Skip to content

openssl-ca command implementation for self-sign certificates#2937

Merged
skmcgrail merged 19 commits intoaws:mainfrom
skmcgrail:openssl-ca
Jan 24, 2026
Merged

openssl-ca command implementation for self-sign certificates#2937
skmcgrail merged 19 commits intoaws:mainfrom
skmcgrail:openssl-ca

Conversation

@skmcgrail
Copy link
Copy Markdown
Member

@skmcgrail skmcgrail commented Jan 9, 2026

Description of changes:

Adds a fairly limited openssl ca command that is targeted towards supporting the specific efs-utils use case for generating and self-signing a certificate.

Call-outs:

  • This only supports the self-signed certificate use case
  • Some code paths are retained to make it easier to add support for non-self-signed use cases in the future
  • A limited set of command-line options were added to support efs-utils use-case, there are more that could be added in the future. There are analogous options in the configuration file that can be provided in lieu of the missing command line arguments.
  • openssl ca has a series of "database" files that it record and tracks metadata in. Some of the behaviors like revocation checking is retained even though generation of revocations is not supported.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

Loading
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants