From a675ab70d1444c13a8c39eab977fdea8e9d6cd94 Mon Sep 17 00:00:00 2001 From: Alexander Sulfrian Date: Mon, 14 Feb 2022 18:36:42 +0100 Subject: SSLCA: Add generator for custom cert/key formats This generator will not generate a new ssl key or ssl cert, but it will generate a custom format of already existing ssl keys and certs. --- schemas/sslca-format.xsd | 150 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 150 insertions(+) create mode 100644 schemas/sslca-format.xsd (limited to 'schemas') diff --git a/schemas/sslca-format.xsd b/schemas/sslca-format.xsd new file mode 100644 index 000000000..9f11dc847 --- /dev/null +++ b/schemas/sslca-format.xsd @@ -0,0 +1,150 @@ + + + + Schema for :ref:`server-plugins-generators-cfg-ssl-certificates` + ``sslformat.xml`` + + + + + + + + + An **SSLCAFormatGroupType** is a tag used to provide logic. + Child entries of an SSLCAFormatGroupType tag only apply to + machines that match the condition specified -- either + membership in a group, or a matching client name. + :xml:attribute:`SSLCAFormatGroupType:negate` can be set to negate + the sense of the match. + + + + + + + + + + + + + + The name of the client or group to match on. Child entries + will only apply to this client or group (unless + :xml:attribute:`SSLCAFormatGroupType:negate` is set). + + + + + + + Negate the sense of the match, so that child entries only + apply to a client if it is not a member of the given group + or does not have the given name. + + + + + + + + + + Available cert formats + + + + + + + + + + + + Available ker formats + + + + + + + + + + + + + Format of the cert in the generated format. Currently only ``pem`` + and ``der`` is supported. + + + + + + + + + + + Format of the key in the generated format. Currently only ``pem`` + and ``der`` is supported. + + + + + + + + + + + + + + + + + + + The full path to the cert entry to use for this format. + This is the *client* path; e.g., for a cert defined at + ``/var/lib/bcfg2/SSLCA/etc/pki/tls/private/foo.pem/sslcert.xml``, + **cert** should be ``/etc/pki/tls/private/foo.pem``. This + if required if the cert is used in the format. + + + + + + + The full path to the key entry to use for this certificate. + This is the *client* path; e.g., for a key defined at + ``/var/lib/bcfg2/SSLCA/etc/pki/tls/private/foo.key/sslkey.xml``, + **key** should be ``/etc/pki/tls/private/foo.key``. This is + only required if the key is used in the format and **cert** + is not a SSLCA generated cert. + + + + + + + + + Top-level tag for describing an SSLCA generated cert format. + + + + + + + + + + + + -- cgit v1.2.3-1-g7c22