OpenVox Server Configuration Files: ca.conf

The ca.conf file configures settings for the OpenVox Server Certificate Authority (CA) service. For an overview, see OpenVox Server Configuration.

Deprecation Note: The authorization-required and client-whitelist settings are deprecated in favor of authorization that is configured in the new auth.conf file.

Signing settings

The allow-subject-alt-names setting in the certificate-authority section enables you to sign certs with subject alternative names. It is false by default for security reasons, but can be enabled if you need to sign certs with subject alternative names. puppet cert sign used to allow this via a flag, but puppetserver ca sign requires it to be configured in the config file.

The allow-authorization-extensions setting in the certificate-authority section enables you to sign certs with authorization extensions. It is false by default for security reasons, but can be enabled if you know you need to sign certs this way. puppet cert sign used to allow this via a flag, but puppetserver ca sign requires it to be configued in the config file.

Auto-renewal settings

The allow-auto-renewal setting in the certificate-authority section enables automatic renewal of agent certificates. It is false by default. When enabled, the CA issues certificates to renewal-capable agents with the lifetime from the auto-renewal-cert-ttl setting instead of the ca_ttl value, and agents renew their certificates automatically before they expire. The packaged ca.conf sets auto-renewal-cert-ttl to 60 days; when the setting is absent, the built-in default is 90 days. See Renewing and regenerating certificates for details.

The certificate-authority section also accepts a ca-ttl setting that controls the lifetime of newly signed certificates and takes precedence over the ca_ttl value in puppet.conf.

Infrastructure CRL settings

OpenVox Server is able to create a separate CRL file containing only revocations of OpenVox infrastructure nodes. This behavior is turned off by default. To enable it, set certificate-authority.enable-infra-crl to true.

Status settings (deprecated)

The certificate-status setting in ca.conf provides deprecated configuration options for access to the certificate_status and certificate_statuses HTTP endpoints. These endpoints allow certificates to be signed, revoked, and deleted through HTTP requests, which provides full control over OpenVox’s ability to securely authorize access. Therefore, you should always restrict access to ca.conf.

The certificate-status setting takes two parameters: authorization-required and client-whitelist. If authorization-required is set to true or not set, and client-whitelist is set to an empty list or not set, OpenVox Server uses the authorization methods and new auth.conf format to control access to the administration API endpoints.

• authorization-required determines whether a client certificate is required to access certificate status endpoints. If this parameter is set to false, all requests can access this API. If set to true, only the clients whose certificate names are included in the client-whitelist setting can access the admin API. If this parameter is not specified but the client-whitelist parameter is, this parameter’s value defaults to true.
• client-whitelist contains a list of client certificate names that are whitelisted for access to the certificate status endpoints. OpenVox Server denies access to requests at these endpoints that do not present a valid client certificate named in this list.

Example (Deprecated)

If you are using the deprecated authorization methods, follow this structure to configure certificate_status and certificate_statuses endpoint access in ca.conf, whitelisting a client named host1:

certificate-authority: {
   # deprecated in favor of auth.conf
   certificate-status: {
       authorization-required: true
       client-whitelist: [host1]
   }
}