oriolrius/pki-manager-web v3.15.0

v3.15.0 — Integrations and SCEP device enrollment

on GitHub

Highlights

• Integrations replace cluster tokens (#18, thanks @tilwegener): CA-bound service tokens are now typed kubernetes, scep or generic integrations, managed from Operations → Integrations. Existing cluster tokens keep working unchanged, as do the legacy cluster.* API and /clusters links.
  • The external issuer API enforces a CSR profile in the backend: an extension allowlist; no CA certificates or keyCertSign/cRLSign; RSA 2048–8192; for scep, clientAuth-only and at most 90 days.
  • Issuance, retries, status and revocation are scoped to the integration that owns the certificate. Revoking an already revoked certificate no longer regenerates the CRL.
  • Rejected external requests are audited with their error code. Anonymous rejections are rate-bounded so they can't flood audit_log.
• SCEP device enrollment (#19, thanks @tilwegener): a standalone RSA SCEP gateway (scep/, image ghcr.io/oriolrius/pki-manager-web/scep) with shared-challenge, native Intune and MDM-webhook authorization.
  • The gateway never talks to the KMS. RA provisioning, renewal, signing and decryption are backend endpoints (/api/v1/external/ra/*) bound to the gateway's scep integration and CA. Every RA operation is audited, and the RA key stays in Cosmian KMS.
  • Deployment: scep/compose.yml (adds one gateway to an existing install) or the docker/docker-compose.scep.yml overlay, plus Intune/MDM overlays. Setup is in scep/README.md and DEPLOYMENT.md.

Upgrade notes — read before deploying

• Back up the database first. Migrations 0010–0011 run automatically on start and turn clusters into integrations. Older images can't use the migrated DB, so rollback means restoring the backup. Follow docs/deployment/integrations-0010.md.
• KMS 5.28.0 is required for SCEP RA renewal. KMS 5.24 reuses the certificate serial when the same key is renewed, and the backend refuses it. The dev, Docker and e2e stacks now pin cosmian/kms:5.28.0. Back up the KMS data before recreating the container: the 5.28 upgrade of the database is one-way. If you don't enable SCEP, everything else works on 5.24.
• The SCEP gateway must sit behind a rate-limiting ingress (see scep/README.md) and reach the backend over HTTPS (or loopback).

Fixes

• Dev/e2e KMS lost its keys on recreate (#20, TASK-238): kms/kms.toml used config keys that Cosmian 5.24+ silently ignores, so the SQLite DB lived inside the container. The file now uses the current schema and persists to kms/data. kms/README.md explains how to rescue a DB left inside an old container.

Known issues

• Unchanged from v3.14.x: export passwords still travel in request URLs (TASK-237).
• Behind a reverse proxy, the per-IP budget for anonymous rejection audits sees the proxy's IP, because the backend doesn't set trustProxy yet. Auditing stays bounded, but the rows don't carry the real client IP.

Full Changelog: v3.14.2...v3.15.0