Enable and enforce HTTPS endpoints

[darakian]

Is it possible to enable https by either passing in a cert and key or by having cfssl generate its own? If so am I missing something in the docs about where to enable this? If not is this on the roadmap?

[darakian]

The answer for cli commands seems to be the flags -tls-cert= and -tls-key=. These are very confusingly described as Other endpoint CA to set up TLS protocol and Other endpoint CA private key. Using an example config file of

{
"tls-cert": "test-pki.pem",
"tls-key": "test-pki.pem",
"min-tls-version": "1.2",
"signing": {
    "profiles":{
        "default": {
            "usages": ["digital signature"],
            "expiry": "1h",
            "auth_key":"def"
            }
        }
    },
"auth_keys":{
    "def":{
        "type":"standard",
        "key":"0123456789ABCDEF0123456789ABCDEF"
        }
    }
}

Does not seem to set them, but with the cli override I can work around this.

[lgarofalo]

Yes, I see the the lack of documentation on the config file may be causing confusion. The ConfigFile is defined only for this struct of CA information, not other settings like "min-tls-version" in your example.

// Config stores configuration information for the CA.
type Config struct {
	Signing  *Signing           `json:"signing"`
	OCSP     *ocspConfig.Config `json:"ocsp"`
	AuthKeys map[string]AuthKey `json:"auth_keys,omitempty"`
	Remotes  map[string]string  `json:"remotes,omitempty"`
}

It would be good to clarify this in the README and add an explicit note about using TLS

[darakian]

Ah I see, I was reading from

type Config struct {
	Hostname          string
	CertFile          string
	CSRFile           string
	CAFile            string
	CAKeyFile         string
...

in cli/config.go As it seemed to be referenced in cli/serve/serve.go. Thank you for the clarification and some better docs would be fantastic :)