Commit Graph

1096 Commits

Author SHA1 Message Date
Javier Ramos d80a6bb405 Added tests for CSR parsing into CertificateInputSchema 2019-04-01 08:44:40 +02:00
Ryan DeShone e10007ef7b Add support for Vault KV API v2
This adds the ability to target KV API v1 or v2.
2019-03-29 10:32:49 -04:00
Javier Ramos b86e381e20 Parse SubjectAlternativeNames from CSR into Lemur Certificate 2019-03-27 13:46:33 +01:00
Hossein Shafagh d2e969b836 better synching of source and destinations 2019-03-26 18:20:14 -07:00
Curtis 4018c68d49
Merge branch 'master' into authority_validation_LE_errors 2019-03-25 08:34:10 -07:00
Curtis Castrapel c2158ff8fb Add order URI during LE cert creation failure; Fail properly when invalid CA passed; Update reqs 2019-03-25 08:28:23 -07:00
Curtis 8a42cfa345
Merge branch 'master' into ghjaramos/master 2019-03-21 08:07:44 -07:00
alwaysjolley fa4a5122bc fixing file read to trim line endings and cleanup 2019-03-20 14:59:04 -04:00
alwaysjolley f99b11d50e refactor url and token to support muiltiple instances of vault 2019-03-20 13:51:06 -04:00
Javier Ramos 9e5496b484
Update schemas.py 2019-03-15 10:19:25 +01:00
Javier Ramos f7452e8379 Parse DNSNames from CSR into Lemur Certificate 2019-03-15 09:29:23 +01:00
alwaysjolley 157db684c3
Merge branch 'master' into lemur_vault_plugin 2019-03-14 11:09:01 -04:00
Curtis c445297357
Update celery.py 2019-03-12 15:41:24 -07:00
Curtis f38e5b0879
Update celery.py 2019-03-12 15:29:04 -07:00
Curtis 1a5a91ccc7
Update celery.py 2019-03-12 15:11:13 -07:00
Curtis 3b3faa66f4
Merge branch 'master' into skip_duplicate_tasks 2019-03-12 14:53:42 -07:00
Curtis Castrapel d220e9326c Skip a task if similar task already active 2019-03-12 14:45:43 -07:00
alwaysjolley 57d3f3d5a5
Merge branch 'master' into lemur_vault_plugin 2019-03-08 07:08:56 -05:00
alwaysjolley f1c09a6f8f fixed comments 2019-03-07 15:58:34 -05:00
Hossein Shafagh 93ce259fb2
Merge branch 'master' into verify-cert-chain 2019-03-07 12:46:19 -08:00
alwaysjolley 7b0a3cf781 Merge branch 'lemur_vault_plugin' of github.com:/alwaysjolley/lemur into lemur_vault_plugin 2019-03-07 15:42:40 -05:00
alwaysjolley 752c9a086b fixing error handling and better data formating 2019-03-07 15:41:29 -05:00
Hossein Shafagh 92b60b279a
Merge branch 'master' into verify-cert-chain 2019-03-06 11:15:32 -08:00
Hossein Shafagh 43b1d6217a
Merge branch 'master' into allow-cert-deletion 2019-03-06 10:59:33 -08:00
Hossein Shafagh 98ece58342
Merge branch 'master' into lemur_vault_plugin 2019-03-06 10:59:03 -08:00
Hossein Shafagh 45cb0f0513
Merge branch 'master' into allow-cert-deletion 2019-03-06 09:35:10 -08:00
Kevin Glisson cc6d53fdeb Ensuring that configs passed via the command line are respected. 2019-03-05 15:39:37 -08:00
alwaysjolley a1cb8ee266 fixing lint 2019-03-05 07:37:04 -05:00
alwaysjolley 880eaad6cb Merge branch 'lemur_vault_plugin' of github.com:/alwaysjolley/lemur into lemur_vault_plugin 2019-03-05 07:22:18 -05:00
alwaysjolley 4a027797e0 fixing linting issues 2019-03-05 07:19:22 -05:00
Hossein Shafagh 54ad3ba777
Merge branch 'master' into verify-cert-chain 2019-03-04 17:55:36 -08:00
Hossein Shafagh c9bcd29082
Merge branch 'master' into lemur_vault_plugin 2019-03-04 17:55:00 -08:00
Curtis Castrapel dd2900bdbc Relax search;update requirements 2019-03-04 10:04:06 -08:00
Marti Raudsepp 10cec063c2 Check that stored certificate chain matches certificate
Similar to how the private key is checked.
2019-03-04 17:10:59 +02:00
alwaysjolley 20518bc377
Merge branch 'master' into lemur_vault_plugin 2019-03-01 09:58:43 -05:00
alwaysjolley 5d2f603c84 renamed vault destination plugin to avoid conflict with vault pki plugin 2019-03-01 09:49:52 -05:00
Ronald Moesbergen 63de8047ce Return 'already deleted' instead of 'not found' when cert has already been deleted 2019-02-27 09:38:25 +01:00
Ronald Moesbergen a9735e129c Merge branch 'master' into allow-cert-deletion 2019-02-27 09:28:48 +01:00
Hossein Shafagh 658c58e4b6 clarifying comments 2019-02-26 17:04:43 -08:00
Hossein Shafagh 9dbae39604 updating cryptography API call, to create right signing algorithm object. 2019-02-26 16:42:26 -08:00
Hossein Shafagh 16a18cc4b7 adding more edge test cases for EC-certs 2019-02-26 16:42:26 -08:00
Hossein Shafagh aec7c7b0bc
Merge branch 'master' into fixing-signature-verify-ecc 2019-02-26 09:28:48 -08:00
alwaysjolley 53301728fa Moved url to config file instead of plugin option. One one url can be supported
unless both the token and url are moved to the plugin options.
2019-02-26 09:15:12 -05:00
Hossein Shafagh 40fac02d8b the check_cert_signature() method was attempting to compare RSA and ECC signatures.
If a ec public-key certificate is signed with an RSA key, then it can't be a self-signed certificate, in which case we just raise InvalidSignature.
2019-02-25 19:05:54 -08:00
alwaysjolley cd65a36437 - support multiple bundle configuration, nginx, apache, cert only
- update vault destination to support multi cert under one object
- added san list as key value
- read and update object with new keys, keeping other keys, allowing
us to keep an iterable list of keys in an object for deploying multiple
certs to a single node
2019-02-25 09:42:07 -05:00
Ronald Moesbergen ef0c08dfd9 Fix: when no alias is entered when exporting a certificate, the alias is set to 'blah'.
This fix sets it to the common name instead.
2019-02-21 16:33:43 +01:00
alwaysjolley eaa73998a0 adding lemur_vault destination plugin 2019-02-19 15:03:15 -05:00
Ronald Moesbergen 29bda6c00d Fix typo's 2019-02-14 11:58:29 +01:00
Ronald Moesbergen 8abf95063c Implement a ALLOW_CERT_DELETION option (boolean, default False). When enabled, the certificate delete API call will work and the UI
will no longer display deleted certificates. When disabled (the default), the delete API call will not work (405 method not allowed)
 and the UI will show all certificates, regardless of the 'deleted' flag.
2019-02-14 11:57:27 +01:00
Hossein Shafagh e034771e36
Merge branch 'master' into special-issuer-for-selfsigned-certs 2019-02-11 12:04:33 -08:00
Hossein Shafagh 605663704b
Merge branch 'master' into hosseinsh-celeryjob-sync-src-dst 2019-02-05 12:41:33 -08:00
Hossein Shafagh e139b92b24
Merge branch 'master' into hshafagh-src-dst-register 2019-02-05 12:41:26 -08:00
Hossein Shafagh 6d1ef933c4 creating a new celery task to sync sources with destinations. This is as a measure to make sure important new destinations are also present as sources. 2019-02-05 10:48:52 -08:00
Hossein Shafagh 2107d58050
Merge branch 'master' into get_by_attributes 2019-02-05 10:31:35 -08:00
Hossein Shafagh 8d261b4120
Merge branch 'master' into special-issuer-for-selfsigned-certs 2019-02-05 10:29:20 -08:00
Marti Raudsepp 51248c1938 Use special issuer values <selfsigned> and <unknown> in special cases
This way it's easy to find/distinguish selfsigned certificates stored in
Lemur.
2019-02-05 16:56:09 +02:00
Hossein Shafagh 1d2771b014
Merge branch 'master' into get_by_attributes 2019-02-04 21:07:09 -08:00
Hossein Shafagh f249a82d71 renaming destination to source. 2019-02-04 16:10:48 -08:00
Hossein Shafagh 44a060b159 adding support for creating a source while creating a new dst, while the destination is from AWS 2019-02-04 15:36:39 -08:00
sirferl c1cf8d7a92
Merge branch 'master' into ADCS-plugin 2019-02-02 19:21:22 +01:00
Hossein Shafagh 45fbaf159a
Merge branch 'master' into master 2019-02-01 16:50:09 -08:00
Hossein Shafagh 8e93d007be
Merge branch 'master' into get_by_attributes 2019-02-01 16:48:50 -08:00
Hossein Shafagh 6705a0e030
Merge branch 'master' into ADCS-plugin 2019-02-01 16:38:39 -08:00
sirferl 36ab1c0bec
Merge branch 'master' into ADCS-plugin 2019-02-01 19:10:46 +01:00
Marti Raudsepp e24a94d798 Enforce that PEM strings (certs, keys, CSR) are internally passed as str, not bytes
This was already true in most places but not 100%, leading to lots of redundant checks and conversions.
2019-01-30 18:11:24 +02:00
Curtis e475d90e2e
Merge branch 'master' into master 2019-01-30 07:20:44 -08:00
Hossein Shafagh e5ddf08f48
Merge branch 'master' into master 2019-01-29 16:37:29 -08:00
Hossein Shafagh 7f4f4ffded
Merge branch 'master' into master 2019-01-29 16:30:15 -08:00
Hossein Shafagh 48ad20faca moving the 2 year validity issue to the Verisign plugin, and address it there 2019-01-29 16:17:08 -08:00
Curtis 1e708bf1c7
Merge branch 'master' into password_noninteractive 2019-01-29 15:21:34 -08:00
Curtis Castrapel d2317acfc5 allowing create_user with noninteractive PW;updating reqs 2019-01-29 15:17:40 -08:00
Curtis 29638c7f3b
Merge branch 'master' into master 2019-01-29 14:59:55 -08:00
Curtis 93021a5d89
Merge branch 'master' into expose-cert-distinguished-name 2019-01-29 14:56:31 -08:00
alwaysjolley c68a9cf80a fixing linting issues 2019-01-29 11:10:56 -05:00
alwaysjolley 254a3079f2 fix whitespace 2019-01-29 11:01:55 -05:00
alwaysjolley b4d1b80e04 Adding support for cfssl auth mode signing 2019-01-29 10:13:44 -05:00
sirferl c77ccdf46e
Merge branch 'master' into ADCS-plugin 2019-01-28 17:57:46 +01:00
Hossein Shafagh c47fa0f9a2 adjusting the tests to reflect on the new full year convert limit! 2019-01-24 17:52:22 -08:00
Hossein Shafagh a9724e7383 Resolving the 2 years error from UI during cert creation:
Though a CA would accept two year validity, we were getting error for being beyond 2 years.
This is because our current conversion is just current date plus 2 years,
1/25/2019 + 2 years ==> 1/25/2019
This is more strictly seen two years and 1 day extra, violating the 2 year's limit.
2019-01-24 17:23:40 -08:00
Marti Raudsepp 4b893ab5b4 Expose full certificate RFC 4514 Distinguished Name string
Using rfc4514_string() method added in cryptography version 2.5.
