3 people 4584aff32b feat: let plugins store a CA-signed certificate on a credential (#1764) ...

A credential that carries an SSH key can already hold a CA-signed
certificate, but the only way to fill it in is the credentials editor.
A plugin that issues certificates has no way to keep the credential in
step, so after a renewal it keeps presenting the previous certificate
and the connection fails much later with a generic authentication error.

ctx.credentials.setSshKeyCertificate stores one on a key credential the
acting user owns, or clears it with null. It needs credentials:write and
the core credentials.update permission, refuses anything that is not a
key credential because core never sends a certificate for the other auth
types, and is audited like the other ctx.credentials writes.

Co-authored-by: Stefan Wienert <stefan@piratopedia.de>
Co-authored-by: LukeGus <bugattiguy527@gmail.com>

2026-11-06 20:49:36 -06:00

..

plugin-sdk

feat: let plugins store a CA-signed certificate on a credential (#1764)

2026-11-06 20:49:36 -06:00