You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It is often useful to allow users to easily re-issue their certificates. The way I see it there are a couple different ways this could be implemented:
Force issuer plugins to implement a 'reissue' function
Each CA does reissue a bit differently, Symantec/Verisign has it's own logic on what it means to reissue a certificate. We could force issuer plugins to create a reissue function that would navigate the logic of that particular CA. The messy part is that CA's may require that a state or challenge be saved and then presented before a certificate will be re-issued.
Save the request data when a certificate is created
If we save this data (json) Lemur's re-issue function might be able to simply use the same data and modify the not_before, not_after values (maybe OU?) then create a new certificate using create_certificate interface. This is much easier to implement but a major drawback is that we don't know what the rules are in determining if a given certificate already exists.
The text was updated successfully, but these errors were encountered:
A third way would be to parse the certificate fields and extensions and return such that this information could then be fed back through the process (with new dates) and have a new certificate issued.
This would also allow us to edit the 'cloned' certificate if need be (e.g.) adding a new domain.
It is often useful to allow users to easily re-issue their certificates. The way I see it there are a couple different ways this could be implemented:
reissue
function that would navigate the logic of that particular CA. The messy part is that CA's may require that a state or challenge be saved and then presented before a certificate will be re-issued.create_certificate
interface. This is much easier to implement but a major drawback is that we don't know what the rules are in determining if a given certificate already exists.The text was updated successfully, but these errors were encountered: