Add support for additional CAPI certificate context properties #873
Conversation
|
|
hslatman
changed the title
kms/tpmkms/tpmkms.go
Outdated
| uv.Set("friendly-name", o.friendlyName) | ||
| case o.description != "": | ||
| uv.Set("description", o.description) | ||
| } |
There was a problem hiding this comment.
It might not make much sense, but if we're going off the underlying CAPI, they shouldn't be. In our calling code paths, we may want make to only ever provide one, so that we can ensure our desired property is used for retrieval (eg: the description), without worrying about the underlying implementation in capikms.
kms/capi/capi.go
Outdated
| canLookupByIssuer := func() bool { | ||
| return issuerName != "" && (serialNumber != "" || subjectCN != "" || friendlyName != "" || description != "") | ||
| } |
There was a problem hiding this comment.
Why a function here, instead of eg: a const?
There was a problem hiding this comment.
Ah, this was relic from previous code when I was updating it, fixed here b78b8bb
This fixes an issue with agent, where it was unable to find device certificates due to using a key-id derived from a random string for certificate lookups. If the key-id lookup fails automatically attempt lookup by cert+attr where attr can be one of the certificate atributes, serial number, friendly-name, description, etc.
The function was a relic from past refactoring code, not necessary anymore.
joshdrake
force-pushed
the
josh/capi-set-cert-context-props
branch
from
b78b8bb to
5505db4
Compare
- Wrong variable names. - Added missing forwarding issuer,description,friendly-name params to CAPI.
This PR adds functionality to the
capiKMS to support setting the "friendly name" and "description" certificate properties. Thetpmkmspasses these through as needed.💔Thank you!