pki

hashicorp/vault#8690
Original Vault Issue Comment: hashicorp/vault#8690 (comment)

Old Issue that tracked the completion of the RA API which enables a plugin like architecture for new backends: smallstep/certificates#343

This issue was migrated from Pagure Issue #3199. Originally filed by rcritten (@rcritten) on 2020-08-03 15:59:52:

• Assigned to nobody

IPA can be installed in a CA-less configuration with the user providing the certificates required for operation. Running ipa-healthcheck with this will generate quite a few pk

During our last meeting, we discussed how should the server/the client compute the commitment:

• Main concern: server is using a static salt which would allow an attacker to test whether keys exist in the tree
  => client sends salt along with the registration
  => need secure PRNG

• How to ensure the server is using the right commitment scheme? Client should verify with the scheme specified

Details of the scenario you tried and the problem that is occurring:
In the resource CertificateImport there should be no need to have the non-mandatory parameter Ensure in the Get-TargetResource function.

https://github.com/PowerShell/CertificateDsc/blob/6906fc5b31a783a899260c9c9d4ba84a02dd4c14/Modules/CertificateDsc/DSCResources/MSFT_CertificateImport/MSFT_CertificateImport.psm1#L65-