Repository navigation
changed root CA creation options, added encryption - #22
mrtvfuencxozd wants to merge 1 commit into
Conversation
97dad12 to
fea3766
Compare
- added -no-auto flag to prevent automatic issuer creation
- added -root-ca-only flag to only create an issuer
- added -ca-name flag to customize issuer CN for easier identification
this replaces "minica" by a custom string in "minica root ca 3f3732"
- added -encrypt-ca-key flag to encrypt root CA's private key
to allow automated use, when required (creation/use of key),
password can be provided by environment (MINICA_KEY_PASSWORD).
If it is not, it will be asked to user.
- added/modified some error checking.
- modified README/Usage accordingly.
fea3766 to
d8bf361
Compare
|
Hi Jacob, |
|
Hi @mtrvfuencxozd! Thanks for your patience. Most of these changes, I don't want to incorporate into minica. For the encrypted root CA private key: I think this use case can be better solved with an encrypted filesystem containing the private key. For For I'm going to close this PR for now; if you would like to create another one that implements |
Hi Jacob,
Thank you for minica.
Here is a PR somehow "reverting" #18 with the few other changes I mentioned in comments of this PR.
The other changes are :
to allow automated use, when required (creation/use of key),
password can be provided by environment (MINICA_KEY_PASSWORD).
If it is not, it will be asked to user.
Note that this adds a dependency to "golang.org/x/crypto"
this is for ssh/terminal, to not display typed password
Also, as you stated in #14 that you wanted to keep things "radically simple", and while still wanting to help find where a certificate comes from, I've added a simple CN customization option.
added -ca-name flag to customize issuer CN for easier identification
this replaces "minica" by a custom string in "minica root ca 3f3732"
added/modified some error checking.
modified README/Usage accordingly.
As I needed these changes, I hope you'll find them worth the merge.