README.md

   1 _certmaster -- it hands out SSL certs!_
   2
   3 read more at:
   4
   5 [Fedora Project Page](https://fedorahosted.org/certmaster/)
   6
   7 [Fedora Repo](http://git.fedorahosted.org/git/?p=certmaster.git;a=summary)
   8
   9 ---
  10
  11 ## About this fork
  12
  13 ### Multiple CA support
  14
  15 This certmaster fork introduces a new '--ca' argument for specifying an alternative certificate authority.
  16
  17 This allows one certmaste instance to supply certs from multiple authorities instead of having to have a
  18 separate certmaster instance for each certificate authority might be using.
  19
  20 If you don't want to use multiple CA's, this fork should act just like the parent certmaster project - you
  21 should be able to upgrade your existing certmaster to this version, and it will continue to server your existing certs
  22
  23 If you want to add an additional certificate authorities, add a section to your certmaster.conf file as per below
  24 for each CA, using a different name and set of directories for each CA.
  25
  26     [ca:name]
  27     autosign = yes_or_no
  28     cadir = /path/to/cadir
  29     cert_dir = /path/to/cert_dir
  30     certroot = /path/to/certroot
  31     csrroot = /path/to/csrroot
  32
  33 Then to use the new CA, include the argument '--ca=name' in your list of certmaster-ca arguments to use the 'name' CA.
  34
  35 Likewise, when requesting certs from the new CA, include a section of the following form in your minion.conf file:
  36
  37     [ca:name]
  38     cert_dir = /path/to/cert_dir
  39
  40 Then include the argument '--ca=name' in your certmaster-request commands to request a cert from the 'name' CA.
  41
  42 If the '--ca' argument is not given in the certmaster-ca or certmaster-request commands, then the original
  43 autosign, cadir, cert_dir, certroot, and csrroot options from the main section of certmaster.conf / minion.conf are used instead.
  44
  45 ### Misc Changes
  46 + 'certmaster-ca --version' reads /etc/certmaste/version instead of func's version file
  47 + certmaster-sync doesn't error out if func if not present
  48