cmp-issuer¶
cmp-issuer is a vendor-neutral cert-manager external issuer for Certificate Management Protocol (CMP) servers.
Point a cert-manager Certificate at a CMPIssuer and the certificate is enrolled over CMPv2 with the resulting certificate written to the usual TLS Secret.
CMP message protection is mandatory. HTTP and HTTPS are both supported.
Currently, enrollment and renewal are supported using PasswordBasedMac (PSK) or certificate-based signature protection for CMP P10CR requests.
Start here¶
Getting started walks from an empty cluster to an issued certificate in five steps. If you are new to cmp-issuer, read that page first and come back here for detail.
Where to go next¶
| I want to | Page |
|---|---|
| Install a different way, or understand the CRD lifecycle | Installation |
| Know what is supported today | Support matrix |
| Understand the request lifecycle | Enrollment |
| Choose a protection mode | Message protection |
| Configure which CA responses are trusted | CMP response trust |
| Move off plain HTTP | HTTP and HTTPS transport |
| Look up every field | CMPIssuer, CMPClusterIssuer |
| Find notes for my CMP server | Tested PKIs |
| Watch enrollments on a dashboard | Metrics |
| Fix something that is stuck | Troubleshooting |
| Understand what is not done yet | Known limitations |
Design and operations¶
- Architecture - components and message flow
- Credential Secret access - the namespace boundary for Secret reads
- Transaction recovery - what survives a controller restart
- Security model and Threat model
- Provenance and supply chain
- CMP library selection and issuer reconciliation library
Contributing¶
- Development and Testing
- Source and issues: github.com/misiektoja/cmp-issuer