)]}'
{"specs/mikata/killick/killick-concept.rst":[{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"42d5ffe15b86c9c7bd9859e1af9011f478739b4e","unresolved":false,"context_lines":[{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":" Killick - Lightweight PKI with certificate policy enforcement"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Killick is a proposed lightweight, python based, Certificate Authority"},{"line_number":13,"context_line":"and Registration Authority. Killick is designed to re-use the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a2fa921_88ffa766","line":10,"updated":"2015-10-07 12:41:53.000000000","message":"needs a link to a blueprint I think, even though the blueprint is probably just a copy of this summary in LP.","commit_id":"9451e05e10741a1e870cd7ed6762440c047699d3"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"a16c4da9d8eaa35ae1ce15e14eccd75d18300ea0","unresolved":false,"context_lines":[{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":" Killick - Lightweight PKI with certificate policy enforcement"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Killick is a proposed lightweight, python based, Certificate Authority"},{"line_number":13,"context_line":"and Registration Authority. Killick is designed to re-use the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a2fa921_fc3b7d9a","line":10,"in_reply_to":"7a2fa921_88ffa766","updated":"2015-10-07 13:42:14.000000000","message":"Done","commit_id":"9451e05e10741a1e870cd7ed6762440c047699d3"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f11f2b75aea1e5ee00e72a22d6335bf55ba96e3c","unresolved":false,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"This work is licensed under a Creative Commons Attribution 3.0 Unported"},{"line_number":4,"context_line":"License."},{"line_number":5,"context_line":"http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":" Killick - Lightweight PKI with certificate policy enforcement"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_57d36a04","line":5,"updated":"2015-10-07 14:09:35.000000000","message":"what\u0027s the deal with this license?  I think we normally use Apache for our things, but maybe this is a common spec license?","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"f8ea4de686764b8f25a10f777377b6d00f638ee3","unresolved":false,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"This work is licensed under a Creative Commons Attribution 3.0 Unported"},{"line_number":4,"context_line":"License."},{"line_number":5,"context_line":"http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":" Killick - Lightweight PKI with certificate policy enforcement"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_2aad1531","line":5,"in_reply_to":"7a2fa921_57d36a04","updated":"2015-10-07 19:10:27.000000000","message":"CC is more appropriate for written stuff.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f11f2b75aea1e5ee00e72a22d6335bf55ba96e3c","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/killick/+spec/killick-concept"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Killick is a proposed lightweight, python based, Certificate Authority"},{"line_number":14,"context_line":"and Registration Authority. Killick is designed to re-use the"},{"line_number":15,"context_line":"Certificate Service Request (CSR) validation from Anchor to provide"},{"line_number":16,"context_line":"automated Certificate Security Policy enforcement, allowing certificate"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_f7087693","line":13,"updated":"2015-10-07 14:09:35.000000000","message":"should CA be capitalized?","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"f8ea4de686764b8f25a10f777377b6d00f638ee3","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/killick/+spec/killick-concept"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Killick is a proposed lightweight, python based, Certificate Authority"},{"line_number":14,"context_line":"and Registration Authority. Killick is designed to re-use the"},{"line_number":15,"context_line":"Certificate Service Request (CSR) validation from Anchor to provide"},{"line_number":16,"context_line":"automated Certificate Security Policy enforcement, allowing certificate"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_4a589132","line":13,"in_reply_to":"7a2fa921_f7087693","updated":"2015-10-07 19:10:27.000000000","message":"no idea. I\u0027ll leave it for the moment but follow up on the capitalisation.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f11f2b75aea1e5ee00e72a22d6335bf55ba96e3c","unresolved":false,"context_lines":[{"line_number":11,"context_line":"https://blueprints.launchpad.net/killick/+spec/killick-concept"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Killick is a proposed lightweight, python based, Certificate Authority"},{"line_number":14,"context_line":"and Registration Authority. Killick is designed to re-use the"},{"line_number":15,"context_line":"Certificate Service Request (CSR) validation from Anchor to provide"},{"line_number":16,"context_line":"automated Certificate Security Policy enforcement, allowing certificate"},{"line_number":17,"context_line":"administrators to see at a glance if a CSR meets their policy and thus"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_57fa8a76","line":14,"updated":"2015-10-07 14:09:35.000000000","message":"same with RA","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f11f2b75aea1e5ee00e72a22d6335bf55ba96e3c","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Killick is a proposed lightweight, python based, Certificate Authority"},{"line_number":14,"context_line":"and Registration Authority. Killick is designed to re-use the"},{"line_number":15,"context_line":"Certificate Service Request (CSR) validation from Anchor to provide"},{"line_number":16,"context_line":"automated Certificate Security Policy enforcement, allowing certificate"},{"line_number":17,"context_line":"administrators to see at a glance if a CSR meets their policy and thus"},{"line_number":18,"context_line":"make an informed decision whether to issue that certificate or deny the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_d72c5a04","line":15,"updated":"2015-10-07 14:09:35.000000000","message":"I\u0027d guess this should also not be capitalized?","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f11f2b75aea1e5ee00e72a22d6335bf55ba96e3c","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Killick is a proposed lightweight, python based, Certificate Authority"},{"line_number":14,"context_line":"and Registration Authority. Killick is designed to re-use the"},{"line_number":15,"context_line":"Certificate Service Request (CSR) validation from Anchor to provide"},{"line_number":16,"context_line":"automated Certificate Security Policy enforcement, allowing certificate"},{"line_number":17,"context_line":"administrators to see at a glance if a CSR meets their policy and thus"},{"line_number":18,"context_line":"make an informed decision whether to issue that certificate or deny the"},{"line_number":19,"context_line":"request."}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_b7399e43","line":16,"updated":"2015-10-07 14:09:35.000000000","message":"caps :(","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f11f2b75aea1e5ee00e72a22d6335bf55ba96e3c","unresolved":false,"context_lines":[{"line_number":15,"context_line":"Certificate Service Request (CSR) validation from Anchor to provide"},{"line_number":16,"context_line":"automated Certificate Security Policy enforcement, allowing certificate"},{"line_number":17,"context_line":"administrators to see at a glance if a CSR meets their policy and thus"},{"line_number":18,"context_line":"make an informed decision whether to issue that certificate or deny the"},{"line_number":19,"context_line":"request."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_b7875ed6","line":18,"updated":"2015-10-07 14:09:35.000000000","message":"maybe issue \"the\" certificate?","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"57b9d4e12938ab0ba9c7ea8a8b6fbfcefcdee11d","unresolved":false,"context_lines":[{"line_number":15,"context_line":"Certificate Service Request (CSR) validation from Anchor to provide"},{"line_number":16,"context_line":"automated Certificate Security Policy enforcement, allowing certificate"},{"line_number":17,"context_line":"administrators to see at a glance if a CSR meets their policy and thus"},{"line_number":18,"context_line":"make an informed decision whether to issue that certificate or deny the"},{"line_number":19,"context_line":"request."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_c5c1cb55","line":18,"in_reply_to":"7a2fa921_a1baa321","updated":"2015-10-08 14:31:16.000000000","message":"Done","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"bba54ea100dbbdd8c6b445c3b6e6288a081a6e95","unresolved":false,"context_lines":[{"line_number":15,"context_line":"Certificate Service Request (CSR) validation from Anchor to provide"},{"line_number":16,"context_line":"automated Certificate Security Policy enforcement, allowing certificate"},{"line_number":17,"context_line":"administrators to see at a glance if a CSR meets their policy and thus"},{"line_number":18,"context_line":"make an informed decision whether to issue that certificate or deny the"},{"line_number":19,"context_line":"request."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_a1baa321","line":18,"in_reply_to":"7a2fa921_b7875ed6","updated":"2015-10-07 21:57:39.000000000","message":"Actually I\u0027d probably go with \"issue a corresponding certificate\" as it\u0027s not a great idea to issue traditional certificates by signing the CSR so much as to extract the bits you want and create a new cert. (As Anchor is moving to).","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"f8ea4de686764b8f25a10f777377b6d00f638ee3","unresolved":false,"context_lines":[{"line_number":15,"context_line":"Certificate Service Request (CSR) validation from Anchor to provide"},{"line_number":16,"context_line":"automated Certificate Security Policy enforcement, allowing certificate"},{"line_number":17,"context_line":"administrators to see at a glance if a CSR meets their policy and thus"},{"line_number":18,"context_line":"make an informed decision whether to issue that certificate or deny the"},{"line_number":19,"context_line":"request."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_a535d6f7","line":18,"in_reply_to":"7a2fa921_b7875ed6","updated":"2015-10-07 19:10:27.000000000","message":"Done","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f11f2b75aea1e5ee00e72a22d6335bf55ba96e3c","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Killick is intended for small internal infrastructure and cloud"},{"line_number":25,"context_line":"deployments, where the overhead of deploying and maintaining a"},{"line_number":26,"context_line":"traditional pki service (MS ADCS, RH Dogtag PKI, ejbca, etc) is too"},{"line_number":27,"context_line":"significant, but where there is no opportunity or desire to use"},{"line_number":28,"context_line":"ephemeral certificates. Additionally, Killick will offer automated"},{"line_number":29,"context_line":"certificate policy enforcement via the Anchor validator system, which"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_b75e7e74","line":26,"updated":"2015-10-07 14:09:35.000000000","message":"I think PKI should be capitalized here..  maybe check on ejbca","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"57b9d4e12938ab0ba9c7ea8a8b6fbfcefcdee11d","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Killick is intended for small internal infrastructure and cloud"},{"line_number":25,"context_line":"deployments, where the overhead of deploying and maintaining a"},{"line_number":26,"context_line":"traditional pki service (MS ADCS, RH Dogtag PKI, ejbca, etc) is too"},{"line_number":27,"context_line":"significant, but where there is no opportunity or desire to use"},{"line_number":28,"context_line":"ephemeral certificates. Additionally, Killick will offer automated"},{"line_number":29,"context_line":"certificate policy enforcement via the Anchor validator system, which"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_059b4373","line":26,"in_reply_to":"7a2fa921_217d336e","updated":"2015-10-08 14:31:16.000000000","message":"Done","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"bba54ea100dbbdd8c6b445c3b6e6288a081a6e95","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Killick is intended for small internal infrastructure and cloud"},{"line_number":25,"context_line":"deployments, where the overhead of deploying and maintaining a"},{"line_number":26,"context_line":"traditional pki service (MS ADCS, RH Dogtag PKI, ejbca, etc) is too"},{"line_number":27,"context_line":"significant, but where there is no opportunity or desire to use"},{"line_number":28,"context_line":"ephemeral certificates. Additionally, Killick will offer automated"},{"line_number":29,"context_line":"certificate policy enforcement via the Anchor validator system, which"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_217d336e","line":26,"in_reply_to":"7a2fa921_b75e7e74","updated":"2015-10-07 21:57:39.000000000","message":"EJBCA","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"55ff5692cfba5bf0303a1ba77b92e45aa0e6dc91","unresolved":false,"context_lines":[{"line_number":28,"context_line":"ephemeral certificates. Additionally, Killick will offer automated"},{"line_number":29,"context_line":"certificate policy enforcement via the Anchor validator system, which"},{"line_number":30,"context_line":"allows a Certificate Administrator or Security Architect to define a"},{"line_number":31,"context_line":"security policy and see at a glance if that policy is met. Optionally,"},{"line_number":32,"context_line":"Killick can be configured to automatically reject certificates that do"},{"line_number":33,"context_line":"not meet the policy."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_f71636a6","line":31,"updated":"2015-10-07 14:20:59.000000000","message":"Might want to avoid using project names as colloquailisms for readability. \"and easily see if that policy....\"","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"f8ea4de686764b8f25a10f777377b6d00f638ee3","unresolved":false,"context_lines":[{"line_number":28,"context_line":"ephemeral certificates. Additionally, Killick will offer automated"},{"line_number":29,"context_line":"certificate policy enforcement via the Anchor validator system, which"},{"line_number":30,"context_line":"allows a Certificate Administrator or Security Architect to define a"},{"line_number":31,"context_line":"security policy and see at a glance if that policy is met. Optionally,"},{"line_number":32,"context_line":"Killick can be configured to automatically reject certificates that do"},{"line_number":33,"context_line":"not meet the policy."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_c56332db","line":31,"in_reply_to":"7a2fa921_f71636a6","updated":"2015-10-07 19:10:27.000000000","message":"Done","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"7473547ced17d74f44bf8b35a485131708df4586","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"- Use public certificates. These are certificates provided by services"},{"line_number":39,"context_line":"  like Verisign or Letsencrypt. These are generally trusted by external"},{"line_number":40,"context_line":"  users, but can incur per certificate costs."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"- Use ephemeral certificates. Short-term certificates provided by"},{"line_number":43,"context_line":"  Anchor avoid the issues with certificate revocation associated with"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_41e621b1","line":40,"updated":"2015-10-08 08:07:56.000000000","message":"Due to the relatively high cost of public certificates it is extremely rare to see them used for internal network communications - they\u0027re generally only procured for edge-services (Web pages, VPN endpoints etc)","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"57b9d4e12938ab0ba9c7ea8a8b6fbfcefcdee11d","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"- Use public certificates. These are certificates provided by services"},{"line_number":39,"context_line":"  like Verisign or Letsencrypt. These are generally trusted by external"},{"line_number":40,"context_line":"  users, but can incur per certificate costs."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"- Use ephemeral certificates. Short-term certificates provided by"},{"line_number":43,"context_line":"  Anchor avoid the issues with certificate revocation associated with"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_859c335e","line":40,"in_reply_to":"7a2fa921_41e621b1","updated":"2015-10-08 14:31:16.000000000","message":"Done","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"7473547ced17d74f44bf8b35a485131708df4586","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"- Use ephemeral certificates. Short-term certificates provided by"},{"line_number":43,"context_line":"  Anchor avoid the issues with certificate revocation associated with"},{"line_number":44,"context_line":"  traditional lifetime certificates, but require a client to replace"},{"line_number":45,"context_line":"  certificates automatically and are not intended for use on interfaces"},{"line_number":46,"context_line":"  like APIs and web servers."},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_c1fa3143","line":44,"updated":"2015-10-08 08:07:56.000000000","message":"Which we haven\u0027t discussed yet in this spec?","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"57b9d4e12938ab0ba9c7ea8a8b6fbfcefcdee11d","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"- Use ephemeral certificates. Short-term certificates provided by"},{"line_number":43,"context_line":"  Anchor avoid the issues with certificate revocation associated with"},{"line_number":44,"context_line":"  traditional lifetime certificates, but require a client to replace"},{"line_number":45,"context_line":"  certificates automatically and are not intended for use on interfaces"},{"line_number":46,"context_line":"  like APIs and web servers."},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_ea005303","line":44,"in_reply_to":"7a2fa921_c1fa3143","updated":"2015-10-08 14:31:16.000000000","message":"Done","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"7473547ced17d74f44bf8b35a485131708df4586","unresolved":false,"context_lines":[{"line_number":46,"context_line":"  like APIs and web servers."