Gecko [ 122.154.134.11 ]

Name	Size	Permission
LICENSE	71 B	-rw-r--r--
README	1.62 KB	-rw-r--r--
STATUS	7.35 KB	-rw-r--r--
api.txt	11.35 KB	-rw-r--r--
certmaster-submit.txt	817 B	-rw-r--r--
design.txt	23.52 KB	-rw-r--r--
dogtag-notes-2.txt	1.46 KB	-rw-r--r--
dogtag-notes.txt	15.28 KB	-rw-r--r--
fips.txt	549 B	-rw-r--r--
ftw.txt	5.82 KB	-rw-r--r--
getting-started.txt	9.41 KB	-rw-r--r--
gpl-3.0.txt	34.32 KB	-rw-r--r--
ipa-submit.txt	1.64 KB	-rw-r--r--
local-signer.txt	1.49 KB	-rw-r--r--
sbexample.txt	4.55 KB	-rw-r--r--
scep.txt	1.8 KB	-rw-r--r--
selinux.txt	4.44 KB	-rw-r--r--
submit.txt	7.68 KB	-rw-r--r--

Code Editor : local-signer.txt

Local Signer: Design and Implementation Notes

"One step forward from self-signed certificates."
"Still basically a toy signer."

During the run-up to 0.75, we added several entry points during which we call
per-CA code.  In addition to "ask the CA to sign this", we are:
* called to self-identity
  * currenty called at daemon startup
* called to produce a list of our root certificates
  * currenty called at daemon startup and at a midpoint between startup and
    the earliest NotValidAfter date for any known roots, iteratively
* called to produce a list of profiles we support
  * currenty called at daemon startup
* called to produce the name of the default profile
  * currenty called at daemon startup
* called to produce a list of required first-time-enrollment attributes
  * currenty called at daemon startup
* called to produce a list of required renewal attributes
  * currenty called at daemon startup

The second one, when we're called to produce a list of our root certificates,
seems to be a good time to actually bring up a local signer and, when it
becomes necessary, add a new certificate for it.

The general idea is:

if we-don't-have-a-certificate or not-valid-after-time-is-soon:
	if we-don't-have-a-private-key-of-the-right-type:
		generate-a-private-key
	generate-ca-certificate-using-private-key
	output all certificates

Since we don't pass the current set of certificates in to helpers, we either
need to start doing that (ugh, the formatting) or implement it as an internal
signer, like SelfSign.

${this.title}

Code Editor : local-signer.txt