Document the certificate issuing process #383
Conversation
There was a problem hiding this comment.
Thanks for this Nathan, very needed bit of work.
I made a few comments, but nothing major
regarding "docs/img/return-certificate.png", I wonder if instead of having "Google CA" we could put "CA Backend" or "interface", something to show its not fixed to Google, as we support other backends.
| - A challenge. This challenge proves the client is in possession of the private | ||
| key that corresponds to the public key provided. The challenge created by | ||
| signing the subject portion of the OIDC ID token |
There was a problem hiding this comment.
The challenge description reads correct, but is it stuffed into the cert now?
There was a problem hiding this comment.
I don't think so. Are you saying it reads like that or it doesn't read like that and it should to be accurate?
There was a problem hiding this comment.
actually reading it again, I missed the reference to "request", so I misread it as being in the certificate
"The certificate request contains three items:"
It might be confused with CSR (certificate signing request)
There was a problem hiding this comment.
Ahhh right I see. Yeah I just meant the API request if that makes sense. I think I can clarify that
|
cc @bobcallaway / @dlorenc for their input. |
nsmith5
force-pushed
the
docs/how-certificate-requests-work
branch
3 times, most recently
from
15ed6d0
to
da8753d
Compare
Add a highlevel document describing the certificate issuing process to help new contributors understand how Fulcio works. Signed-off-by: Nathan Smith <nathan@nfsmith.ca>
nsmith5
force-pushed
the
docs/how-certificate-requests-work
branch
from
da8753d
to
921a3e5
Compare
|
Rewrote the end and expanded on the certificate authority backend, ct log upload etc. I find it easiest to review the rendered content here https://github.com/nsmith5/fulcio/blob/docs/how-certificate-requests-work/docs/how-certificate-issuing-works.md |
|
This looks good to me! |
Summary
Adds a basic overview of the certificate issuing process to our docs to help bring new collaborators up to speed. Its a little light on the certificate transparency and SCT stuff, but I think its a good starting point.
NB: The images all have the excalidraw source embedded in them so they can be changed / edited by anyone
Ticket Link
Relates to #373
Release Note