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- Use an internal PKI to issue traditional lifetime certificates."},{"line_number":49,"context_line":"  These are certificates signed by a private certificate, using a PKI"},{"line_number":50,"context_line":"  owned by the deployer, unless this private CA certificate is trusted"},{"line_number":51,"context_line":"  by end users, the certificates signed by this PKI will not be accepted"},{"line_number":52,"context_line":"  by users."}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_217765d4","line":49,"updated":"2015-10-08 08:07:56.000000000","message":"Terminology: there\u0027s no such things as a \u0027private\u0027 certificate. Try to elaborate - signed by a Certificate Authority using a root of trust (or trust anchor) that was created and distributed by the organisation that will be managing the certificate lifecycle...\n\nMy writing is crappy this morning but hopefully you get the gist.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"57b9d4e12938ab0ba9c7ea8a8b6fbfcefcdee11d","unresolved":false,"context_lines":[{"line_number":46,"context_line":"  like APIs and web servers."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- Use an internal PKI to issue traditional lifetime certificates."},{"line_number":49,"context_line":"  These are certificates signed by a private certificate, using a PKI"},{"line_number":50,"context_line":"  owned by the deployer, unless this private CA certificate is trusted"},{"line_number":51,"context_line":"  by end users, the certificates signed by this PKI will not be accepted"},{"line_number":52,"context_line":"  by users."}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_2ae5eb36","line":49,"in_reply_to":"7a2fa921_217765d4","updated":"2015-10-08 14:31:16.000000000","message":"Done","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f11f2b75aea1e5ee00e72a22d6335bf55ba96e3c","unresolved":false,"context_lines":[{"line_number":61,"context_line":"Proposed change"},{"line_number":62,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Killick will use a rest api to interact with and control the"},{"line_number":65,"context_line":"Registration Authority (RA) and Certificate Authority (CA), this"},{"line_number":66,"context_line":"interface will enable the later addition of a Horizon panel and a"},{"line_number":67,"context_line":"stand-alone interface or GUI. The API will enable the following"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_1795f2dc","line":64,"updated":"2015-10-07 14:09:35.000000000","message":"API should be caps","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"7473547ced17d74f44bf8b35a485131708df4586","unresolved":false,"context_lines":[{"line_number":61,"context_line":"Proposed change"},{"line_number":62,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Killick will use a rest api to interact with and control the"},{"line_number":65,"context_line":"Registration Authority (RA) and Certificate Authority (CA), this"},{"line_number":66,"context_line":"interface will enable the later addition of a Horizon panel and a"},{"line_number":67,"context_line":"stand-alone interface or GUI. The API will enable the following"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_212525c0","line":64,"in_reply_to":"7a2fa921_1795f2dc","updated":"2015-10-08 08:07:56.000000000","message":"RESTful API.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"57b9d4e12938ab0ba9c7ea8a8b6fbfcefcdee11d","unresolved":false,"context_lines":[{"line_number":61,"context_line":"Proposed change"},{"line_number":62,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Killick will use a rest api to interact with and control the"},{"line_number":65,"context_line":"Registration Authority (RA) and Certificate Authority (CA), this"},{"line_number":66,"context_line":"interface will enable the later addition of a Horizon panel and a"},{"line_number":67,"context_line":"stand-alone interface or GUI. The API will enable the following"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_4ab94714","line":64,"in_reply_to":"7a2fa921_212525c0","updated":"2015-10-08 14:31:16.000000000","message":"Done","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"55ff5692cfba5bf0303a1ba77b92e45aa0e6dc91","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Administrator:"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"- View pending requests"},{"line_number":80,"context_line":"- View validation status for a pending request"},{"line_number":81,"context_line":"- View issued certificates"},{"line_number":82,"context_line":"- View denied requests"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_a93862a1","line":79,"updated":"2015-10-07 14:20:59.000000000","message":"Is viewing the details of a request the same as viewing that the request exists? Or do specs not need to go into that much detail? And are we assuming that anything that has made it past the policy is then a \"good\" cert?","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"7473547ced17d74f44bf8b35a485131708df4586","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Administrator:"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"- View pending requests"},{"line_number":80,"context_line":"- View validation status for a pending request"},{"line_number":81,"context_line":"- View issued certificates"},{"line_number":82,"context_line":"- View denied requests"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_a11ff56a","line":79,"updated":"2015-10-08 08:07:56.000000000","message":"Would you expect an administrator to also be able to submit a certificate signing request?","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"4ed178e87f7b3fbf0cad3d2618e0531dbf5595a7","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Administrator:"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"- View pending requests"},{"line_number":80,"context_line":"- View validation status for a pending request"},{"line_number":81,"context_line":"- View issued certificates"},{"line_number":82,"context_line":"- View denied requests"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_fade0c6c","line":79,"in_reply_to":"7a2fa921_85053a7b","updated":"2015-10-07 20:50:15.000000000","message":"Probably, I was thinking more from the API standpoint - get list of certs, get individual details of a specific cert (for manual validation, etc...) \u0026 wanted to call it out.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"57b9d4e12938ab0ba9c7ea8a8b6fbfcefcdee11d","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Administrator:"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"- View pending requests"},{"line_number":80,"context_line":"- View validation status for a pending request"},{"line_number":81,"context_line":"- View issued certificates"},{"line_number":82,"context_line":"- View denied requests"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_6afbe3c1","line":79,"in_reply_to":"7a2fa921_a11ff56a","updated":"2015-10-08 14:31:16.000000000","message":"I would expect the administrator to use the same API to request signing requests as any other user.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"f8ea4de686764b8f25a10f777377b6d00f638ee3","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Administrator:"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"- View pending requests"},{"line_number":80,"context_line":"- View validation status for a pending request"},{"line_number":81,"context_line":"- View issued certificates"},{"line_number":82,"context_line":"- View denied requests"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_85053a7b","line":79,"in_reply_to":"7a2fa921_a93862a1","updated":"2015-10-07 19:10:27.000000000","message":"TBD - i think this is one we can figure out when we are desigining the interfaces.