certificates

certificates copied to clipboard

Address the failures from the OpenSSF scorecard

1

https://deps.dev/go/github.com%2Fsmallstep%2Fcli/v0.16.1

dopey

Add ability to list/download all unrevoked signed certificates

3

### What would you like to be added Please add the ability to list or download all unrevoked signed certificates from a `step-ca` instance. ### Why this is needed Right...

liujed

Revocation of successors of compromised certificate

8

Hey team. Suppose a short-lived certificate is issued. The certificate and key are compromised and the attacker issued a new certificate using the old one: `step ca renew compromised.crt compromised.key...

vulnbe

FR: Allow startup with unreacheable `provisioner`

1

### Description If a provisioner cannot be accessed, e.g. OAuth server is down, allow `step-ca` to boot up with the remaining functioning provisioners. Probably this is already in the new...

LecrisUT

### Description Currently, KMSs are registered in certificates when the file is imported using the `apiv1.Register` method, for example, cloudkms is registered using this: https://github.com/smallstep/certificates/blob/3f660ff07e834fbe7b387da6c7a7d004e59da057/kms/cloudkms/cloudkms.go#L96-L100 Then we import the supported...

maraino

dopey

### What would you like to be added To be able to use as little resources as possible in resource constrained environments like the Raspberry Pi it would be *awesome*...

mohe2015

dopey

FR: Limit ssh access based on OAuth groups/roles

4

# Use case If we have multiple machines, or a machine can have custom ssh access, e.g. Github or Gitea access, it would be better to have control over the...

LecrisUT

Constrain lifetime of signed certificate by remaining lifetime of parent certificates.

1

* step-ca should transparently reduce the notAfter of any issued certificates to min(requested-notAfter, intermediate-notAfter, root-notAfter) * If the notAfter is reduced, step-ca should log a warning: "Requested certificate expiration was...

dopey