Support Custom Provisioner

[loicsikidi]

Hi,

First and foremost, thank you for the wonderful work you've done so far 🚀 .

Do you plan to offer a way to add/remove custom provisioner to an instance of step-ca?

This feature could allow to provide support to:

• standard protocols: not yet developed or won't be developed by step-ca (eg. CMP, EST, etc.)
• custom protocols: provisioner that won't be developed by step-ca because to specific to a dedicated use case

The idea here (as a customer) is to have a little bit more freedom (at your own peril) regarding the provisioner catalog, especially when the context is off the beaten track.

Thank you in advance for your answers 🙏 .

[maraino]

Hi @loicsikidi, adding a custom has been in our minds for some time now, either by Go plugins or by compiling your own version with it. Registering your own provisioner is probably going to work in the same way multiple KMSs are being registered. See, for example, the init in awskms.

But provisioners are a little bit more complicated. We are currently supporting a couple of types of provisioners, SCEP and ACME have their own HTTP routers, and for the rest, we need a way to identify what token belongs to a specific provisioner, and this might not be straightforward in some cases.

[loicsikidi]

Hi @maraino,

Thank you for your feedback!

I'm in a context where the provisioner is not really a standard and I was wondering how a custom provisioner could work w/ step-ca 😄.

I'll try your idea by building my own version of the tool.

[maraino]

Right now, there's no way to register provisioners, but you can start doing that, ideally, all our standard provisioners should use the same approach, but we can leave them our for a first attempt.