tree e2b8e2e3d9aa83ca7f650f2a0d972023869c1d3b
parent e47ace84cb3e30375dcb4236c17ee9710a77a6ad
author Lorenz Brun <lorenz@nexantic.com> 1572518430 +0100
committer Lorenz Brun <lorenz@nexantic.com> 1572518430 +0100

Added bootstrap CA

This adds a self-contained CA for bootstrapping and securing etcd
using certificates of infinite duration and a CRL for near-instant
revocation.

The bootstrapping problem is addressed by first
generating the CA and issuing initial certificates and then
injecting them once the consensus system is up and running.
All files are also kept on the encrypted persistent data store to
prevent the same bootstrapping problem when the node is already
initialized. The CRL is synchronized using a sync loop on every
node running the consensus service and distributed inside that.

The CA uses Ed25519-based cryptography and identifies the
hosts by their external hostname.

Test Plan:
Initial bootstrapping manually tested on a single node using a
manual gRPC call for Setup() and openssl s_client for connecting
to etcd.

X-Origin-Diff: phab/D233
GitOrigin-RevId: bd67818b5b649b13e0c098e480059ef990826542