Skip to content

Conversation

@arsing
Copy link
Member

@arsing arsing commented Aug 17, 2022

Copy link
Contributor

@gordonwang0 gordonwang0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's a backlogged work item to make this configurable instead of hardcoded to these algorithms. But making it consistent is a good start.

@arsing
Copy link
Member Author

arsing commented Aug 17, 2022

Ah yes, I see the work item you're talking about. It's true that configurable would be nice to have. It would also solve the problem with module certs issued through the workload API - they're currently hard-coded to RSA-2048 but I did not change them in this PR because there's no way to have them match the issuer cert's key algorithm. But if we allow the user to configure it then we can let the user make sure the algorithms match.

@arsing arsing marked this pull request as draft August 17, 2022 23:04
@arsing
Copy link
Member Author

arsing commented Aug 17, 2022

In shiproom we decided to do this after the next release branch is branched, and to implement a configuration option for this to reduce the chance of regression from switching from RSA to EC certs. So I've marked this is Draft for now.

@buentead
Copy link

I was wondering if there is an ETA for this PR to merge into main branch as I'm waiting for the fix of EST ID and Device ID certificates default to using different key types #403. Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants