mtca: add profile and run Prepare#8886
Conversation
7fa5449 to
50fd800
Compare
aarongable
left a comment
aarongable
left a comment
There was a problem hiding this comment.
High level: I don't want to hang anything on the idea that we'll have a 1-to-1 mapping of profiles to MTCAs. That's not a hill I want to die on, it's just something kinda convenient we can do to make the performance properties of our long-lived and short-lived logs better. I'd prefer to make the assumption that we'll have multiple profiles within a single log (e.g. future versions of "classic" vs "modern") and build the code to support that today.
|
Fair enough; I'll change this to mimic the CA's config. |
This leaves multi-profile support in MTCA as a TODO, but makes the config ready to accept multiple profiles. Perhaps more importantly it reconciles the fact that issuance.ProfileConfig needs a non-empty list of profiles to let an issuer be active.
|
@jsha, this PR appears to contain configuration and/or SQL schema changes. Please ensure that a corresponding deployment ticket has been filed with the new values. |
1 similar comment
|
@jsha, this PR appears to contain configuration and/or SQL schema changes. Please ensure that a corresponding deployment ticket has been filed with the new values. |
This leaves multi-profile support in MTCA as a TODO, but makes the config ready to accept multiple profiles. Perhaps more importantly it reconciles the fact that issuance.ProfileConfig needs a non-empty list of profiles to let an issuer be active.
1ed77f3 to
cfe83ab
Compare
2 participants
Question for reviewers: we plan to always have one issuer per MTCA instance. For the medium term, we expect to also have one profile per MTCA issuance (we'll have separate issuance logs for short and long certificates).
That means the MTCA doesn't really need to know the name of its assigned profile. But this leads to a little funkiness in the JSON config. The issuance package looks at an IssuerConfig's "profiles" field to decide whether an issuer is active. If there are no profiles, the issuer is inactive.
Should we try to mimic the CA's
issuancestanza entirely, with plural fields for issuers and profiles, and error at runtime if there is more than one of each? Or should we use singular-named fields in the config to reflect the fact that we only support one?Note: this PR includes a copy of #8868. Do not merge before that PR merges.