There are checks done against the certificate inside of the validate() function. Currently some of the checks are: is the domain in CN ending with one of the suffixes allowed n the config file and does the server prefix match the ldap user's team (for example is "nv-..." requested by a member of "Nova_Team".

Installation

This service requires either a python virtual environment and python/ssl/ldap/sasl development system packages, or system python-ldap, python-flask packages.

For virtual environment run:

virtualenv .venv
. .venv/bin/activate
./setup.py develop

The config file should be copied from config.cfg.sample to ephemeral_ca/config.cfg with any details updated.

The service can be run with:

ephemeral_ca_server

To test the service, generate the certificate request and submit it using curl:

openssl req -text -newkey rsa:384 -nodes -out some.name.hpcloud.net.csr
curl http://0:5000/sign -F user=sso_username -F secret=sso_password -F encoding=pem -F 'csr=<some.name.hpcloud.net.csr'