[Pki-devel] [PATCH] Lightweight CAs

[Endi Sukma Dewata]

On 9/18/2015 1:46 PM, Ade Lee wrote:
>> 6. Assuming authority DN is unique, we can add --issuer <DN> option
>> tothese commands:
>> * pki ca-cert-find --issuer <dn>
>> * pki ca-cert-request-submit --issuer <dn>
>> * pki client-cert-find --issuer <dn>
>> * pki client-cert-request --issuer <dn>
>>
>
> If we do this, then we need to be sure that the DN is normalized - both
> on input -- ie. when the subca is created (we need to do this in any
> case) and also on processing in the CLI.
>
> I'm ok with offering this as an option (maybe --issuer_dn), but the
> primary (and initially required option) will be using UUID.  We can
> defer this mechanism to another ticket/patch.  Please open one.

Per IRC discussion we agreed with these options:
* --issuer-id <ID>
* --issuer-dn <DN>
to be added to the ca-cert-* and client-cert-request commands.

For the client-cert-find command we can only provide this option:
* --issuer-dn <DN>
since issuer ID is irrelevant on the client.

Personally I think the issuer DN would be more useful since that's the 
value that you see in certificates, so it's more consistent everywhere, 
and no need to do a lookup to find the issuer ID. Also, although most 
likely we will copy & paste the ID or DN anyway, the DN is easier to 
read and confirm that you're submitting the request to the right authority.

-- 
Endi S. Dewata