gravitational/teleport
1
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-10-11 22:49:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix CRL backfill (#57318)

Browse Source 
* Fix CRL backfill

* Update lib/auth/init.go

Co-authored-by: Zac Bergquist <[email protected]>

---------

Co-authored-by: Zac Bergquist <[email protected]>
This commit is contained in:
Przemko Robakowski
2025-07-30 16:03:44 +00:00
committed by GitHub
co-authored by Zac Bergquist
parent 8c6e10dddd
commit 988e7b7d9d
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/auth/init.go
+12 -3
View File
@@ -785,15 +785,24 @@ func initializeAuthority(ctx context.Context, asrv *Server, caID types.CertAuthI
}
certBytes, signer, err := asrv.keyStore.GetTLSCertAndSigner(ctx, ca)
if err != nil {
return nil, nil, trace.Wrap(err)
asrv.logger.WarnContext(ctx, "Couldn't get CA certificate", "ca_type", caID.Type, "error", err)
continue
}
cert, err := tlsca.ParseCertificatePEM(certBytes)
if err != nil {
return nil, nil, trace.Wrap(err)
asrv.logger.WarnContext(ctx, "Couldn't parse CA certificate", "ca_type", caID.Type, "error", err)
continue
}
if cert.KeyUsage&x509.KeyUsageCRLSign == 0 {
asrv.logger.WarnContext(ctx, "Certificate authority can't sign CRLs, some Active Directory integrations will require a CA rotation", "ca_type", caID.Type)
continue
}
crl, err := keystore.GenerateCRL(cert, signer)
if err != nil {
return nil, nil, trace.Wrap(err)
asrv.logger.WarnContext(ctx, "Failed to generate CRL", "ca_type", caID.Type, "error", err)
continue
}
kp.CRL = crl
updated = true