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"55ff5692cfba5bf0303a1ba77b92e45aa0e6dc91","unresolved":false,"context_lines":[{"line_number":79,"context_line":"- View pending requests"},{"line_number":80,"context_line":"- View validation status for a pending request"},{"line_number":81,"context_line":"- View issued certificates"},{"line_number":82,"context_line":"- View denied requests"},{"line_number":83,"context_line":"- View revoked certificates"},{"line_number":84,"context_line":"- Revoke an issued certificate"},{"line_number":85,"context_line":"- Deny a pending request"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_e9ae5a84","line":82,"updated":"2015-10-07 14:20:59.000000000","message":"If there\u0027s an error with the validator is there a way to manually push a denied request?","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"57b9d4e12938ab0ba9c7ea8a8b6fbfcefcdee11d","unresolved":false,"context_lines":[{"line_number":79,"context_line":"- View pending requests"},{"line_number":80,"context_line":"- View validation status for a pending request"},{"line_number":81,"context_line":"- View issued certificates"},{"line_number":82,"context_line":"- View denied requests"},{"line_number":83,"context_line":"- View revoked certificates"},{"line_number":84,"context_line":"- Revoke an issued certificate"},{"line_number":85,"context_line":"- Deny a pending request"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_0ada6f4c","line":82,"in_reply_to":"7a2fa921_ba5654d0","updated":"2015-10-08 14:31:16.000000000","message":"Done","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"4ed178e87f7b3fbf0cad3d2618e0531dbf5595a7","unresolved":false,"context_lines":[{"line_number":79,"context_line":"- View pending requests"},{"line_number":80,"context_line":"- View validation status for a pending request"},{"line_number":81,"context_line":"- View issued certificates"},{"line_number":82,"context_line":"- View denied requests"},{"line_number":83,"context_line":"- View revoked certificates"},{"line_number":84,"context_line":"- Revoke an issued certificate"},{"line_number":85,"context_line":"- Deny a pending request"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_ba5654d0","line":82,"in_reply_to":"7a2fa921_e5450eb3","updated":"2015-10-07 20:50:15.000000000","message":"And really the validators should be tested BEFORE cert expiry dates even get close, but there may be cases where people don\u0027t want to mess with retooling a validator. The only caveat is that this may be abused and someone uses it like MSADCS, but that is kinda the decision of the implementor. Again, just wanted to call it out to make sure.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"f8ea4de686764b8f25a10f777377b6d00f638ee3","unresolved":false,"context_lines":[{"line_number":79,"context_line":"- View pending requests"},{"line_number":80,"context_line":"- View validation status for a pending request"},{"line_number":81,"context_line":"- View issued certificates"},{"line_number":82,"context_line":"- View denied requests"},{"line_number":83,"context_line":"- View revoked certificates"},{"line_number":84,"context_line":"- Revoke an issued certificate"},{"line_number":85,"context_line":"- Deny a pending request"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_e5450eb3","line":82,"in_reply_to":"7a2fa921_e9ae5a84","updated":"2015-10-07 19:10:27.000000000","message":"Theres no reason why you could not issue a certificate that has been previously denied.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"55ff5692cfba5bf0303a1ba77b92e45aa0e6dc91","unresolved":false,"context_lines":[{"line_number":85,"context_line":"- Deny a pending request"},{"line_number":86,"context_line":"- Publish a CRL"},{"line_number":87,"context_line":"- View CA health"},{"line_number":88,"context_line":"- Download an audit report of certificates issued in a time period"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"In addition to this functionality, the RA will support the following"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_a9eaa20d","line":88,"updated":"2015-10-07 14:20:59.000000000","message":"Is the assumption that a small enough infrastructure will not want a \u0027tiered\u0027 deployment with some type of intermediary issuance?","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"f8ea4de686764b8f25a10f777377b6d00f638ee3","unresolved":false,"context_lines":[{"line_number":85,"context_line":"- Deny a pending request"},{"line_number":86,"context_line":"- Publish a CRL"},{"line_number":87,"context_line":"- View CA health"},{"line_number":88,"context_line":"- Download an audit report of certificates issued in a time period"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"In addition to this functionality, the RA will support the following"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_e54aeeab","line":88,"in_reply_to":"7a2fa921_a9eaa20d","updated":"2015-10-07 19:10:27.000000000","message":"My assumption is that you will give this PKI a CA signing certificate - I dont think it matters to Killick if that certificate was generated locally with openssl, delegated from a policy CA, or delegated from a public CA.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"4ed178e87f7b3fbf0cad3d2618e0531dbf5595a7","unresolved":false,"context_lines":[{"line_number":85,"context_line":"- Deny a pending request"},{"line_number":86,"context_line":"- Publish a CRL"},{"line_number":87,"context_line":"- View CA health"},{"line_number":88,"context_line":"- Download an audit report of certificates issued in a time period"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"In addition to this functionality, the RA will support the following"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_70069bcf","line":88,"in_reply_to":"7a2fa921_e54aeeab","updated":"2015-10-07 20:50:15.000000000","message":"Makes sense to have something like Anchor worry about where CA\u0027s are, I haven\u0027t looked at it enough to know if something needed to be added at this layer to make that easier.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"55ff5692cfba5bf0303a1ba77b92e45aa0e6dc91","unresolved":false,"context_lines":[{"line_number":101,"context_line":"- optional reporting of validation results to the requestor (optional to"},{"line_number":102,"context_line":"  prevent enumeration of certificate policy)"},{"line_number":103,"context_line":"- optional automatic issuing of certificates that pass validation,"},{"line_number":104,"context_line":"  either permanently or for an administrator defined time period."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"In the future, the support for the following functionality will be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_a92dc247","line":104,"updated":"2015-10-07 14:20:59.000000000","message":"Is any of the above actions constrained to a user? Is authentication needed to view every cert?","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"4ed178e87f7b3fbf0cad3d2618e0531dbf5595a7","unresolved":false,"context_lines":[{"line_number":101,"context_line":"- optional reporting of validation results to the requestor (optional to"},{"line_number":102,"context_line":"  prevent enumeration of certificate policy)"},{"line_number":103,"context_line":"- optional automatic issuing of certificates that pass validation,"},{"line_number":104,"context_line":"  either permanently or for an administrator defined time period."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"In the future, the support for the following functionality will be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_f0214b4e","line":104,"in_reply_to":"7a2fa921_45a08243","updated":"2015-10-07 20:50:15.000000000","message":"Yeah, i think the big question is \"who cares\"? It\u0027s probably easier to enumerate crypto with nmap/sslscan, and just grabbing a public cert shouldn\u0027t give you too much, unless you have really old/weak ones laying around...","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"f8ea4de686764b8f25a10f777377b6d00f638ee3","unresolved":false,"context_lines":[{"line_number":101,"context_line":"- optional reporting of validation results to the requestor (optional to"},{"line_number":102,"context_line":"  prevent enumeration of certificate policy)"},{"line_number":103,"context_line":"- optional automatic issuing of certificates that pass validation,"},{"line_number":104,"context_line":"  either permanently or for an administrator defined time period."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"In the future, the support for the following functionality will be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_45a08243","line":104,"in_reply_to":"7a2fa921_a92dc247","updated":"2015-10-07 19:10:27.000000000","message":"My assumption that the options will be configured in a local json config file, at least initially, like anchor. At a later date, it could be exposed via the API. You raise an interesting point about authn - that is something I have not considered in any depth yet.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"57b9d4e12938ab0ba9c7ea8a8b6fbfcefcdee11d","unresolved":false,"context_lines":[{"line_number":101,"context_line":"- optional reporting of validation results to the requestor (optional to"},{"line_number":102,"context_line":"  prevent enumeration of certificate policy)"},{"line_number":103,"context_line":"- optional automatic issuing of certificates that pass validation,"},{"line_number":104,"context_line":"  either permanently or for an administrator defined time period."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"In the future, the support for the following functionality will be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_0a8fcf2a","line":104,"in_reply_to":"7a2fa921_f0214b4e","updated":"2015-10-08 14:31:16.000000000","message":"the enumeration I was talking about was figuring out what the rules are for certificate issuing, and thus allowing an attacker to spot a gap and expoit it - however this is far more of an issue for anchor, where they get the cert automatically.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"55ff5692cfba5bf0303a1ba77b92e45aa0e6dc91","unresolved":false,"context_lines":[{"line_number":108,"context_line":"considered:"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"- Online Certificate Status Protocol (OCSP)"},{"line_number":111,"context_line":"- Automated Certificate Management Environment (ACME)"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"The majority of the certificate operations and validation functionality"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_89afa693","line":111,"updated":"2015-10-07 14:20:59.000000000","message":"Is any integration with a ticketing system planned/supported? (This is if authentication is required)","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"4ed178e87f7b3fbf0cad3d2618e0531dbf5595a7","unresolved":false,"context_lines":[{"line_number":108,"context_line":"considered:"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"- Online Certificate Status Protocol (OCSP)"},{"line_number":111,"context_line":"- Automated Certificate Management Environment (ACME)"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"The majority of the certificate operations and validation functionality"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_f0cf0b7d","line":111,"in_reply_to":"7a2fa921_058b6ac4","updated":"2015-10-07 20:50:15.000000000","message":"Cool, the other aspect of no authN would be that a lot of that integration would be exposed via the API, but if there is authn it could get easier to do workflows, only allow specific groups to grab certain certs, or even have that be part of the validator","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"f8ea4de686764b8f25a10f777377b6d00f638ee3","unresolved":false,"context_lines":[{"line_number":108,"context_line":"considered:"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"- Online Certificate Status Protocol (OCSP)"},{"line_number":111,"context_line":"- Automated Certificate Management Environment (ACME)"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"The majority of the certificate operations and validation functionality"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_058b6ac4","line":111,"in_reply_to":"7a2fa921_89afa693","updated":"2015-10-07 19:10:27.000000000","message":"I had not considered this, Ill add it to the list.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"66e6eca0f9f95c0c88f58b746d64599686563e92","unresolved":false,"context_lines":[{"line_number":108,"context_line":"considered:"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"- Online Certificate Status Protocol (OCSP)"},{"line_number":111,"context_line":"- Automated Certificate Management Environment (ACME)"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"The majority of the certificate operations and validation functionality"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_260d4990","line":111,"in_reply_to":"7a2fa921_f0cf0b7d","updated":"2015-10-07 21:44:09.000000000","message":"I think it definitely needs to have AuthN, I just havent figured out how it will work yet!","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"55ff5692cfba5bf0303a1ba77b92e45aa0e6dc91","unresolved":false,"context_lines":[{"line_number":186,"context_line":"  Validator-\u003eValidator: Run Validators"},{"line_number":187,"context_line":"  Validator-\u003eRA: Validation Results (dictionary)"},{"line_number":188,"context_line":"  RA-\u003eDatabase: Write request data (request object)"},{"line_number":189,"context_line":"  RA-\u003eUser: Failure Notification (optional)"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Issue Certificate"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_49ce6e5b","line":189,"updated":"2015-10-07 14:20:59.000000000","message":"If this is automated, this should occur within a relatively short period of time (I can\u0027t see a situation where enough certs are requested that a system is \u0027overwhelmed\u0027), I would argue that user failure notification should not be optional.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"f8ea4de686764b8f25a10f777377b6d00f638ee3","unresolved":false,"context_lines":[{"line_number":186,"context_line":"  Validator-\u003eValidator: Run Validators"},{"line_number":187,"context_line":"  Validator-\u003eRA: Validation Results (dictionary)"},{"line_number":188,"context_line":"  RA-\u003eDatabase: Write request data (request object)"},{"line_number":189,"context_line":"  RA-\u003eUser: Failure Notification (optional)"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Issue Certificate"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_e5542e22","line":189,"in_reply_to":"7a2fa921_49ce6e5b","updated":"2015-10-07 19:10:27.000000000","message":"Do you mean failure notification happens quickly? My concern is that if it automatically tells people the reasons the CSR has been rejected, it will make enumeration of the policy easier - now in most cases, people submitting requests will know the policy, so maybe its just a case of limiting the information returned.\n\nIn Anchor, validation happens very quickly.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"66e6eca0f9f95c0c88f58b746d64599686563e92","unresolved":false,"context_lines":[{"line_number":186,"context_line":"  Validator-\u003eValidator: Run Validators"},{"line_number":187,"context_line":"  Validator-\u003eRA: Validation Results (dictionary)"},{"line_number":188,"context_line":"  RA-\u003eDatabase: Write request data (request object)"},{"line_number":189,"context_line":"  RA-\u003eUser: Failure Notification (optional)"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Issue Certificate"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_a64ab9c3","line":189,"in_reply_to":"7a2fa921_d0a9af7c","updated":"2015-10-07 21:44:09.000000000","message":"+1","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"4ed178e87f7b3fbf0cad3d2618e0531dbf5595a7","unresolved":false,"context_lines":[{"line_number":186,"context_line":"  Validator-\u003eValidator: Run Validators"},{"line_number":187,"context_line":"  Validator-\u003eRA: Validation Results (dictionary)"},{"line_number":188,"context_line":"  RA-\u003eDatabase: Write request data (request object)"},{"line_number":189,"context_line":"  RA-\u003eUser: Failure Notification (optional)"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Issue Certificate"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a2fa921_d0a9af7c","line":189,"in_reply_to":"7a2fa921_e5542e22","updated":"2015-10-07 20:50:15.000000000","message":"Exactly - I\u0027d limit what is returned to a generic message, but it may help to give a user an indicator of if it passed the policy or not (which presumably would be in some type of document repository anyway) so that they could update and the security architect didn\u0027t have to send ti back and follow-up with the user to have them re-submit.","commit_id":"94198d958fb327861fbfbe392ae7ac4cb7e8661e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"6d916445305644ce6295e66ce52291d7715094f1","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Generally, enterprise deployments use a combination of public and"},{"line_number":62,"context_line":"private certificates, as there are pros and cons of both types. Most"},{"line_number":63,"context_line":"certificate administrators prefer to manually issue certificates, at"},{"line_number":64,"context_line":"least for some of their estate. Killick is intended to be a lightweight"},{"line_number":65,"context_line":"PKI to enable this."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a2fa921_9ea55348","line":62,"updated":"2015-10-08 20:15:33.000000000","message":"Per Rob\u0027s comment I should probably use good terminology too... private -\u003e internal","commit_id":"a73f68aadfd4a59581d846dbcacf1c25f9115207"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"6d916445305644ce6295e66ce52291d7715094f1","unresolved":false,"context_lines":[{"line_number":100,"context_line":""},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"------AUTH -----"},{"line_number":103,"context_line":"????????"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"In addition to this functionality, the RA will support the following"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a2fa921_4176faa4","line":103,"updated":"2015-10-08 20:15:33.000000000","message":"Will this be filled out now, or should it just be something like \"Authentication is planned through Keystone project tokens\"...?","commit_id":"a73f68aadfd4a59581d846dbcacf1c25f9115207"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"6d916445305644ce6295e66ce52291d7715094f1","unresolved":false,"context_lines":[{"line_number":208,"context_line":"  Validator-\u003eValidator: Run Validators"},{"line_number":209,"context_line":"  Validator-\u003eRA: Validation Results (dictionary)"},{"line_number":210,"context_line":"  RA-\u003eDatabase: Write request data (request object)"},{"line_number":211,"context_line":"  RA-\u003eUser: Failure Notification (optional)"},{"line_number":212,"context_line":""},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Issue Certificate"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a2fa921_9e1b13ca","line":211,"updated":"2015-10-08 20:15:33.000000000","message":"I\u0027m still not a fan of optional failure notification here, even if it\u0027s generic.","commit_id":"a73f68aadfd4a59581d846dbcacf1c25f9115207"}],"specs/mitaka/killick/killick-concept.rst":[{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"6ff3e78af8ec5f1a997e6964fce1c397c79322da","unresolved":false,"context_lines":[{"line_number":129,"context_line":"to Anchor, such as HSM support, Killick will automatically benefit. The"},{"line_number":130,"context_line":"Anchor validation functionality allows automatic checking of certificate"},{"line_number":131,"context_line":"request fields, such as the user/email, checking that the common name"},{"line_number":132,"context_line":"and sans fall within the certificate policy or checking for the"},{"line_number":133,"context_line":"existence of a CMDB entry for the request."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"There are three key functions required to build Killick, over the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a2fa921_7067f0ea","line":132,"updated":"2015-10-12 05:52:52.000000000","message":"SANs? It reads strange if you don\u0027t expect it\u0027s subjectAltNames","commit_id":"43118b290b5d2d41288a305f5a824c67fe9ceecb"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"6ff3e78af8ec5f1a997e6964fce1c397c79322da","unresolved":false,"context_lines":[{"line_number":133,"context_line":"existence of a CMDB entry for the request."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"There are three key functions required to build Killick, over the"},{"line_number":136,"context_line":"functionality provided by anchor:"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"- Certificate database. This will store all submitted requests, their"},{"line_number":139,"context_line":"  status, user information and if the CSR has been issued, the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a2fa921_d02364a6","line":136,"updated":"2015-10-12 05:52:52.000000000","message":"Anchor","commit_id":"43118b290b5d2d41288a305f5a824c67fe9ceecb"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"6ff3e78af8ec5f1a997e6964fce1c397c79322da","unresolved":false,"context_lines":[{"line_number":141,"context_line":"  database, but the extensibility and integration with standard databases"},{"line_number":142,"context_line":"  should be considered."},{"line_number":143,"context_line":"- Revocation functionality. As Anchor has no ability to generate"},{"line_number":144,"context_line":"  certificate revocation lists, this will need to be added."},{"line_number":145,"context_line":"- Controller functionality to enable the user interactions described"},{"line_number":146,"context_line":"  above."},{"line_number":147,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a2fa921_3033b8f8","line":144,"updated":"2015-10-12 05:52:52.000000000","message":"added to Killick, or Anchor?","commit_id":"43118b290b5d2d41288a305f5a824c67fe9ceecb"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"6ff3e78af8ec5f1a997e6964fce1c397c79322da","unresolved":false,"context_lines":[{"line_number":261,"context_line":"Dependencies"},{"line_number":262,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"anchor"},{"line_number":265,"context_line":""},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a2fa921_70405036","line":264,"updated":"2015-10-12 05:52:52.000000000","message":"Anchor","commit_id":"43118b290b5d2d41288a305f5a824c67fe9ceecb"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"a0d2d9537d5fb2dde501a8809ee45a4aa61384bb","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/killick/+spec/killick-concept"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Killick is a proposed lightweight, python based, Certificate Authority"},{"line_number":14,"context_line":"and Registration Authority. Killick is designed to re-use the"},{"line_number":15,"context_line":"Certificate Service Request (CSR) validation from Anchor to provide"},{"line_number":16,"context_line":"automated Certificate Security Policy enforcement, allowing certificate"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_88da2277","line":13,"range":{"start_line":13,"start_character":35,"end_line":13,"end_character":41},"updated":"2016-02-19 16:57:36.000000000","message":"Python","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"ea87a3119bee8bba2210b2170cc474fe3caf8789","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/killick/+spec/killick-concept"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Killick is a proposed lightweight, python based, Certificate Authority"},{"line_number":14,"context_line":"and Registration Authority. Killick is designed to re-use the"},{"line_number":15,"context_line":"Certificate Service Request (CSR) validation from Anchor to provide"},{"line_number":16,"context_line":"automated Certificate Security Policy enforcement, allowing certificate"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7af24918_8f745368","line":13,"range":{"start_line":13,"start_character":35,"end_line":13,"end_character":41},"in_reply_to":"bae84128_88da2277","updated":"2016-03-03 15:32:20.000000000","message":"Done","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"a0d2d9537d5fb2dde501a8809ee45a4aa61384bb","unresolved":false,"context_lines":[{"line_number":15,"context_line":"Certificate Service Request (CSR) validation from Anchor to provide"},{"line_number":16,"context_line":"automated Certificate Security Policy enforcement, allowing certificate"},{"line_number":17,"context_line":"administrators to see at a glance if a CSR meets their policy and thus"},{"line_number":18,"context_line":"make an informed decision whether to issue a coresponding certificate or"},{"line_number":19,"context_line":"deny the request."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_283796b1","line":18,"range":{"start_line":18,"start_character":45,"end_line":18,"end_character":57},"updated":"2016-02-19 16:57:36.000000000","message":"corresponding","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"ea87a3119bee8bba2210b2170cc474fe3caf8789","unresolved":false,"context_lines":[{"line_number":15,"context_line":"Certificate Service Request (CSR) validation from Anchor to provide"},{"line_number":16,"context_line":"automated Certificate Security Policy enforcement, allowing certificate"},{"line_number":17,"context_line":"administrators to see at a glance if a CSR meets their policy and thus"},{"line_number":18,"context_line":"make an informed decision whether to issue a coresponding certificate or"},{"line_number":19,"context_line":"deny the request."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7af24918_af678fb5","line":18,"range":{"start_line":18,"start_character":45,"end_line":18,"end_character":57},"in_reply_to":"bae84128_283796b1","updated":"2016-03-03 15:32:20.000000000","message":"Done","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"aa8ea90a7960a1ed280e8d045fe8f54622a76eed","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Killick is intended for small internal infrastructure and cloud"},{"line_number":25,"context_line":"deployments, where the overhead of deploying and maintaining a"},{"line_number":26,"context_line":"traditional PKI service (MS ADCS, RH Dogtag PKI, EJBCA, etc) is too"},{"line_number":27,"context_line":"significant, but where there is no opportunity or desire to use"},{"line_number":28,"context_line":"ephemeral certificates. Additionally, Killick will offer automated"},{"line_number":29,"context_line":"certificate policy enforcement via the Anchor validator system, which"},{"line_number":30,"context_line":"allows a Certificate Administrator or Security Architect to define a"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_677432cf","line":27,"updated":"2016-02-19 15:29:17.000000000","message":"this would be a stronger case if you explained some examples of the kind of things that make deploying and maintaining traditional PKI significant","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"a0d2d9537d5fb2dde501a8809ee45a4aa61384bb","unresolved":false,"context_lines":[{"line_number":26,"context_line":"traditional PKI service (MS ADCS, RH Dogtag PKI, EJBCA, etc) is too"},{"line_number":27,"context_line":"significant, but where there is no opportunity or desire to use"},{"line_number":28,"context_line":"ephemeral certificates. Additionally, Killick will offer automated"},{"line_number":29,"context_line":"certificate policy enforcement via the Anchor validator system, which"},{"line_number":30,"context_line":"allows a Certificate Administrator or Security Architect to define a"},{"line_number":31,"context_line":"security policy and easily see if that policy is met. Optionally,"},{"line_number":32,"context_line":"Killick can be configured to automatically reject certificates that do"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_282cb649","line":29,"range":{"start_line":29,"start_character":31,"end_line":29,"end_character":34},"updated":"2016-02-19 16:57:36.000000000","message":"through","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"ea87a3119bee8bba2210b2170cc474fe3caf8789","unresolved":false,"context_lines":[{"line_number":26,"context_line":"traditional PKI service (MS ADCS, RH Dogtag PKI, EJBCA, etc) is too"},{"line_number":27,"context_line":"significant, but where there is no opportunity or desire to use"},{"line_number":28,"context_line":"ephemeral certificates. Additionally, Killick will offer automated"},{"line_number":29,"context_line":"certificate policy enforcement via the Anchor validator system, which"},{"line_number":30,"context_line":"allows a Certificate Administrator or Security Architect to define a"},{"line_number":31,"context_line":"security policy and easily see if that policy is met. Optionally,"},{"line_number":32,"context_line":"Killick can be configured to automatically reject certificates that do"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7af24918_efd99758","line":29,"range":{"start_line":29,"start_character":31,"end_line":29,"end_character":34},"in_reply_to":"bae84128_282cb649","updated":"2016-03-03 15:32:20.000000000","message":"Done","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"a0d2d9537d5fb2dde501a8809ee45a4aa61384bb","unresolved":false,"context_lines":[{"line_number":30,"context_line":"allows a Certificate Administrator or Security Architect to define a"},{"line_number":31,"context_line":"security policy and easily see if that policy is met. Optionally,"},{"line_number":32,"context_line":"Killick can be configured to automatically reject certificates that do"},{"line_number":33,"context_line":"not meet the policy."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"There are three main approaches to providing certificates for an"},{"line_number":36,"context_line":"enterprise deployment:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_a8956641","line":33,"range":{"start_line":33,"start_character":13,"end_line":33,"end_character":19},"updated":"2016-02-19 16:57:36.000000000","message":"I would recommend a bit of explanation on why that\u0027s a good thing, maybe: \", providing immediate feedback to the user on what specifically was not conforming to policy.\"","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"ea87a3119bee8bba2210b2170cc474fe3caf8789","unresolved":false,"context_lines":[{"line_number":30,"context_line":"allows a Certificate Administrator or Security Architect to define a"},{"line_number":31,"context_line":"security policy and easily see if that policy is met. Optionally,"},{"line_number":32,"context_line":"Killick can be configured to automatically reject certificates that do"},{"line_number":33,"context_line":"not meet the policy."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"There are three main approaches to providing certificates for an"},{"line_number":36,"context_line":"enterprise deployment:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7af24918_8f28d3e3","line":33,"range":{"start_line":33,"start_character":13,"end_line":33,"end_character":19},"in_reply_to":"bae84128_a8956641","updated":"2016-03-03 15:32:20.000000000","message":"Done","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"aa8ea90a7960a1ed280e8d045fe8f54622a76eed","unresolved":false,"context_lines":[{"line_number":47,"context_line":"  traditional lifetime certificates, which have not yet been discussed"},{"line_number":48,"context_line":"  in this spec. However, systems that use short term certificates"},{"line_number":49,"context_line":"  require a client to replace their certificates automatically and this"},{"line_number":50,"context_line":"  model is not not intended for use on interfaces like APIs and web"},{"line_number":51,"context_line":"  servers."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"- Use an internal PKI to issue traditional lifetime certificates. These"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_e735e2f7","line":50,"updated":"2016-02-19 15:29:17.000000000","message":"why not?","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"aa8ea90a7960a1ed280e8d045fe8f54622a76eed","unresolved":false,"context_lines":[{"line_number":79,"context_line":"- Request certificate (submit CSR)"},{"line_number":80,"context_line":"- View request status"},{"line_number":81,"context_line":"- List all submitted requests for a given user and view their statuses"},{"line_number":82,"context_line":"- Retrieve certificate (if it is issued)"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Administrator:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_b9965e92","line":82,"updated":"2016-02-19 15:29:17.000000000","message":"what about viewing past issued certificates and their TTL?","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"ea87a3119bee8bba2210b2170cc474fe3caf8789","unresolved":false,"context_lines":[{"line_number":79,"context_line":"- Request certificate (submit CSR)"},{"line_number":80,"context_line":"- View request status"},{"line_number":81,"context_line":"- List all submitted requests for a given user and view their statuses"},{"line_number":82,"context_line":"- Retrieve certificate (if it is issued)"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Administrator:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7af24918_3af61ff9","line":82,"in_reply_to":"bae84128_b9965e92","updated":"2016-03-03 15:32:20.000000000","message":"Current issued certs can be viewed, there is no ability to view expired certs explicitly or TTL. This is clearly an ommission, good catch.","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"a0d2d9537d5fb2dde501a8809ee45a4aa61384bb","unresolved":false,"context_lines":[{"line_number":80,"context_line":"- View request status"},{"line_number":81,"context_line":"- List all submitted requests for a given user and view their statuses"},{"line_number":82,"context_line":"- Retrieve certificate (if it is issued)"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Administrator:"},{"line_number":86,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_a8f8c67d","line":83,"updated":"2016-02-19 16:57:36.000000000","message":"Will a user be able to check on an individual certificate? ie, if another employee leaves? Or will that be done through administrator functionality?","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"ea87a3119bee8bba2210b2170cc474fe3caf8789","unresolved":false,"context_lines":[{"line_number":80,"context_line":"- View request status"},{"line_number":81,"context_line":"- List all submitted requests for a given user and view their statuses"},{"line_number":82,"context_line":"- Retrieve certificate (if it is issued)"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Administrator:"},{"line_number":86,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7af24918_9a977347","line":83,"in_reply_to":"bae84128_a8f8c67d","updated":"2016-03-03 15:32:20.000000000","message":"TBD","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"a0d2d9537d5fb2dde501a8809ee45a4aa61384bb","unresolved":false,"context_lines":[{"line_number":97,"context_line":"- Publish a CRL"},{"line_number":98,"context_line":"- View CA health"},{"line_number":99,"context_line":"- Download an audit report of certificates issued in a time period"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"In addition to this functionality, the RA will support the following"},{"line_number":102,"context_line":"functionality to simplify operation of an internal PKI:"},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_48d65ac6","line":100,"updated":"2016-02-19 16:57:36.000000000","message":"The assumption here is that the administrator will not request a certificate (submit a CSR)? While this is done out of band is there any method for validating the details of the current trust anchor certificate (like expiry)? Also, I don\u0027t see replacing or setting a new trust anchor addressed anywhere outside the API either.","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"ea87a3119bee8bba2210b2170cc474fe3caf8789","unresolved":false,"context_lines":[{"line_number":97,"context_line":"- Publish a CRL"},{"line_number":98,"context_line":"- View CA health"},{"line_number":99,"context_line":"- Download an audit report of certificates issued in a time period"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"In addition to this functionality, the RA will support the following"},{"line_number":102,"context_line":"functionality to simplify operation of an internal PKI:"},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7af24918_bae06f97","line":100,"in_reply_to":"bae84128_48d65ac6","updated":"2016-03-03 15:32:20.000000000","message":"Yes. But there is no reason an administrator cannot also be a user. How is submitting a CSR linked to validating trust anchor details? I think this may come under View CA Health. Assumption is that the trust anchor is specified in the configuration file and not cannot be changed via the API.","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"bb27a24e68ab38b96913729bc570466543a40924","unresolved":false,"context_lines":[{"line_number":118,"context_line":"considered:"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"- Online Certificate Status Protocol (OCSP)"},{"line_number":121,"context_line":"- Automated Certificate Management Environment (ACME)"},{"line_number":122,"context_line":"- Integration with ticketing systems"},{"line_number":123,"context_line":"- Integration with orchestration frameworks"},{"line_number":124,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a2ca52d_94558f51","line":121,"updated":"2015-10-14 21:36:02.000000000","message":"I don\u0027t understand why you would want to develop a brand new API to then bolt on ACME support on top of it.\n\nAs I\u0027ve mentioned during the Security weekly meetings, I\u0027m against adding yet another Certificate Issuance API to OpenStack.\n\nI think Killick has a great opportunity to be the ACME implementation for OpenStack.  You wouldn\u0027t have to develop clients for this new API, since ACME clients would work.  Also think of how awesome it could be for the Horizon front end to be able to be pointed at Let\u0027s Encrypt.","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"ea87a3119bee8bba2210b2170cc474fe3caf8789","unresolved":false,"context_lines":[{"line_number":118,"context_line":"considered:"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"- Online Certificate Status Protocol (OCSP)"},{"line_number":121,"context_line":"- Automated Certificate Management Environment (ACME)"},{"line_number":122,"context_line":"- Integration with ticketing systems"},{"line_number":123,"context_line":"- Integration with orchestration frameworks"},{"line_number":124,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7af24918_75127858","line":121,"in_reply_to":"5a2ca52d_94558f51","updated":"2016-03-03 15:32:20.000000000","message":"Currently Killick uses the anchor API, ie you curl a CSR to a url. In the interest of keeping it working with existing processes, I do not want to change this or add complexity, but agree that ACME is worth considering.","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"aa8ea90a7960a1ed280e8d045fe8f54622a76eed","unresolved":false,"context_lines":[{"line_number":126,"context_line":"The majority of the certificate operations and validation functionality"},{"line_number":127,"context_line":"for Killick should be re-used from Anchor - this will minimize the"},{"line_number":128,"context_line":"maintenance required for Killick and as future functionality is added"},{"line_number":129,"context_line":"to Anchor, such as HSM support, Killick will automatically benefit. The"},{"line_number":130,"context_line":"Anchor validation functionality allows automatic checking of certificate"},{"line_number":131,"context_line":"request fields, such as the user/email, checking that the common name"},{"line_number":132,"context_line":"and subjectAltNames fall within the certificate policy or checking for"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_392c0e4a","line":129,"updated":"2016-02-19 15:29:17.000000000","message":"this approach is good, but you\u0027ll of course need integration tests to make sure Anchor changes don\u0027t break Killick","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"ea87a3119bee8bba2210b2170cc474fe3caf8789","unresolved":false,"context_lines":[{"line_number":126,"context_line":"The majority of the certificate operations and validation functionality"},{"line_number":127,"context_line":"for Killick should be re-used from Anchor - this will minimize the"},{"line_number":128,"context_line":"maintenance required for Killick and as future functionality is added"},{"line_number":129,"context_line":"to Anchor, such as HSM support, Killick will automatically benefit. The"},{"line_number":130,"context_line":"Anchor validation functionality allows automatic checking of certificate"},{"line_number":131,"context_line":"request fields, such as the user/email, checking that the common name"},{"line_number":132,"context_line":"and subjectAltNames fall within the certificate policy or checking for"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7af24918_1a97e3ec","line":129,"in_reply_to":"bae84128_392c0e4a","updated":"2016-03-03 15:32:20.000000000","message":"Agreed. Assumption is to pin to a specific anchor version, once anchor has versions.","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"bb27a24e68ab38b96913729bc570466543a40924","unresolved":false,"context_lines":[{"line_number":153,"context_line":"Alternatives"},{"line_number":154,"context_line":"------------"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"As discussed above, existing PKIs such as ADCS, Dogtag."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Implementation"},{"line_number":159,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a2ca52d_d49f8701","line":156,"updated":"2015-10-14 21:36:02.000000000","message":"Another alternative would be to contribute to Boulder. [1]\n\n[1] https://github.com/letsencrypt/boulder","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":538,"name":"Major Hayden","email":"major@mhtx.net","username":"rackerhacker"},"change_message_id":"986618b75cb7dd5a6567597a777d15fc02325fdd","unresolved":false,"context_lines":[{"line_number":169,"context_line":"----------"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Target Milestone for completion:"},{"line_number":172,"context_line":"  mikata-1"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"Work Items"},{"line_number":175,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_edca326e","line":172,"updated":"2015-12-01 13:42:29.000000000","message":"s/mikata/mitaka/ (minor spelling adjustment)","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"ea87a3119bee8bba2210b2170cc474fe3caf8789","unresolved":false,"context_lines":[{"line_number":169,"context_line":"----------"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Target Milestone for completion:"},{"line_number":172,"context_line":"  mikata-1"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"Work Items"},{"line_number":175,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7af24918_b5188076","line":172,"in_reply_to":"9a8ffd7b_edca326e","updated":"2016-03-03 15:32:20.000000000","message":"Done","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"aa8ea90a7960a1ed280e8d045fe8f54622a76eed","unresolved":false,"context_lines":[{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Target Milestone for completion:"},{"line_number":172,"context_line":"  mikata-1"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"Work Items"},{"line_number":175,"context_line":"----------"},{"line_number":176,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_39ba4ee2","line":173,"updated":"2016-02-19 15:29:17.000000000","message":"is this still feasible?","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"ea87a3119bee8bba2210b2170cc474fe3caf8789","unresolved":false,"context_lines":[{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Target Milestone for completion:"},{"line_number":172,"context_line":"  mikata-1"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"Work Items"},{"line_number":175,"context_line":"----------"},{"line_number":176,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7af24918_d5326cf1","line":173,"in_reply_to":"bae84128_39ba4ee2","updated":"2016-03-03 15:32:20.000000000","message":"No.","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"a0d2d9537d5fb2dde501a8809ee45a4aa61384bb","unresolved":false,"context_lines":[{"line_number":207,"context_line":"  Validator-\u003eValidator: Run Validators"},{"line_number":208,"context_line":"  Validator-\u003eRA: Validation Results (dictionary)"},{"line_number":209,"context_line":"  RA-\u003eDatabase: Write request data (request object)"},{"line_number":210,"context_line":"  RA-\u003eUser: Failure Notification (optional but default)"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"Issue Certificate"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bae84128_c31a4b6e","line":210,"range":{"start_line":210,"start_character":0,"end_line":210,"end_character":55},"updated":"2016-02-19 16:57:36.000000000","message":"This assumes failure - is this the normal Cert Submission process? Or is failure it\u0027s own block?","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"ea87a3119bee8bba2210b2170cc474fe3caf8789","unresolved":false,"context_lines":[{"line_number":207,"context_line":"  Validator-\u003eValidator: Run Validators"},{"line_number":208,"context_line":"  Validator-\u003eRA: Validation Results (dictionary)"},{"line_number":209,"context_line":"  RA-\u003eDatabase: Write request data (request object)"},{"line_number":210,"context_line":"  RA-\u003eUser: Failure Notification (optional but default)"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"Issue Certificate"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7af24918_f5a168f9","line":210,"range":{"start_line":210,"start_character":0,"end_line":210,"end_character":55},"in_reply_to":"bae84128_c31a4b6e","updated":"2016-03-03 15:32:20.000000000","message":"Its an optional block, I am choosing to be less strict diagraming in the interest of fewer near-identical diagrams requiring an eye-diff.","commit_id":"6b45359a18cca8ccfe052c266555b3c49569043e"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"ed99221afca64cd522f4429077f033fd13a3cefe","unresolved":false,"context_lines":[{"line_number":165,"context_line":"-----------"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"Primary assignee:"},{"line_number":168,"context_line":"dg"},{"line_number":169,"context_line":"tkelsey"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Milestones"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a18252c_31cb2920","line":168,"updated":"2016-04-13 21:56:18.000000000","message":"I would suggest picking a single primary assignee (as a single point of contact) and listing additional assignees separately, e.g.,\n\n    Primary assignee: dg\n\n    Additional assignees:\n\n    * tkelsey","commit_id":"6718a9488f07184757a5230c5843bf1e7b366373"}]}