search

Venafi / vcert

Go client SDK and command line utility designed to simplify integrations by automating key generation and certificate enrollment using Venafi machine identity services.
https://support.venafi.com/hc/en-us/articles/217991528
Apache License 2.0
88 stars 64 forks source link

Enable support in certrequest to set the certificate type for TPP #299

Closed BeardedPrincess closed 11 months ago

BeardedPrincess commented 1 year ago

BUSINESS PROBLEM API requests to TPP's POST certificates/request endpoint that do not specify a certificate type default to a server certificates type in TPP. The certificate type in TPP can have licensing implications, and so it's important to get them categorized properly. Currently, vCert SDK does not provide a way to set the certificate type, but the API endpoint in TPP allows for this.

PROPOSED SOLUTION Add CertificateType to the certificate request struct, so that it can be optionally set by vCert, and other dependent solutions.

CURRENT ALTERNATIVES None.

VENAFI EXPERIENCE This beard had no gray when I started :)

BeardedPrincess commented 11 months ago

According to the TPP WebSDK docs, setting CertificateType = Auto should automatically set the correct certificate type based on the EKU of the certificate returned from the CA: https://docs.venafi.com/Docs/currentSDK/TopNav/Content/SDK/WebSDK/r-SDK-POST-Certificates-request.php.

In https://github.com/Venafi/vcert/blob/d6340bc5e347e7001f337fca7141fc6f03fc57e9/pkg/venafi/tpp/connector.go#L525 it appears that this is already being set to "AUTO" for every certificate request. However, evidence is supporting that this is not working. Could it be that the string should be "Auto" instead of "AUTO" per the TPP docs? Or maybe "auto"? Will work on building out some tests to determine. This might be a very easy 3-byte fix.

BeardedPrincess commented 11 months ago

After further testing, this is no longer required.