68fd1556b2
Black lint all the things
2019-05-16 07:57:02 -07:00
f6afcc6d21
Merge branch 'master' into master
2019-04-17 10:28:46 -07:00
58dd424de8
Prevent potential NoneType not subscriptable
...
Fix when data['extensions']['subAltNames']['names'] is none
2019-04-17 18:33:52 +02:00
770729a72e
Allow csr to be empty during upload
2019-04-13 01:17:12 +02:00
406753fcde
Fix PEP8
2019-04-13 00:49:35 +02:00
c1b02cc8a5
Allow uploading csr along with certificates
2019-04-13 00:48:19 +02:00
d80a6bb405
Added tests for CSR parsing into CertificateInputSchema
2019-04-01 08:44:40 +02:00
b86e381e20
Parse SubjectAlternativeNames from CSR into Lemur Certificate
2019-03-27 13:46:33 +01:00
4018c68d49
Merge branch 'master' into authority_validation_LE_errors
2019-03-25 08:34:10 -07:00
c2158ff8fb
Add order URI during LE cert creation failure; Fail properly when invalid CA passed; Update reqs
2019-03-25 08:28:23 -07:00
9e5496b484
Update schemas.py
2019-03-15 10:19:25 +01:00
f7452e8379
Parse DNSNames from CSR into Lemur Certificate
2019-03-15 09:29:23 +01:00
10cec063c2
Check that stored certificate chain matches certificate
...
Similar to how the private key is checked.
2019-03-04 17:10:59 +02:00
4b893ab5b4
Expose full certificate RFC 4514 Distinguished Name string
...
Using rfc4514_string() method added in cryptography version 2.5.
2019-01-23 10:03:40 +02:00
542e953919
Check that stored private keys match certificates
...
This is done in two places:
* Certificate import validator -- throws validation errors.
* Certificate model constructor -- to ensure integrity of Lemur's data
even when issuer plugins or other code paths have bugs.
2018-12-31 16:28:20 +02:00
75069cd52a
Add CSR to certificiates
...
Add csr column to certificates field, as pending certificates have
exposed the CSR already. This is required as generating CSR from
existing certificate is will not include SANs due to OpenSSL bug:
https://github.com/openssl/openssl/issues/6481
Change-Id: I9ea86c4f87067ee6d791d77dc1cce8f469cb2a22
2018-10-23 17:46:04 -07:00
cc18a68c00
Lemur LetsEncrypt Polling Support
2018-10-11 22:01:05 -07:00
7d42e4ce67
Fix certificate import issues
2018-09-10 10:34:47 -07:00
1ad61b1550
allow null validity periods
2018-08-17 07:57:55 -07:00
bb026b8b59
Allow LetsEncrypt renewals and requesting certificates without specifying DNS provider
2018-08-13 14:22:59 -07:00
7f3454128d
Adds an optional interval variable to notification service's
...
create_default_expiration_notifications and introduces a new optional
configuration variable, LEMUR_SECURITY_TEAM_EMAIL_INTERVALS, to allow admins
control over the centralized email notification defaults.
2018-07-13 14:08:31 -07:00
50846eb682
Expose certificate dateCreated via API
2018-07-02 18:24:18 +03:00
544a02ca3f
Addressing comments. Updating copyrights. Added function to determine authorative name server
2018-05-29 10:23:01 -07:00
a9b9b27a0b
fix tests
2018-05-10 12:58:04 -07:00
52e7ff9919
Allow specification of dns provider name only
2018-05-10 12:58:04 -07:00
6500559f8e
Fix issue with automatically renewing acme certificates
2018-05-08 14:54:10 -07:00
e68b3d2cbd
0.7 release
2018-05-07 09:58:24 -07:00
1be3f8368f
dyn support
2018-05-04 15:01:01 -07:00
3e64dd4653
Additional work
2018-05-04 15:01:01 -07:00
7704f51441
Working acme flow. Pending DNS providers UI
2018-04-24 09:38:57 -07:00
44e3b33aaa
More stuff. Will prioritize this more next week
2018-04-20 14:49:54 -07:00
18c64fafe4
address comment
2018-02-27 12:34:18 -08:00
77a1600c13
Fix cloned notifications
2018-02-27 10:57:43 -08:00
bb08b1e637
Initial work allowing certificates to be revoked. ( #941 )
...
