Module io.helidon.integrations.vault.secrets.pki
Package io.helidon.integrations.vault.secrets.pki

Interface PkiSecrets

All Superinterfaces:
Secrets
public interface PkiSecrets extends Secrets
API operation for Vault PKI Secrets Engine.

  • Field Details

  • Method Details

    • list

      VaultOptionalResponse<ListSecrets.Response> list(ListSecrets.Request request)
      List certificate serial numbers.
      Specified by:
      list in interface Secrets
      Parameters:
      request - request, path is ignored
      Returns:
      serial numbers of certificates

    • caCertificate

      default X509Certificate caCertificate()
      Certification authority certificate.
      Returns:
      certificate of the CA

    • caCertificate

      default byte[] caCertificate(PkiFormat format)
      Certification authority certificate in raw bytes.
      Parameters:
      format - format to use, either DER or PEM format are supported
      Returns:
      CA certificate bytes

    • caCertificate

      CaCertificateGet.Response caCertificate(CaCertificateGet.Request request)
      Certification authority certificate.
      Parameters:
      request - request with optional PkiFormat configured
      Returns:
      CA certificate bytes

    • certificate

      default Optional<X509Certificate> certificate(String serialNumber)
      Certificate with the defined serial id.
      Parameters:
      serialNumber - serial number of the certificate
      Returns:
      certificate, if not found, an exception is returned

    • certificate

      default Optional<byte[]> certificate(String serialNumber, PkiFormat format)
      Certificate in raw bytes, currently only PkiFormat.PEM is supported.
      Parameters:
      serialNumber - serial number of the certificate
      format - format - must be PkiFormat.PEM
      Returns:
      certificate bytes in PEM format

    • certificate

      VaultOptionalResponse<CertificateGet.Response> certificate(CertificateGet.Request request)
      Get a certificate.
      Parameters:
      request - certificate request with at least the serial number
      Returns:
      get certificate response

    • crl

      default X509CRL crl()
      Certificate revocation list.
      Returns:
      revoke list

    • crl

      default byte[] crl(PkiFormat format)
      Certificate revocation list in raw bytes.
      Parameters:
      format - to choose between PEM and DER encoding of the list
      Returns:
      CRL bytes

    • crl

      CrlGet.Response crl(CrlGet.Request request)
      Get a CRL (certificate revocation list).
      Parameters:
      request - get CRL request
      Returns:
      get CRL response

    • issueCertificate

      IssueCertificate.Response issueCertificate(IssueCertificate.Request request)
      Issue a new certificate returning raw data.

      The format of data returned depends on the PkiFormat chosen:

      Parameters:
      request - configuration of the new certificate
      Returns:
      certificate response with bytes of returned certificates

    • signCertificateRequest

      SignCsr.Response signCertificateRequest(SignCsr.Request request)
      This endpoint signs a new certificate based upon the provided CSR and the supplied parameters, subject to the restrictions contained in the role named in the endpoint.
      Parameters:
      request - sign CSR request
      Returns:
      a new certificate

    • revokeCertificate

      default Instant revokeCertificate(String serialNumber)
      Revoke a certificate by its serial number.
      Parameters:
      serialNumber - serial number of the certificate to revoke
      Returns:
      revocation instant

    • revokeCertificate

      RevokeCertificate.Response revokeCertificate(RevokeCertificate.Request request)
      Revoke a certificate.
      Parameters:
      request - revoke certificate request with at least the certificate serial number
      Returns:
      revoke certificate response

    • generateSelfSignedRoot

      default GenerateSelfSignedRoot.Response generateSelfSignedRoot(String commonName)
      Generate a self signed root certificate. This operations makes sense for testing. For production environments, this would most likely be initialized with an explicit key and certificate.
      Parameters:
      commonName - the common name (cn) of the certificate
      Returns:
      when request finishes

    • generateSelfSignedRoot

      GenerateSelfSignedRoot.Response generateSelfSignedRoot(GenerateSelfSignedRoot.Request request)
      Generate a self signed root certificate. This operations makes sense for testing. For production environments, this would most likely be initialized with an explicit key and certificate.
      Parameters:
      request - generate self signed root request with at least the common name configured
      Returns:
      generate self signed root response

    • createOrUpdateRole

      PkiRole.Response createOrUpdateRole(PkiRole.Request request)
      This endpoint creates or updates the role definition. Note that the PkiRole.Request.addAllowedDomain(String), PkiRole.Request.allowSubDomains(boolean), PkiRole.Request.allowGlobDomains(boolean), and PkiRole.Request.allowAnyName(boolean) are additive; between these options, and across multiple roles, nearly any issuing policy can be accommodated. PkiRole.Request.serverFlag(boolean), PkiRole.Request.clientFlag(boolean), and PkiRole.Request.codeSigningFlag(boolean) are additive as well. If a client requests a certificate that is not allowed by the CN policy in the role, the request is denied.
      Parameters:
      request - request modifying the role
      Returns:
      when request finishes