pki

What would you like to be added

We can't query smallstep for anything related to certs because the only thing in the DB is the bytes of the cert. Storing the cert alongside more columns like the common name, not after date, and more, would let us enable more complex queries, and optimize performance for future use cases.

Why this is needed

Enable searching of Certificates signed by attrib

This issue was migrated from Pagure Issue #3199. Originally filed by rcritten (@rcritten) on 2020-08-03 15:59:52:

• Assigned to nobody

IPA can be installed in a CA-less configuration with the user providing the certificates required for operation. Running ipa-healthcheck with this will generate quite a few pk

During our last meeting, we discussed how should the server/the client compute the commitment:

• Main concern: server is using a static salt which would allow an attacker to test whether keys exist in the tree
  => client sends salt along with the registration
  => need secure PRNG

• How to ensure the server is using the right commitment scheme? Client should verify with the scheme specified