reynir/cert-service
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Add README.md

Browse source
This commit is contained in:
Reynir Björnsson 2020-12-09 22:08:51 +01:00
parent 9690ef010f
commit fa9fcd174e
1 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
README.md Normal file
View file

@ -0,0 +1,22 @@
# Certificate signing service
An ACME-like shell server certificate signing service.
A service that listens on a unix domain socket and signs certificate signing requests.
It verifies the CSR's subject corresponds to the username of the peer.
If a user tries to get a certificate for another user the request will be rejected.
It will also add an email address as the SubjectAltName.
This is for client certificates.
## Motivation
This was written with hashbang.sh in mind - a open registration shell server.
SSH keys are used for authenticating with hashbang.sh machines, but users might want to connect to services using TLS or send signed and/or encrypted email.
## Design
The server `cert-service-server` loads up a certificate authority and listens on a socket.
A client `cert-service-client` can connect to this socket and make a signing request.
Using `SO_PEERCRED` the server decides if the client is allowed to have its certificate signed.
The peers communicate using a custom protocol based on [ASN.1](https://en.wikipedia.org/wiki/ASN.1).