search

cloudflare / cfssl

CFSSL: Cloudflare's PKI and TLS toolkit
https://cfssl.org/
BSD 2-Clause "Simplified" License
8.75k stars 1.11k forks source link

Delegated Credentials for TLS support #1125

Open rektide opened 4 years ago

rektide commented 4 years ago

Hello. What would be involved with adding Delegated Credentials for TLS support to cfssl? I believe there are two main cases:

  1. cfssl issuing a "delegation certificate" to operators, with which they can generate their own delegated credentials
  2. cfssl generating a "delegated credential" from a delgation certificate that has been provided by a ca

Some good introductory reading on Delegated Credentials for TLS is available from this fine article; I suspect some folks here may already be familiar with it. ;)

wbl commented 4 years ago

I made an attempt at this in https://github.com/cloudflare/cfssl/pull/953 and see also https://github.com/cloudflare/cfssl/pull/1040. The challenges we ran into were around specifying the policy for the CA when it came to signing with extensions and I don't think we quite got something we were happy with there.

rektide commented 4 years ago

Thank you, & apologies: I did search but did not see or make the connection to Delegated Credentials.