saltext.vault.utils.vault.pki

Vault PKI helpers

Added in version 1.1.0.

saltext.vault.utils.vault.pki.check_cert_for_changes(current: str, issuer: str, private_key: str, common_name: str, encoding: Literal['pem', 'pkcs7_pem', 'der', 'pkcs7_der'] = 'pem', common_name_only: bool = False, append_chain: list[str] | str | None = None, private_key_passphrase: str | None = None, expire_tolerance: int | str | None = None, alt_names: dict[str, str | list[str]] | list[str] | None = None, **kwargs) → dict[str, Any]

current

Path of the certificate on disk

issuer

Issuer certificate

private_key

Path of the private key on disk

common_name

CN

encoding

Requested certificate encoding

common_name_only

Skip change detection on subject fields other than CN.

append_chain

List of certificates to append. Fails with der

private_key_passphrase

Passphrase for private_key

expire_tolerance

Otherwise called ttl_remaining, minimum TTL to allow before requesting a fresh certificate.

alt_names

Requested SANs

kwargs

All other kwargs passed to the cert signing endpoint

saltext.vault.utils.vault.pki.compare_sans(cert: Certificate, alt_names: dict[str, str | list[str]] | list[str], common_name: str, exclude_cn_from_sans: bool = False) → tuple[dict[str, list[str]], Literal['added', 'changed', 'removed']] | tuple[None, None]

Compare requested DNS, EMAIL, IP, URI and other SANs against the ones present in a certificate.

saltext.vault.utils.vault.pki.norm_sans(sans: dict[str, str | list[str]] | list[str]) → dict[str, list[str]]

Normalize all allowed inputs for SubjectAlternativeNames into a dict of lists with uppercase keys.

saltext.vault.utils.vault.pki.split_sans(sans: dict[str, list[str]]) → tuple[list[str], list[str], list[str], list[str]]

Render a normalized dict of lists of SubjectAlternativeNames into a format Vault understands and return each type separately.