Skip to content

Conversation

iamjpotts
Copy link
Contributor

@iamjpotts iamjpotts commented Sep 10, 2025

Adds an example based on 0.14 that generates a certificate chain, and stores each step as PEM files, and reads from the PEM files for the next step, rather than doing all of the steps in memory.

Related:

@oscartbeaumont said he "wanted to know if there is a way to load an existing CA certificate to sign some more certificates without triggering signing."

@acul009 mentioned the api obscurity as discouraging an upgrade from 0.12 to 0.13 in #274 (comment).

This new example does not resign any certificates, instead loading the already signed certificate as an Issuer.

@djc
Copy link
Member

djc commented Sep 10, 2025

Thanks for your efforts. I'm generally pretty wary of adding too many examples since they can add maintenance costs. In this case, your example is pretty long already (200+ lines) and IMO working directly on the file system makes it less generalizable (and more likely to leave clutter around if you actually try to run it).

While I agree it could be useful to have a specific example that shows how to load an existing CA certificate without resigning, I'd prefer a more concise and focused piece of code for that.

@iamjpotts
Copy link
Contributor Author

@djc see #379 as an alternative example to this example.

@iamjpotts
Copy link
Contributor Author

Force push only renames new_unsigned_server to new_signed_server to match its behavior.

@iamjpotts
Copy link
Contributor Author

Replaced by #379.

@iamjpotts iamjpotts closed this Oct 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants