Skip to content

Conversation

iamjpotts
Copy link
Contributor

@iamjpotts iamjpotts commented Sep 10, 2025

Adds an example based on 0.14 that generates a certificate chain, and stores each step as PEM files, and reads from the PEM files for the next step, rather than doing all of the steps in memory.

Related:

@oscartbeaumont said he "wanted to know if there is a way to load an existing CA certificate to sign some more certificates without triggering signing."

@acul009 mentioned the api obscurity as discouraging an upgrade from 0.12 to 0.13 in #274 (comment).

This new example does not resign any certificates, instead loading the already signed certificate as an Issuer.

@djc
Copy link
Member

djc commented Sep 10, 2025

Thanks for your efforts. I'm generally pretty wary of adding too many examples since they can add maintenance costs. In this case, your example is pretty long already (200+ lines) and IMO working directly on the file system makes it less generalizable (and more likely to leave clutter around if you actually try to run it).

While I agree it could be useful to have a specific example that shows how to load an existing CA certificate without resigning, I'd prefer a more concise and focused piece of code for that.

@iamjpotts
Copy link
Contributor Author

@djc see #379 as an alternative example to this example.

@iamjpotts
Copy link
Contributor Author

Force push only renames new_unsigned_server to new_signed_server to match its behavior.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants