diff options
author | Niall Sheridan <nsheridan@gmail.com> | 2016-07-31 20:41:52 +0100 |
---|---|---|
committer | Niall Sheridan <nsheridan@gmail.com> | 2016-07-31 21:18:55 +0100 |
commit | 531f63e5a9e82d86a6ee1f5d44bebee0bc51d828 (patch) | |
tree | 882b6dfb10c4db96b9e983fd6112a29d227a416a /server/signer/signer.go | |
parent | 44fef1c2a163bdfd781ef08a06e3cf5cf9b7d5da (diff) |
Use a KRL for revoked certs
Diffstat (limited to 'server/signer/signer.go')
-rw-r--r-- | server/signer/signer.go | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/server/signer/signer.go b/server/signer/signer.go index 8169c11..0bff1c3 100644 --- a/server/signer/signer.go +++ b/server/signer/signer.go @@ -13,6 +13,8 @@ import ( "github.com/nsheridan/cashier/lib" "github.com/nsheridan/cashier/server/config" + "github.com/nsheridan/cashier/server/store" + "github.com/stripe/krl" "golang.org/x/crypto/ssh" ) @@ -51,6 +53,22 @@ func (s *KeySigner) SignUserKey(req *lib.SignRequest) (*ssh.Certificate, error) return cert, nil } +// GenerateRevocationList returns an SSH key revocation list (KRL). +func (s *KeySigner) GenerateRevocationList(certs []*store.CertRecord) ([]byte, error) { + revoked := &krl.KRLCertificateSection{ + CA: s.ca.PublicKey(), + } + ids := krl.KRLCertificateKeyID{} + for _, c := range certs { + ids = append(ids, c.KeyID) + } + revoked.Sections = append(revoked.Sections, &ids) + k := &krl.KRL{ + Sections: []krl.KRLSection{revoked}, + } + return k.Marshal(rand.Reader) +} + func makeperms(perms []string) map[string]string { if len(perms) > 0 { m := make(map[string]string) |