cmp-issuer¶
cmp-issuer is a vendor-neutral cert-manager external issuer for Certificate Management Protocol (CMP) servers.
Point a cert-manager Certificate at a CMPIssuer and the certificate is enrolled over CMPv2 with the resulting certificate written to the usual TLS Secret.
CMP message protection is mandatory. HTTP and HTTPS are both supported.
Initial enrollment uses P10CR or a CRMF IR. A renewal re-enrolls with P10CR or uses certificate-authenticated KUR with CRMF proof of possession when the CMP profile requires a true key update. An omitted renewal operation follows the initial one: P10CR after P10CR and KUR after IR. A KUR renewal can fall back to the initial enrollment operation when the current certificate is missing or expired.
Start here¶
Getting started walks from an empty cluster to an issued certificate in five steps. If you are new to cmp-issuer, read that page first and come back here for detail.
Where to go next¶
| I want to | Page |
|---|---|
| Install a different way, or understand the CRD lifecycle | Installation |
| Know what is supported today | Support matrix |
| Understand the request lifecycle | Enrollment |
| Configure renewal as P10CR or KUR | Renewal with P10CR or KUR |
| Choose a protection mode | Message protection |
| Configure which CA responses are trusted | CMP response trust |
| Move off plain HTTP | HTTP and HTTPS transport |
| Look up every field | CMPIssuer, CMPClusterIssuer |
| Find notes for my CMP server | Tested PKIs |
| Watch enrollments on a dashboard | Metrics |
| Fix something that is stuck | Troubleshooting |
| Ask for help or report a problem | Support |
| Understand what is not done yet | Known limitations |
Design and operations¶
- Architecture - components and message flow
- Credential Secret access - the namespace boundary for Secret reads
- Transaction recovery - what survives a controller restart
- Security model and Threat model
- Provenance and supply chain
- CMP library selection, issuer reconciliation library, KUR renewal design, IR initial enrollment and renewal fallback
Contributing¶
- Development and Testing
- Source and issues: github.com/misiektoja/cmp-issuer
Support¶
SUPPORT.md routes usage questions, bug reports, feature requests and private security reports. Check the documentation and collect sanitized diagnostics before posting.