9 Commits

Author	SHA1	Message	Date
Matt Keeler	677d6dac80	Remove x509 name constraints ... These were only added as SPIFFE intends to use the in the future but currently does not mandate their usage due to patch support in common TLS implementations and some ambiguity over how to use them with URI SAN certificates. We included them because until now everything seem fine with it, however we've found the latest version of `openssl` (1.1.0h) fails to validate our certificats if its enabled. LibreSSL as installed on OS X by default doesn’t have these issues. For now it's most compatible not to have them and later we can find ways to add constraints with wider compatibility testing.	2018-06-25 12:26:10 -07:00
Kyle Havlovitz	050da22473	connect/ca: undo the interface changes and use sign-self-issued in Vault	2018-06-25 12:25:42 -07:00
Kyle Havlovitz	bc997688e3	connect/ca: update Consul provider to use new cross-sign CSR method	2018-06-25 12:25:41 -07:00
Kyle Havlovitz	1a8ac686b2	connect/ca: add the Vault CA provider	2018-06-25 12:25:41 -07:00
Paul Banks	51fc48e8a6	Sign certificates valid from 1 minute earlier to avoid failures caused by clock drift	2018-06-25 12:25:41 -07:00
Kyle Havlovitz	5683d628c4	Support giving the duration as a string in CA config	2018-06-14 09:42:22 -07:00
Paul Banks	b4803eca59	Generate CSR using real trust-domain	2018-06-14 09:42:16 -07:00
Paul Banks	c1f2025d96	Return TrustDomain from CARoots RPC	2018-06-14 09:42:15 -07:00
Kyle Havlovitz	e00088e8ee	Rename some of the CA structs/files	2018-06-14 09:42:15 -07:00