README.md in certmeister-0.3.0 vs README.md in certmeister-0.3.1
- old
+ new
@@ -13,22 +13,24 @@
* Requests to delete certificates are only allowed when they originate from
a secure operator network.
This allows us the convenience of Puppet's autosign feature, without the horrendous security implications.
-Certmeister is the core of a fancy web service that does this:
+This repository currently builds three gems:
-```
-cat request/client.csr | openssl x509 -req -CA CA/ca.crt -CAkey CA/ca.key -CAcreateserial -addtrust clientAuth > CA/signed/<cn>.crt
-```
+* _certmeister_ - the CA, some off-the-shelf policy modules and an in-memory cert store
+* _certmeister-redis_ - a redis-backed store
+* _certmeister-rack_ - a rack application to provide an HTTP interface to the CA
+An example, using redis and rack and enforcing Hetzner PTY Ltd's policy, is available in [contrib/config.ru](contrib/config.ru).
+
To hit the service:
```
$ curl -L \
-d "psk=secretkey" \
-d "csr=$(perl -MURI::Escape -e 'print uri_escape(join("", <STDIN>));' < fixtures/client.csr)" \
- http://certmeister.hetzner.co.za/certificate/axl.starjuice.net
+ http://localhost:9292/ca/certificate/axl.starjuice.net
```
## Testing
Because we test both certmeister and certmeister-redis with `rake spec`, you need redis up if you want to run the tests. It's easy: