From ee7ed76e8f79535ed32b655e2e1564b108cb993e Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Thu, 14 Jul 2022 15:27:47 -0400 Subject: [PATCH] remove 1.0.5 identity info --- CHANGELOG.md | 80 ++-------------------------------------------------- 1 file changed, 2 insertions(+), 78 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0a69ee5bc..a7ebe51e9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,86 +4,10 @@ There was a missed dependency update for xweb in 0.26.0 that kept SNI from worki affect SNI support for all REST APIs. ## What's New -- All - - Identity `alt_server_certs` - - Fixes missing identity update in xweb - Edge - - N/A + - Fixes missing identity update in xweb - Fabric - - N/A -- Ziti CLI - - N/A -- SDK Golang - - N/a - -## All -### Identity `alt_server_certs` - -The [identity library](https://github.com/openziti/identity) has been updated to support a new field: `alt_server_certs` -. This field is an array of objects with `server_cert` and `server_key` fields. `alt_server_certs` is not touched by -higher level Ziti automations to renew certificates and is intended for manual or externally automated use. It allows -additional server certificates to be used for the controller and routers with separate private keys. It is useful in -scenarios where routers or controllers are exposed using certificates signed by public CAs (i.e. Let's Encrypt). - -The `server_cert` and `server_key` work the same as the root identity properties of the same name. In any single -`server_cert` source that provides a chain, it assumed that all leaf-certificates are based on the private key in -`server_key`. If `server_key` is not defined, the default root `server_key` will be used. The identity library will use -the certificate chains and private key pairs specified in `alt_server_certs` when generating a TLS configuration via -`ServerTLSConfig()`. All identity sources are viable: `pem`, `file`, etc. - -Go Identity Config Struct Definition: -```go -type Config struct { - Key string `json:"key" yaml:"key" mapstructure:"key"` - Cert string `json:"cert" yaml:"cert" mapstructure:"cert"` - ServerCert string `json:"server_cert,omitempty" yaml:"server_cert,omitempty" mapstructure:"server_cert,omitempty"` - ServerKey string `json:"server_key,omitempty" yaml:"server_key,omitempty" mapstructure:"server_key,omitempty"` - AltServerCerts []ServerPair `json:"alt_server_certs,omitempty" yaml:"alt_server_certs,omitempty" mapstructure:"alt_server_certs,omitempty"` - CA string `json:"ca,omitempty" yaml:"ca,omitempty" mapstructure:"ca"` -} - -type ServerPair struct { - ServerCert string `json:"server_cert,omitempty" yaml:"server_cert,omitempty" mapstructure:"server_cert,omitempty"` - ServerKey string `json:"server_key,omitempty" yaml:"server_key,omitempty" mapstructure:"server_key,omitempty"` -} -``` - -JSON Example: - -```json -{ - "cert": "./ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem", - "key": "./ziti/etc/ca/intermediate/private/ctrl.key.pem", - "server_cert": "./ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem", - "server_key": "./ziti/etc/ca/intermediate/certs/ctrl-server.key.pem", - "ca": "./ziti/etc/ca/intermediate/certs/ca-chain.cert.pem", - "alt_server_certs": [ - { - "server_cert": "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.cert.pem", - "server_key": "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.key.pem" - }, - { - "server_cert": "pem:-----BEGIN CERTIFICATE-----\nIIGBjCCA+6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVT...", - "server_key": "pem:-----BEGIN CERTIFICATE-----\nMIIEuDCCAqCgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVT..." - } - ] -} -``` - -YAML Example: - -```yaml -cert: "./ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem" -key: "./ziti/etc/ca/intermediate/private/ctrl.key.pem" -server_cert: "./ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem" -server_key: "./ziti/etc/ca/intermediate/certs/ctrl-server.key.pem" -ca: "./ziti/etc/ca/intermediate/certs/ca-chain.cert.pem" -alt_server_certs: - - server_cert: "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.cert.pem" - server_key: "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.key.pem" - - server_cert: "pem:-----BEGIN CERTIFICATE-----\nIIGBjCCA+6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVT..." - server_key: "pem:-----BEGIN CERTIFICATE-----\nMIIEuDCCAqCgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVT..." -``` + - Fixes missing identity update in xweb # Release 0.26.0