2019-01-23 10:03:40 +02:00
Ronald Moesbergen 4c4fbf3e48 Implement certificates delete API call by marking a cert as 'deleted' in the database. Only certificates that have expired can be deleted. 2019-01-21 10:25:28 +01:00
Ronald Moesbergen cb35f19d6c Add 'delete_cert' to enum log_type in logs table 2019-01-21 10:22:03 +01:00
Curtis Castrapel 0336d68ee2 Merge remote-tracking branch 'upstream/master' 2019-01-17 14:56:12 -08:00
Curtis Castrapel 7f88c24e83 Fix LetsEncrypt Dyn flow for duplicate CN/SAN 2019-01-17 14:56:04 -08:00
Hossein Shafagh d3284a4006 adjusting the query to filter authorities based on matching CN 2019-01-14 17:52:06 -08:00
Curtis Castrapel 3567a768d5 Compare certificate hashes to determine if Lemur already has a synced certificate 2019-01-14 13:35:55 -08:00
Curtis Castrapel 31a86687e7 Reduce the expense of joins 2019-01-14 09:20:02 -08:00
Curtis Castrapel c4e6e7c59b Optimize DB cert filtering 2019-01-14 08:02:27 -08:00
Curtis 638a8450a3
Merge branch 'master' into more_retries 2019-01-11 11:25:00 -08:00
Curtis Castrapel 0e02e6da79 Be more forgiving to throttling 2019-01-11 11:13:43 -08:00
sirferl a1ca61d813 changed a too long comment 2019-01-09 09:50:26 +01:00
sirferl a43476bc87 minor errors after lint fix 2019-01-07 11:04:27 +01:00
sirferl 054685fc38
Merge branch 'master' into ADCS-plugin 2019-01-07 10:23:18 +01:00
sirferl c62bcd1456 repaired several lint errors 2019-01-07 10:02:37 +01:00
Marti Raudsepp 542e953919 Check that stored private keys match certificates
This is done in two places:
* Certificate import validator -- throws validation errors.
* Certificate model constructor -- to ensure integrity of Lemur's data
  even when issuer plugins or other code paths have bugs.
2018-12-31 16:28:20 +02:00
Curtis 6a31856d0d
Update plugin.py 2018-12-21 12:33:47 -08:00
Curtis b5d6abb01f
Merge branch 'master' into kubernetes-improvment 2018-12-21 12:06:09 -08:00
Curtis b7332957e7
Merge branch 'master' into unicode-in-issuer-name 2018-12-21 07:59:20 -08:00
Curtis 70381c4c89
Merge branch 'master' into kubernetes-fix 2018-12-21 07:44:11 -08:00
Curtis a14fe08a63
Merge branch 'master' into kubernetes-improvment 2018-12-21 07:42:13 -08:00
Curtis fb7605e34b
Merge branch 'master' into unicode-in-issuer-name 2018-12-21 07:41:08 -08:00
Marti Raudsepp 72f6fdb17d Properly handle Unicode in issuer name sanitization
If the point of sanitization is to get rid of all non-alphanumeric
characters then Unicode characters should probably be forbidden too.

We can re-use the same sanitization function as used for cert 'name'
2018-12-21 16:34:12 +02:00
Marti Raudsepp 0f2e30cdae Deduplicate rows before notification associations unique constraint migration 2018-12-21 12:11:33 +02:00
sirferl f02178c154 added ADCS issuer and source plugin 2018-12-20 11:54:47 +01:00
Wesley Hartford fbf48316b1 Minor changes for code review suggestions. 2018-12-18 22:43:32 -05:00
Wesley Hartford 073d05ae21 Merge branch 'kubernetes-fix' into kubernetes-improvment 2018-12-18 22:26:03 -05:00
Wesley Hartford e7313da03e Minor changes for code review suggestions. 2018-12-18 22:24:48 -05:00
Curtis 425a07e988
Merge branch 'master' into destination-tpl-fix 2018-12-18 12:27:35 -08:00
Curtis 513e876e2e
Merge branch 'master' into master 2018-12-18 12:18:38 -08:00
Wesley Hartford bc621c1468 Improve the Kubernetes Destination plugin
The plugin now supports loading details from local files rather than requiring them to be entered through the UI. This is especially relaent when Lemur is deployed on Kubernetes as the certificate, token, and current namespace will be injected into the pod. The location these details are injected are the defaults if no configuration details are supplied.

The plugin now supports deploying the secret in three different formats:
* Full - matches the formate used by the plugin prior to these changes.
* TLS - creates a secret of type kubernetes.io/tls and includes the certificate chain and private key, this format is used by many kubernetes features.
* Certificate - creates a secret containing only the certificate chain, suitable for use as trust authority where private keys should _NOT_ be deployed.

The deployed secret can now have a name set through the configuration options; the setting allows the insertion of the placeholder '{common_name}' which will be replaced by the certificate's common name value.

Debug level logging has been added.
2018-12-12 13:25:36 -08:00
sirferl a50d80992c updated query to ignore empty parameters 2018-12-12 12:45:48 +01:00
Wesley Hartford 060c78fd91 Fix Kubernetes Destination Plugin
The Kubernetes plugin was broken. There were two major issues:
* The server certificate was entered in a string input making it impossible (as far as I know) to enter a valid PEM certificate.
