-
Notifications
You must be signed in to change notification settings - Fork 2
/
util.go
111 lines (94 loc) · 3.47 KB
/
util.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
package atlasvault
import (
"strings"
"github.com/hashicorp/vault/sdk/framework"
)
func normalizeSerial(serial string) string {
return strings.Replace(strings.ToLower(serial), ":", "-", -1)
}
// addIssueAndSignCommonFields adds fields common to both CA and non-CA issuing
// and signing
func addIssueAndSignCommonFields(fields map[string]*framework.FieldSchema) map[string]*framework.FieldSchema {
fields["exclude_cn_from_sans"] = &framework.FieldSchema{
Type: framework.TypeBool,
Default: false,
Description: `If true, the Common Name will not be
included in DNS or Email Subject Alternate Names.
Defaults to false (CN is included).`,
}
fields["format"] = &framework.FieldSchema{
Type: framework.TypeString,
Default: "pem",
Description: `Format for returned data. Can be "pem", "der",
or "pem_bundle". If "pem_bundle" any private
key and issuing cert will be appended to the
certificate pem. Defaults to "pem".`,
AllowedValues: []interface{}{"pem", "der", "pem_bundle"},
}
fields["private_key_format"] = &framework.FieldSchema{
Type: framework.TypeString,
Default: "der",
Description: `Format for the returned private key.
Generally the default will be controlled by the "format"
parameter as either base64-encoded DER or PEM-encoded DER.
However, this can be set to "pkcs8" to have the returned
private key contain base64-encoded pkcs8 or PEM-encoded
pkcs8 instead. Defaults to "der".`,
AllowedValues: []interface{}{"", "der", "pem", "pkcs8"},
}
fields["ip_sans"] = &framework.FieldSchema{
Type: framework.TypeCommaStringSlice,
Description: `The requested IP SANs, if any, in a
comma-delimited list`,
}
fields["uri_sans"] = &framework.FieldSchema{
Type: framework.TypeCommaStringSlice,
Description: `The requested URI SANs, if any, in a
comma-delimited list.`,
}
fields["other_sans"] = &framework.FieldSchema{
Type: framework.TypeCommaStringSlice,
Description: `Requested other SANs, in an array with the format
<oid>;UTF8:<utf8 string value> for each entry.`,
}
return fields
}
// addNonCACommonFields adds fields with help text specific to non-CA
// certificate issuing and signing
func addNonCACommonFields(fields map[string]*framework.FieldSchema) map[string]*framework.FieldSchema {
fields = addIssueAndSignCommonFields(fields)
fields["role"] = &framework.FieldSchema{
Type: framework.TypeString,
Description: `The desired role with configuration for this
request`,
}
fields["common_name"] = &framework.FieldSchema{
Type: framework.TypeString,
Description: `The requested common name; if you want more than
one, specify the alternative names in the
alt_names map. If email protection is enabled
in the role, this may be an email address.`,
}
fields["alt_names"] = &framework.FieldSchema{
Type: framework.TypeString,
Description: `The requested Subject Alternative Names, if any,
in a comma-delimited list. If email protection
is enabled for the role, this may contain
email addresses.`,
}
fields["serial_number"] = &framework.FieldSchema{
Type: framework.TypeString,
Description: `The requested serial number, if any. If you want
more than one, specify alternative names in
the alt_names map using OID 2.5.4.5.`,
}
fields["ttl"] = &framework.FieldSchema{
Type: framework.TypeDurationSecond,
Description: `The requested Time To Live for the certificate;
sets the expiration date. If not specified
the role default, backend default, or system
default TTL is used, in that order. Cannot
be larger than the role max TTL.`,
}
return fields
}