Change Details

**Summary** Add operational commands to display PKI private keys and certificate bundles in PEM format **Use case** OpenConnect client requires a private key in addition to the certificate, currently, VyOS provides operational commands to display CA and certificates in PEM format, for example: ``` show pki ca <name> pem ``` ``` show pki certificate <name> pem ``` It would be useful to add a system option to: - display a private key in PEM format - display a bundled PEM (certificate + private key) **Additional information** private key in PEM ``` -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- ``` ``` show pki certificate <name> private-key pem ``` bundled PEM (certificate + private key) ``` -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- ``` ``` show pki certificate <name> bundled pem ```

**Summary** Add op-mode command having ability to show certificate full chain in pem format as part of PKI configuration. **Use case** Currently, we have the following to render certificate in PEM format. - `show pki ca <NAME> pem` - `show pki certificate <NAME> pem` - `show pki certificate <NAME> private pem` But there isn’t a way to render the full chain including the intermediate CA (and the certificate perivate key if requested) for the certificate in PEM format. We need to allow users to easily export a certificate along with its CA hierarchy for use in external applications that require the full chain to be provided in a single file. So, for completeness we should have: - For `ca`:     - `show pki ca NAME pem`     - `show pki ca NAME pem full-chain` - For `certificate`:     - `show pki certificate NAME pem`     - `show pki certificate NAME pem full-chain`     - `show pki certificate NAME private pem`     - `show pki certificate NAME private pem full-chain` Additional information The security concern for exposing private key is orthogonal to the implementation. Necessary restrictions to the operator commands can be applied via `command-policy` like `set system login operator-group NAME command-policy`.

**Summary** Add operational-mode commands to display PKI priv having ability to show certificate keys and certificate bundles in PEM formatfull chain in pem format as part of PKI configuration. **Use case** OpenConnect client requires a private key in addition to the certificate, currently, VyOS provides operational commands to display CA and certificates in PEM formatCurrently, for example: ```we have the following to render certificate in PEM format. - `show pki ca <nameNAME> pem` ``` ``` - `show pki certificate <nameNAME> pem` ``` It would be useful to add a system option to: - display a private key in PEM format - display a bundled PEM (certificate + private key) **Additional information**- `show pki certificate <NAME> private pem` private key in PEM ``` -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY-----But there isn’t a way to render the full chain including the intermediate CA (and the certificate perivate key if requested) for the certificate in PEM format. ```We need to allow users to easily export a certificate along with its CA hierarchy for use in external applications that require the full chain to be provided in a single file. ``` show pki certificate <name> private-key pem ``` bundled PEM (certificate + private key)So, for completeness we should have: ``` -----BEGIN PRIVATE KEY------ For `ca`: ...    - `show pki ca NAME pem` -----END PRIVATE KEY-----    - `show pki ca NAME pem full-chain` - For `certificate`: -----BEGIN CERTIFICATE-----    - `show pki certificate NAME pem` ...    - `show pki certificate NAME pem full-chain` -----END CERTIFICATE-----    - `show pki certificate NAME private pem` ```    - `show pki certificate NAME private pem full-chain` ``` show pki certificate <name> bundled pemAdditional information ```The security concern for exposing private key is orthogonal to the implementation. Necessary restrictions to the operator commands can be applied via `command-policy` like `set system login operator-group NAME command-policy`.