Add support for certificate links #29
Conversation
|
In review, will need a bit of time since it modified the 'get_key_pair' function that is used in many places. |
|
@mennodegraaf I have a question, why is both the chain and certificate, required (when returned from the 'get_key_pair') result? Because the full chain can be found in either the root CA or the LeafCA, it is certain that the full chain is retrieved when we request both. Plus if we modify the interface (get_key_pair) we need also to change in everest core not to break the compatibility. |
|
@mennodegraaf another modification was made, the get_key_pair function return had it's members renamed so that it doesn't break compatibility with existing function usage. Except that, as long as the new symlinks don't break any compatibility with existing code, I'd consider it good to do. |
Signed-off-by: Menno de Graaf <[email protected]>
Separated single leaf and full chain in get_key_pair() to achieve that Signed-off-by: Menno de Graaf <[email protected]>
Signed-off-by: Menno de Graaf <[email protected]>
Signed-off-by: Menno de Graaf <[email protected]>
Signed-off-by: AssemblyJohn <[email protected]>
…ficate Signed-off-by: AssemblyJohn <[email protected]>
mennodegraaf
force-pushed
the
mg-certificate-links
branch
from
a0b0ace to
90af7a4
Compare
| @@ -116,8 +116,8 @@ struct OCSPRequestDataList { | |||
| }; | |||
| struct KeyPair { | |||
| fs::path key; ///< The path of the PEM or DER encoded private key | |||
| fs::path certificate; ///< The path of the PEM or DER encoded certificate | |||
| fs::path chain; ///< The path of the PEM or DER encoded certificate chain | |||
| fs::path certificate; ///< The path of the PEM or DER encoded certificate chain | |||
There was a problem hiding this comment.
Perhaps this can be renamed to certificate_chain to more clearly distinguish between certificate_single. This has the advantage that you will have to go through all code where certificate was used before, where you can verify that the chain is indeed really desired there.
There was a problem hiding this comment.
Being part of the public API, I am unsure where it might be used (maybe in non-public repos), so while I do agree with you from the clarity of the code, I would incline to keep it as-is.
Signed-off-by: Menno de Graaf <[email protected]>
get_key_pairto return both single leaf and chain (if found)