23 lines
1.0 KiB
Markdown
23 lines
1.0 KiB
Markdown
# Certificate signing service
|
|
|
|
An ACME-like shell server certificate signing service.
|
|
|
|
A service that listens on a unix domain socket and signs certificate signing requests.
|
|
It verifies the CSR's subject corresponds to the username of the peer.
|
|
If a user tries to get a certificate for another user the request will be rejected.
|
|
It will also add an email address as the SubjectAltName.
|
|
This is for client certificates.
|
|
|
|
## Motivation
|
|
|
|
This was written with hashbang.sh in mind - a open registration shell server.
|
|
SSH keys are used for authenticating with hashbang.sh machines, but users might want to connect to services using TLS or send signed and/or encrypted email.
|
|
|
|
## Design
|
|
|
|
The server `cert-service-server` loads up a certificate authority and listens on a socket.
|
|
A client `cert-service-client` can connect to this socket and make a signing request.
|
|
Using `SO_PEERCRED` the server decides if the client is allowed to have its certificate signed.
|
|
|
|
The peers communicate using a custom protocol based on [ASN.1](https://en.wikipedia.org/wiki/ASN.1).
|