* The base64 encoding calls were passing strings where bytes were expected.

The fix to the first issue depends on #2218 and a change in the options structure. I've also included some improved input validation and logging.
2018-12-10 15:33:04 -08:00
Wesley Hartford 437d918cf7 Fix textarea and validation on destination page
The destination configuration page did not previously support a textarea input as was supported on most other pages. The validation of string inputs was not being performed. This commit addresses both of those issues and corrects the validation expressions for the AWS and S3 destination plugins so that they continue to function. The SFTP destination plugin does not have any string validation. The Kubernetes plugin does not work at all as far as I can tell; there will be another PR in the coming days to address that.
2018-12-10 12:04:16 -08:00
Ronald Moesbergen dcf5ce0eec
Merge branch 'master' into master 2018-12-07 13:57:59 +01:00
Curtis Castrapel c32e20b6fc Fix notifications - Ensure that notifcation e-mails are sent appropriately 2018-12-06 12:25:43 -08:00
Ronald Moesbergen e0ac749734 When parsing SAN's, ignore unknown san_types, because in some cases they can contain unparsable/serializable values, resulting in a TypeError(repr(o) + " is not JSON serializable") 2018-12-06 16:47:53 +01:00
Curtis Castrapel 2a235fb0e2 Prefer DNS provider with longest matching zone 2018-11-30 12:44:52 -08:00
Curtis Castrapel a90154e0ae LetsEncrypt Celery Flow 2018-11-29 09:29:05 -08:00
Curtis Castrapel 39b76d18dc add countdown to async call 2018-11-28 14:41:56 -08:00
Curtis Castrapel e074a14ee9 unit test 2018-11-28 14:27:03 -08:00
Curtis Castrapel 2381d0a4bb Add async call to create pending cert when needed 2018-11-28 11:32:52 -08:00
Ronald Moesbergen da10913045 Only search nested group memberships when LDAP_IS_ACTIVE_DIRECTORY is True 2018-11-20 10:37:36 +01:00
Ronald Moesbergen 61839f4aca Add support for nested group membership in ldap authenticator 2018-11-19 13:42:42 +01:00
Curtis Castrapel 3ce8abe46e Left outer join on domains tables to avoid missing results 2018-11-13 14:33:17 -08:00
Curtis Castrapel 92a771f5ed More accurate db count functionality 2018-11-13 09:14:21 -08:00
Curtis 29be647911
Merge branch 'master' into no_csr_reissue 2018-11-12 09:54:47 -08:00
Curtis Castrapel a7a05e26bc Do not re-use CSR during certificate reissuance; Update requirement; Add more logging to celery handler 2018-11-12 09:52:11 -08:00
Curtis Castrapel 6f0005c78e Avoid colliding LetsEncrypt jobs 2018-11-09 10:31:27 -08:00
Curtis Castrapel 1643650685 Changing essential part of query 2018-11-07 16:02:04 -08:00
Curtis Castrapel 08a2a2b0e5 Optimize certificate filtering by name 2018-11-07 15:34:25 -08:00
Curtis Castrapel a3f96b96ee Add fixture to failing function 2018-11-05 15:16:09 -08:00
Curtis Castrapel 75183ef2f2 Unpin most dependencies, and fix moto 2018-11-05 14:37:52 -08:00
Curtis Castrapel 61738dde9e Run query on DB 2018-11-05 13:15:53 -08:00
Curtis Castrapel 52e773230d Add new gin index to optimize ILIKE queries 2018-11-05 10:29:11 -08:00
Curtis Castrapel 0277e4dc05 get_or_increase_name fix for pendingcertificates 2018-10-29 13:53:30 -07:00
Curtis Castrapel 50761d9d3b safer reissue, fix celery sync job 2018-10-29 13:22:50 -07:00
Curtis Castrapel 56ed416cb7 Celery task for sync job 2018-10-29 09:10:43 -07:00
Curtis a8b357965e
Merge branch 'master' into get_by_attributes 2018-10-29 08:15:42 -07:00
Curtis 2138930102
Merge branch 'master' into get_by_attributes 2018-10-24 07:20:46 -07:00
