Add System: Trust: Settings page - #7854
Merged
Merged
Conversation
…ermediate_certs setting to new module including migration
…lush CRL's to local trust store when requested. This implements the following options: * Enable/Disable legacy providers (enabled by default, which is the current default) * Option to write specific configuration constraints, when enabled, CipherString, Ciphersuites and MinProtocol[DTS] can be configured One last piece of the puzzle is the "crl" event action, which should deploy to the local trust store as well ehen requested.
fichtner
reviewed
Sep 10, 2024
| @@ -0,0 +1,74 @@ | |||
| <form> | |||
Member
There was a problem hiding this comment.
quite the array of settings after all :)
fichtner
reviewed
Sep 10, 2024
fichtner
reviewed
Sep 10, 2024
| </groups> | ||
| <MinProtocol type="OptionField"> | ||
| <OptionValues> | ||
| <SSLv3>SSLv3</SSLv3> |
Member
There was a problem hiding this comment.
this one is compile time disabled for sure so not applicable
fichtner
reviewed
Sep 10, 2024
| unset($config['system']['prefer_ipv4']); | ||
| } | ||
|
|
||
| $sync_trust = !empty($pconfig['store_intermediate_certs']) !== isset($config['system']['store_intermediate_certs']); |
Member
There was a problem hiding this comment.
see below, looks used $sync_trust and could be removed
fichtner
approved these changes
Sep 10, 2024
fichtner
left a comment
fichtner
left a comment
Member
There was a problem hiding this comment.
Minor things but LGTM, thanks a lot!
Co-authored-by: Franco Fichtner <franco@opnsense.org>
AdSchellevis
marked this pull request as ready for review
September 10, 2024 18:48
Member
Author
|
@fichtner thanks for the review, made some changes and hooked the CRL event (which I forgot to add by the way). I might still take a look at the automatic CRL fetching, but in terms of functionality this PR is finished and ready to be merged. |
Member
|
sweet, thanks. let's go! |
AdSchellevis
added a commit
that referenced
this pull request
Oct 28, 2024
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR offers our Trust settings it's own configuration area, moves
store_intermediate_certsinto it and adds the following functionality:legacy_sectan optional feature, enabled by default to not change current behaviortodo: