From eedecdc6855dfe673c3a3306e02a32a25d6d000a Mon Sep 17 00:00:00 2001 From: Cheng Wang Date: Tue, 27 Jul 2021 21:59:11 +0800 Subject: [PATCH 1/2] Update CSR Signers description --- .../certificate-signing-requests.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md index 6d4c97df10..f27a447737 100644 --- a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -67,12 +67,11 @@ Custom signerNames can also be specified. All signers should provide information This includes: 1. **Trust distribution**: how trust (CA bundles) are distributed. -1. **Permitted subjects**: any restrictions on and behavior when a disallowed subject is requested. -1. **Permitted x509 extensions**: including IP subjectAltNames, DNS subjectAltNames, Email subjectAltNames, URI subjectAltNames etc, and behavior when a disallowed extension is requested. -1. **Permitted key usages / extended key usages**: any restrictions on and behavior when usages different than the signer-determined usages are specified in the CSR. -1. **Expiration/certificate lifetime**: whether it is fixed by the signer, configurable by the admin, determined by the CSR object etc - and the behavior when an expiration is different than the signer-determined expiration that is specified in the CSR. -1. **CA bit allowed/disallowed**: and behavior if a CSR contains a request a for a CA certificate when the signer does not permit it. +1. **Permitted subjects**: any restrictions on and the behavior when a disallowed subject is requested. +1. **Permitted x509 extensions**: including IP subjectAltNames, DNS subjectAltNames, Email subjectAltNames, URI subjectAltNames etc, and the behavior when a disallowed extension is requested. +1. **Permitted key usages / extended key usages**: any restrictions on and the behavior when usages different than the signer-determined usages are specified in the CSR. +1. **Expiration/certificate lifetime**: whether it is fixed by the signer, configurable by the admin, determined by the CSR object etc, and the behavior when an expiration is different than the signer-determined expiration that is specified in the CSR. +1. **CA bit allowed/disallowed**: the behavior if a CSR contains a request for a CA certificate when the signer does not permit it. Commonly, the `status.certificate` field contains a single PEM-encoded X.509 certificate once the CSR is approved and the certificate is issued. Some From c5c8dd48b398573010547998e68c5feef951b21a Mon Sep 17 00:00:00 2001 From: Cheng Wang Date: Wed, 28 Jul 2021 10:11:36 +0800 Subject: [PATCH 2/2] Apply suggestions from code review Co-authored-by: Jordan Liggitt --- .../access-authn-authz/certificate-signing-requests.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md index f27a447737..e5e51ac205 100644 --- a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -67,10 +67,10 @@ Custom signerNames can also be specified. All signers should provide information This includes: 1. **Trust distribution**: how trust (CA bundles) are distributed. -1. **Permitted subjects**: any restrictions on and the behavior when a disallowed subject is requested. +1. **Permitted subjects**: any restrictions on requested subjects, and the behavior when a disallowed subject is requested. 1. **Permitted x509 extensions**: including IP subjectAltNames, DNS subjectAltNames, Email subjectAltNames, URI subjectAltNames etc, and the behavior when a disallowed extension is requested. -1. **Permitted key usages / extended key usages**: any restrictions on and the behavior when usages different than the signer-determined usages are specified in the CSR. -1. **Expiration/certificate lifetime**: whether it is fixed by the signer, configurable by the admin, determined by the CSR object etc, and the behavior when an expiration is different than the signer-determined expiration that is specified in the CSR. +1. **Permitted key usages / extended key usages**: any restrictions on requested usages, and the behavior when usages different than the signer-determined usages are specified in the CSR. +1. **Expiration/certificate lifetime**: whether it is fixed by the signer, configurable by the admin, determined by the CSR object etc, and the behavior when an expiration different than the signer-determined expiration is specified in the CSR. 1. **CA bit allowed/disallowed**: the behavior if a CSR contains a request for a CA certificate when the signer does not permit it. Commonly, the `status.certificate` field contains a single PEM-encoded X.509