James Chuong 75069cd52a Add CSR to certificiates
Add csr column to certificates field, as pending certificates have
exposed the CSR already.  This is required as generating CSR from
existing certificate is will not include SANs due to OpenSSL bug:
https://github.com/openssl/openssl/issues/6481

Change-Id: I9ea86c4f87067ee6d791d77dc1cce8f469cb2a22
2018-10-23 17:46:04 -07:00
Curtis Castrapel b709eed3c3 Only resolve pending cert if not attempted in last 5 min 2018-10-23 13:08:43 -07:00
Curtis Castrapel 054cc64ee8 Prevent dashes from appearing at end of cert name in AWS 2018-10-23 12:49:58 -07:00
Curtis Castrapel 73ed5164cd deps 2018-10-22 14:51:13 -07:00
Curtis b058508478
Merge branch 'master' into get_by_attributes 2018-10-22 09:09:55 -07:00
Curtis Castrapel e83699b6ae Add unique constraint to sources table - label column 2018-10-19 15:34:34 -07:00
Non Sequitur 81d114092e Merge branch 'github' into get_by_attributes 2018-10-17 12:00:36 -04:00
Non Sequitur 48017a9d4c Added get_by_attributes to the certificates service, for fetching certs based on arbitrary attributes. Also associated test and extra tests for other service methods 2018-10-17 11:42:09 -04:00
Curtis Castrapel a912c3488d python fix to retrigger tests 2018-10-12 07:25:58 -07:00
Curtis Castrapel 89a077e54c minor change to pass stuck github check 2018-10-12 07:14:31 -07:00
Curtis Castrapel 13ef965666 nit: comments 2018-10-12 05:56:14 -07:00
Curtis Castrapel 6073f9e7b6 datetime ref fix 2018-10-12 05:51:30 -07:00
Curtis Castrapel 4b3d458dba Celery task to delete old pending certs 2018-10-12 05:47:16 -07:00
Curtis Castrapel cc18a68c00 Lemur LetsEncrypt Polling Support 2018-10-11 22:01:05 -07:00
Curtis Castrapel e91d8ec81b add indexes to domains and certificates tables to optimize load time 2018-10-11 11:36:50 -07:00
Non Sequitur 79033f42b4
Merge branch 'master' into improved_verify 2018-10-02 09:19:24 -04:00
Non Sequitur 40f4444099 Flake8 fix in test_verify.py 2018-10-01 22:04:31 -04:00
Curtis Castrapel 56282845fa Enable optional verisign cloud transparency configuration 2018-10-01 09:20:50 -07:00
Non Sequitur 50919d85a8 Merge remote-tracking branch 'upstream/master' into improved_verify 2018-09-27 11:19:06 -04:00
Mike Culbertson 590fac4aa8 docstring update in verify.py 2018-09-27 10:11:13 -04:00
Mike Culbertson f19b6382bc Updated verify tests 2018-09-27 10:10:04 -04:00
Mike Culbertson 11f2210894 Merge branch 'improved_verify' of github.com:explody/lemur into improved_verify 2018-09-27 09:28:45 -04:00
Mike Culbertson 652d7f65dd flake8 tweak 2018-09-27 09:28:21 -04:00
Curtis Castrapel 563f0fb9b2 Celery refactoring, celery beat job in configuration 2018-09-17 10:52:12 -07:00
Curtis Castrapel 23382b2777 Celery integration 2018-09-13 10:35:54 -07:00
Curtis c09d8ae630
Merge branch 'master' into fix_import_v1 2018-09-10 10:35:31 -07:00
Curtis Castrapel 7d42e4ce67 Fix certificate import issues 2018-09-10 10:34:47 -07:00
Curtis Castrapel f6a130b09d Add more logging to messaging 2018-09-10 09:13:31 -07:00
Curtis c9836fbf25
Merge branch 'master' into improved_verify 2018-09-06 07:33:55 -07:00
Gus Esquivel 82e69db0c5 fix error message typo 2018-09-04 10:21:34 -05:00
Mike Culbertson 2815ddf6c8 Moved cert object to be passed to both ocsp/crl methods so we can report in better detail on the certs. Ensured proper returns of False (revoked) True (good) None (unknown) throughout the methods. 2018-08-31 13:34:55 -04:00
Mike Culbertson 34c88494b8 More specific exception catch for cert parsing. line shortening. 2018-08-31 12:19:55 -04:00
