woggioni
a101182fdd
Allow dedicated Redis for OCSP publication
2026-10-31 20:26:37 +00:00
woggioni
ef64c4a532
Serialize OCSP Redis snapshots with CBOR
2026-10-28 20:54:19 +00:00
woggioni
df98ada177
Publish OCSP snapshots through Redis
2026-10-28 20:27:07 +00:00
woggioni
a7cfda4167
Use S3 object expiry for OCSP snapshots
2026-10-28 19:39:51 +00:00
woggioni
9da68a9625
Add production support for SQLite
CI / Build and push docker image (push) Successful in 3m9s
CI / Build and push OCSP image (push) Successful in 33s
2026-10-28 01:23:28 +00:00
woggioni
356e3beccd
Use aioboto3 for asynchronous OCSP S3 uploads
2026-10-27 22:23:33 +00:00
woggioni
0301cbff6f
Batch certificate summary lookups
CI / Build and push docker image (push) Successful in 3m14s
CI / Build and push OCSP image (push) Successful in 40s
2026-10-27 14:09:00 +00:00
woggioni
cc05d450a2
Fix multi-certificate PEM chain imports
2026-10-26 14:21:10 +00:00
woggioni
c8b4e211a0
Fix issuer links for PEM certificate chain imports
2026-10-26 13:35:28 +00:00
woggioni
7523c0b8c4
Make public key extraction idempotent
2026-10-26 10:55:24 +00:00
woggioni
1a7b4a10e8
Add full XCA curve and digest parity
CI / Build and push docker image (push) Successful in 37s
CI / Build and push OCSP image (push) Successful in 38s
2026-10-26 12:06:17 +08:00
woggioni
aee1025015
Fix stale OCSP snapshots indefinitely
...
- Parse and validate from snapshot JSON, reject future/missing timestamps
- Enforce snapshot age vs in cache and stale fallback (no lifetime extension on repeat S3 reads)
- OCSP: , ,
- Remove unused from signer
- Publisher heartbeats: , republish clean snapshots past interval, preserve dirty-only behavior and concurrency
- Config/env/docker/docs updates for heartbeat
Rolling upgrade: enable publisher heartbeats before deploying the age-enforcing responder so existing snapshots remain within the age window.
2026-10-26 12:06:15 +08:00
woggioni
718d11b4c0
Offload certificate key generation to worker threads
2026-10-25 21:26:34 +00:00
woggioni
4c1bfa4e4d
Reject duplicate serials and make keep_serial renewal safe
...
Add shared serial collision checking against existing certificates and
issuer revocations, reuse it for automatic serial allocation, and enforce
it for user-supplied serials so duplicate serials no longer break the
OCSP snapshot.
make keep_serial renewal require replace_old, refuse keep_serial +
revoke_old, and reject serials already revoked by the issuer so revoked
serials cannot be inherited by renewed certificates.
2026-10-25 21:23:34 +00:00
woggioni
a8d322776d
Enforce CSR proof of possession during certificate issuance
2026-10-25 21:21:16 +00:00
woggioni
cc7059c100
Fix OCSP snapshots for orphaned revocations
2026-10-25 13:21:23 +00:00
woggioni
404facf8e2
Fix OCSP publication races for revocation changes
2026-10-25 11:19:17 +00:00
woggioni
44a79f5b0c
Key OIDC identity by issuer and subject
2026-10-25 08:35:11 +00:00
woggioni
dab4b9e0bb
Fix cross-vault OCSP snapshot poisoning
2026-10-24 22:03:02 +00:00
woggioni
0384995570
Add S3 OCSP status publishing and standalone Rust Axum responder
2026-10-23 09:18:00 +00:00
woggioni
4ed14b42a7
Add optional OpenTelemetry traces, metrics and OTLP logs
2026-10-23 06:09:43 +00:00
woggioni
57c810ea65
Polish PWA assets, accessible tabs and bulk selection, harden bulk revoke tests
2026-10-23 05:44:32 +00:00
woggioni
763268bd40
Add server template apply modes, bulk revocation, explicit DN order and detail tabs
2026-10-23 05:33:43 +00:00
woggioni
5eb7866f5b
Close XCA parity gaps: advanced extensions, CA/revocation UI, imports, ZIP export, E2E
2026-10-23 04:26:35 +00:00
woggioni
4f3a632f4b
Implement KCA: web reimplementation of XCA PKI workflows
...
- kaya backend with OIDC sessions, API tokens, Postgres/Tortoise models
- AES-256-GCM private key storage and full certificate/CSR/CRL domain logic
- Sycamore/WASM SPA for vaults, keys, requests, certificates, CRLs and templates
- imports/exports, XCA .xdb migration, Docker Compose stack and tests
2026-10-23 02:06:55 +00:00
woggioni