* Initial work allowing for certificates to be revoked.
2017-09-28 18:27:56 -07:00
54ff4cddbf
Disallow issuing certificates from inactive authority ( #936 )
2017-09-25 15:34:49 -07:00
97d83890e0
Various minor cleanups and fixes ( #938 )
...
* Documentation fixes
* Various docstring and help string fixes
* Minor code cleanups
* Removed redundant .gitignore entry, ignored package-lock.json.
* 'return' statement in certificates.service.render was redundant
* Split up too long line
* Non-matching tags in templates
2017-09-25 15:33:42 -07:00
7762d6ed52
Reworked sensitive domain name and restriction logic ( #878 )
...
* This is a fix for a potential security issue; the old code had edge
cases with unexpected behavior.
* LEMUR_RESTRICTED_DOMAINS is no more, instead LEMUR_WHITELISTED_DOMAINS
is a list of *allowed* domain name patterns. Per discussion in PR #600
* Domain restrictions are now checked everywhere: in domain name-like
CN (common name) values and SAN DNSNames, including raw CSR requests.
* Common name values that contain a space are exempt, since they cannot
be valid domain names.
2017-08-16 19:24:49 -07:00
443eb43d1f
Adding the ability to specify a per-certificate rotation policy. ( #851 )
2017-07-12 16:46:11 -07:00
5a4806bc43
Allowing description to be optional. ( #826 )
2017-06-01 17:09:04 -07:00
ce5a45037a
Fix for status representation in the view ( #778 )
2017-05-05 11:04:40 -07:00
9c9ca37586
Enabling hex serial numbers without breaking backward compatibility. ( #779 )
...
* Enabling hex serial numbers without breaking backward compatibility.
* Fixing tests.
2017-05-05 11:04:09 -07:00
05f4ae8e58
Hexify cert serial ( #763 )
...
* Hexify serial at the serialization layer
* Fix for flakey test. Change test to test for uppercased string
2017-04-27 09:13:04 -07:00
fc957b63ff
Source syncing tweaks. ( #705 )
...
* Allow owner to be specified when syncing certs.
* Ensuring non-endpoint plugins don't fail to complete syncing.
* Adding in some additional error handling.
2017-03-03 14:53:56 -08:00
700c57b807
Rotation ui ( #633 )
...
* Adding rotation to the UI.
* Removing spinkit dependency.
2016-12-26 15:55:11 -08:00
ce75bba2c3
Replacement refactor. ( #631 )
...
* Deprecating replacement keyword.
* Def renaming.
2016-12-26 11:09:50 -08:00
cdcae4efb0
Closes #594 ( #621 )
2016-12-20 14:26:39 -08:00
a4b32b0d31
Fixing up notification testing ( #575 )
2016-12-08 11:33:40 -08:00
fc205713c8
Certificate rotation enhancements ( #570 )
2016-12-07 16:24:59 -08:00
81bf98c746
Enabling RSA2048 and RSA4096 as available key types ( #551 )
...
* Enabling RSA2048 and RSA4096 as available key types
* Fixing re-issuance
2016-12-01 15:41:53 -08:00
6fd47edbe3
Adds the ability to clone existing certificates. ( #513 )
2016-11-17 16:19:52 -08:00
Curtis Castrapel
Curtis
Javier Ramos
Jose Plana
Javier Ramos
Marti Raudsepp
James Chuong
Curtis Castrapel
Steven Reiling
kevgliss
Michael Treacher