Mike Culbertson 7dbca821c3 Reducing the stacked exceptions plus a bit of pep8 2018-08-31 12:01:49 -04:00
Curtis Castrapel d82a615e17 Validate config - fix for issue#1629 2018-08-28 09:15:28 -07:00
Curtis Castrapel 453bb43157 recommit https://github.com/Netflix/lemur/pull/1612 2018-08-27 09:50:02 -07:00
Curtis 1b77dfa47a
Revert "Precommit - Fix linty things" 2018-08-22 13:21:35 -07:00
Curtis Castrapel 3e9726d9db Precommit work 2018-08-22 10:38:09 -07:00
Curtis Castrapel 6abf274680 Allow case insensitive role matching for cert permissions 2018-08-20 08:55:04 -07:00
Curtis Castrapel 9f64f0523b Increase timeouts 2018-08-17 15:36:56 -07:00
Curtis Castrapel 43ae6c39e3 wait right here 2018-08-17 12:14:02 -07:00
Curtis Castrapel 7f9a035802 Fix private key bytecode issue 2018-08-17 10:59:01 -07:00
Curtis Castrapel a6b1f33208 Ensure owner names are lowercase for new / updated certificates 2018-08-17 10:41:55 -07:00
Curtis Castrapel 1ad61b1550 allow null validity periods 2018-08-17 07:57:55 -07:00
Curtis Castrapel be9d683e46 fix merge 2018-08-16 10:15:48 -07:00
Curtis Castrapel da99bcda68 Better zone handling 2018-08-16 10:12:19 -07:00
Curtis Castrapel 2c22c9c2f1 Allow proper detection of zones, fix certificate detection 2018-08-14 14:37:45 -07:00
Curtis Castrapel 1a5abe6550 fix lint 2018-08-13 15:11:57 -07:00
Curtis Castrapel cc836433fb formatting 2018-08-13 15:06:16 -07:00
Curtis Castrapel 5829794d82 typo fix 2018-08-13 14:25:54 -07:00
Curtis Castrapel bb026b8b59 Allow LetsEncrypt renewals and requesting certificates without specifying DNS provider 2018-08-13 14:22:59 -07:00
Curtis ab37189022
Merge branch 'master' into unittests-use-valid-certs 2018-08-07 09:42:39 -07:00
Curtis cf71f88680
Merge branch 'master' into fill-missing-rotation-policy 2018-08-07 08:23:29 -07:00
Curtis f9a7b97839
Merge branch 'master' into unittests-use-valid-certs 2018-08-07 07:45:45 -07:00
Cyril Dangerville 2869042f38 Fixed invalid JSON payloads (making API requests fail in particular) (#1522) 2018-08-03 15:26:48 -07:00
Marti Raudsepp 82158aece6 Fill in missing cert rotation_policy; don't ignore validation errors when re-issuing certs
CertificateInputSchema requires the rotation_policy field, but
certificates created before the field existed have set to NULL. Thus
saving such certificates failed and probably caused other errors.

Made cert re-issuing (get_certificate_primitives) more strict so such
errors are harder to miss in the future.
2018-08-03 20:06:21 +03:00
Marti Raudsepp 1f0f432327 Fix unit tests certificates to have correct chains and private keys
In preparation for certificate integrity-checking: invalid certificate
chains and mismatching private keys will no longer be allowed anywhere
in Lemur code.

The test vector certs were generated using the Lemur "cryptography"
authority plugin.

* Certificates are now more similar to real-world usage: long serial
  numbers, etc.
* Private key is included for all certs, so it's easy to re-generate
  anything if needed.
2018-08-03 19:45:13 +03:00
Marti Raudsepp acd2701fa2 Delete dead code in unit tests (#1510) 2018-08-03 08:21:55 -07:00
Curtis 025d177565
Merge branch 'master' into letsencrypt_account_support 2018-07-30 15:28:29 -07:00
Curtis Castrapel 44192d4494 remove debug print 2018-07-30 15:27:23 -07:00
Curtis Castrapel 0889076d3b Support LetsEncrypt accounts 2018-07-30 15:25:02 -07:00
Mike Grima d6b482755b Proper flask_restful boolean parsing.
This is documented here: https://github.com/flask-restful/flask-restful/issues/488
2018-07-30 13:49:41 -07:00