Kyle Isom
a80323e320
Web UI: Added browser-based management for all three remaining engines (SSH CA, Transit, User E2E). Includes gRPC client wiring, handler files, 7 HTML templates, dashboard mount forms, and conditional navigation links. Fixed REST API routes to match design specs (SSH CA cert singular paths, Transit PATCH for update-key-config). Security audit: Conducted full-system audit covering crypto core, all engine implementations, API servers, policy engine, auth, deployment, and documentation. Identified 42 new findings (#39-#80) across all severity levels. Remediation of all 8 High findings: - #68: Replaced 14 JSON-injection-vulnerable error responses with safe json.Encoder via writeJSONError helper - #48: Added two-layer path traversal defense (barrier validatePath rejects ".." segments; engine ValidateName enforces safe name pattern) - #39: Extended RLock through entire crypto operations in barrier Get/Put/Delete/List to eliminate TOCTOU race with Seal - #40: Unified ReWrapKeys and seal_config UPDATE into single SQLite transaction to prevent irrecoverable data loss on crash during MEK rotation - #49: Added resolveTTL to CA engine enforcing issuer MaxTTL ceiling on handleIssue and handleSignCSR - #61: Store raw ECDH private key bytes in userState for effective zeroization on Seal - #62: Fixed user engine policy resource path from mountPath to mountName() so policy rules match correctly - #69: Added newPolicyChecker helper and passed service-level policy evaluation to all 25 typed REST handler engine.Request structs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
61 lines
2.3 KiB
HTML
61 lines
2.3 KiB
HTML
{{define "title"}} - SSH Certificate: {{.Cert.Serial}}{{end}}
|
|
{{define "content"}}
|
|
<div class="page-header">
|
|
<h2>SSH Certificate: <code>{{.Cert.Serial}}</code></h2>
|
|
<div class="page-meta">
|
|
<a href="/sshca">← SSH CA</a>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="card">
|
|
<div class="card-title">Details</div>
|
|
<table class="kv-table">
|
|
<tbody>
|
|
<tr><th>Serial</th><td><code>{{.Cert.Serial}}</code></td></tr>
|
|
<tr><th>Type</th><td>{{.Cert.CertType}}</td></tr>
|
|
<tr><th>Key ID</th><td>{{.Cert.KeyID}}</td></tr>
|
|
<tr><th>Principals</th><td>{{range .Cert.Principals}}<code>{{.}}</code> {{end}}</td></tr>
|
|
<tr><th>Profile</th><td>{{if .Cert.Profile}}<a href="/sshca/profile/{{.Cert.Profile}}">{{.Cert.Profile}}</a>{{else}}—{{end}}</td></tr>
|
|
<tr><th>Issued By</th><td>{{.Cert.IssuedBy}}</td></tr>
|
|
<tr><th>Issued At</th><td>{{.Cert.IssuedAt}}</td></tr>
|
|
<tr><th>Expires At</th><td>{{.Cert.ExpiresAt}}</td></tr>
|
|
<tr>
|
|
<th>Revoked</th>
|
|
<td>
|
|
{{if .Cert.Revoked}}
|
|
<span class="badge badge-danger">Revoked</span>
|
|
{{if .Cert.RevokedAt}} at {{.Cert.RevokedAt}}{{end}}
|
|
{{if .Cert.RevokedBy}} by {{.Cert.RevokedBy}}{{end}}
|
|
{{else}}
|
|
No
|
|
{{end}}
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
{{if .Cert.CertData}}
|
|
<div class="card">
|
|
<div class="card-title">Certificate</div>
|
|
<textarea rows="6" class="pem-input" readonly>{{.Cert.CertData}}</textarea>
|
|
</div>
|
|
{{end}}
|
|
|
|
{{if .IsAdmin}}
|
|
<div class="card">
|
|
<div class="card-title">Admin Actions</div>
|
|
{{if not .Cert.Revoked}}
|
|
<form method="post" action="/sshca/cert/{{.Cert.Serial}}/revoke" style="display:inline;">
|
|
{{csrfField}}
|
|
<button type="submit" class="btn-danger" onclick="return confirm('Revoke certificate {{.Cert.Serial}}?')">Revoke</button>
|
|
</form>
|
|
{{end}}
|
|
<form method="post" action="/sshca/cert/{{.Cert.Serial}}/delete" style="display:inline; margin-left: 0.5rem;">
|
|
{{csrfField}}
|
|
<button type="submit" class="btn-danger" onclick="return confirm('Permanently delete certificate {{.Cert.Serial}}?')">Delete</button>
|
|
</form>
|
|
</div>
|
|
{{end}}
|
|
{{end}}
|