HTTP and HTTPS transport¶

cmp-issuer sends CMP as application/pkixcmp over HTTP or HTTPS. Transport security is separate from CMP message protection.

Endpoint URL¶

Set the complete URL in spec.endpoint.url:

spec:
  endpoint:
    url: http://192.168.1.10:8080/pkix/
    timeout: 30s
    maxResponseSize: 1048576

Requirements:

Scheme must be http or https
Path must match the server's CMP servlet or gateway
No trailing whitespace

HTTP¶

HTTP is a first-class transport. CMP message protection still applies to every request and response.

An HTTP issuer can reach Ready=True. The controller emits a one-time warning that the endpoint provides no transport confidentiality. This is informational, not a hard failure.

Use HTTP only on networks where eavesdropping is acceptable or where another layer provides confidentiality.

HTTPS¶

For HTTPS endpoints configure optional custom trust:

spec:
  endpoint:
    url: https://cmp.example.net/pkix/
  transport:
    tls:
      caSecretRef:
        name: cmp-tls-trust
        key: ca.crt

When transport.tls.caSecretRef is omitted the client uses the system root CAs bundled in the controller image.

TLS and CMP trust are independent¶

Setting	Validates
`spec.transport.tls.caSecretRef`	HTTPS server certificate
`spec.cmpTrust.caSecretRef`	CMP PKIProtection signers and issued chains

A private CA may sign CMP responses while a public CA terminates HTTPS, or both may share a hierarchy. Configure each trust store explicitly.

Client behavior¶

Behavior	Setting
Redirects	Disabled; 3xx responses fail permanently
HTTP/2	Disabled for the CMP client
Minimum TLS	TLS 1.2
Timeout	`spec.endpoint.timeout` per exchange
Maximum body	`spec.endpoint.maxResponseSize`

CMP transaction state is derived only from authenticated CMP DER, not from HTTP headers or cookies.

mTLS¶

spec.transport.tls.clientCertificateSecretRef is reserved for future mTLS support. Leave it unset. Setting it makes the issuer NotReady.