0 that kept SNI from worki
affect SNI support for all REST APIs.
## What's New
- All
- Identity `alt_server_certs`
- Fixes missing identity update in xweb
- Edge
- N/A
- Fixes missing identity update in xweb
- Fabric
- N/A
- Ziti CLI
- N/A
- SDK Golang
- N/a
## All
### Identity `alt_server_certs`
The [identity library](https://github.com/openziti/identity) has been updated to support a new field: `alt_server_certs`
. This field is an array of objects with `server_cert` and `server_key` fields. `alt_server_certs` is not touched by
higher level Ziti automations to renew certificates and is intended for manual or externally automated use. It allows
additional server certificates to be used for the controller and routers with separate private keys. It is useful in
scenarios where routers or controllers are exposed using certificates signed by public CAs (i.e. Let's Encrypt).
The `server_cert` and `server_key` work the same as the root identity properties of the same name. In any single
`server_cert` source that provides a chain, it assumed that all leaf-certificates are based on the private key in
`server_key`. If `server_key` is not defined, the default root `server_key` will be used. The identity library will use
the certificate chains and private key pairs specified in `alt_server_certs` when generating a TLS configuration via
`ServerTLSConfig()`. All identity sources are viable: `pem`, `file`, etc.
Go Identity Config Struct Definition:
```go
type Config struct {
Key string `json:"key" yaml:"key" mapstructure:"key"`
Cert string `json:"cert" yaml:"cert" mapstructure:"cert"`
ServerCert string `json:"server_cert,omitempty" yaml:"server_cert,omitempty" mapstructure:"server_cert,omitempty"`
ServerKey string `json:"server_key,omitempty" yaml:"server_key,omitempty" mapstructure:"server_key,omitempty"`
AltServerCerts []ServerPair `json:"alt_server_certs,omitempty" yaml:"alt_server_certs,omitempty" mapstructure:"alt_server_certs,omitempty"`
CA string `json:"ca,omitempty" yaml:"ca,omitempty" mapstructure:"ca"`
}
type ServerPair struct {
ServerCert string `json:"server_cert,omitempty" yaml:"server_cert,omitempty" mapstructure:"server_cert,omitempty"`
ServerKey string `json:"server_key,omitempty" yaml:"server_key,omitempty" mapstructure:"server_key,omitempty"`
}
```
JSON Example:
```json
{
"cert": "./ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem",
"key": "./ziti/etc/ca/intermediate/private/ctrl.key.pem",
"server_cert": "./ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem",
"server_key": "./ziti/etc/ca/intermediate/certs/ctrl-server.key.pem",
"ca": "./ziti/etc/ca/intermediate/certs/ca-chain.cert.pem",
"alt_server_certs": [
{
"server_cert": "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.cert.pem",
"server_key": "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.key.pem"
},
{
"server_cert": "pem:-----BEGIN CERTIFICATE-----\nIIGBjCCA+6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVT...",
"server_key": "pem:-----BEGIN CERTIFICATE-----\nMIIEuDCCAqCgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVT..."
}
]
}
```
YAML Example:
```yaml
cert: "./ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem"
key: "./ziti/etc/ca/intermediate/private/ctrl.key.pem"
server_cert: "./ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem"
server_key: "./ziti/etc/ca/intermediate/certs/ctrl-server.key.pem"
ca: "./ziti/etc/ca/intermediate/certs/ca-chain.cert.pem"
alt_server_certs:
- server_cert: "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.cert.pem"
server_key: "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.key.pem"
- server_cert: "pem:-----BEGIN CERTIFICATE-----\nIIGBjCCA+6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVT..."
server_key: "pem:-----BEGIN CERTIFICATE-----\nMIIEuDCCAqCgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVT..."
```
- Fixes missing identity update in xweb
# Release 0.26.0