claw/flaskpaste
1
0
Fork 1
forked from username/flaskpaste
Code Pull Requests Activity

docs: update test count and fix pki.md inaccuracies

Browse Source 
- README: update test count from 283 to 337
- pki.md: fix environment variable names (PKI_CA_PASSWORD)
- pki.md: correct CLI usage examples (config via env/file)
- pki.md: update pki status output format
- pki.md: clarify revocation is API-only (no CLI command)
This commit is contained in:
Username
2025-12-25 19:24:17 +01:00
parent cd7a9e8340
commit 14c8d0d83d
2 changed files with 32 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
documentation/pki.md
View File

@@ -18,13 +18,14 @@ The PKI system provides:
# Download CLI
curl -o fpaste https://paste.example.com/client && chmod +x fpaste
# Configure server
./fpaste config server https://paste.example.com
# Configure server (environment or config file)
export FLASKPASTE_SERVER="https://paste.example.com"
# Or: echo "server = https://paste.example.com" >> ~/.config/fpaste/config
# Register (requires PKI password if set on server)
# Register and auto-configure
./fpaste register --configure
# Creates ~/.config/fpaste/{client.key, client.crt} and updates config
# Creates ~/.config/fpaste/{client.key, client.crt, client.p12} and updates config
```
### 2. Use Authenticated Requests
@@ -45,11 +46,12 @@ echo "secret data" | ./fpaste create
### Enable PKI
```bash
# Set PKI password (required for certificate operations)
export FLASKPASTE_PKI_PASSWORD="your-secure-password"
# Enable PKI and set CA password (required for certificate operations)
export FLASKPASTE_PKI_ENABLED=1
export FLASKPASTE_PKI_CA_PASSWORD="your-secure-password"
# Optional: enable public registration
export FLASKPASTE_REGISTRATION_ENABLED=true
# Optional: set certificate validity period (default: 365 days)
export FLASKPASTE_PKI_CERT_DAYS=365
# Start server
python run.py
@@ -75,12 +77,13 @@ curl -X POST https://paste.example.com/pki/ca \
Output:
```
PKI Status
CA initialized: yes
CA fingerprint: a1b2c3d4e5f6...
CA expires: 2034-12-25
Issued certs: 5
Revoked: 1
pki enabled: True
ca exists: True
common name: FlaskPaste CA
fingerprint: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2
created: 2024-12-25T10:30:00Z
expires: 2034-12-25T10:30:00Z
download: https://paste.example.com/pki/ca.crt
```
### Download CA Certificate
@@ -100,11 +103,17 @@ PKI Status
./fpaste pki issue -n "alice" -o ./alice-certs/ --configure
```
### Revoke Certificate (Admin)
### Revoke Certificate (API)
Certificate revocation is done via the API:
```bash
./fpaste pki status # Get serial number
./fpaste pki revoke <serial>
# Get certificate serial from /pki/certs
curl -H "X-SSL-Client-SHA1: <your-fingerprint>" https://paste.example.com/pki/certs
# Revoke by serial number
curl -X POST -H "X-SSL-Client-SHA1: <your-fingerprint>" \
https://paste.example.com/pki/revoke/<serial>
```
## Self-Signed Certificate (Offline)
@@ -167,11 +176,11 @@ backend flaskpaste
## Security Considerations
- Store PKI password securely (environment variable, secrets manager)
- Protect CA private key (encrypted with AES-256-GCM)
- Use strong proxy secret for header trust validation
- Revoke compromised certificates promptly
- Monitor audit logs for AUTH_FAILURE events
- Store `FLASKPASTE_PKI_CA_PASSWORD` securely (environment variable, secrets manager)
- CA private key is encrypted with AES-256-GCM using the password
- Use strong `FLASKPASTE_PROXY_SECRET` for header trust validation
- Revoke compromised certificates promptly via the API
- Monitor audit logs for `AUTH_FAILURE` events (revoked/expired certificates)
## API Reference