Certificate Revocation List(CRL) support for HC Vault
Open
Nobody has claimed this yet.
enhancement
keyservice/hcvault
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
SOPS currently uses HTTP Client to connect with Vault, with support for TLS.
In case of Certificate Breach and Revocation, the old certificate could still be validated by the Vault HTTP Client.
In order to prevent exposure, can we add CRL support to SOPS?
We are happy to work on a PR for this
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Trace the SOPS HTTP client path used to connect to Vault and inspect how TLS certificates are currently configured and validated. Define done as revoked certificates being rejected while valid certificates continue to work, with tests covering both outcomes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100