<html lang="en">
<head>
	<meta http-equiv="content-type" content="text/html; charset=utf-8">
	<style>
	table, th, td {
			border: 1px solid black;
			border-collapse: collapse;
	}
	</style>
	<title>Igor Certificate Authority</title>
</head>
<body>
	<h1>Igor Certificate Authority</h1>
	
	{% if pluginData.ca %}
		<p>This Igor uses the Certificate Authority of another Igor, located at <a href="{{pluginData.ca}}">{{pluginData.ca}}</a>.</p>
	{% else %}
		<p>This Igor serves as its own certificate authority.</p>
	{% endif %}
	<p>To change this, add an entry <i>ca</i> to <a href="/data/plugindata/{{pluginName}}">/data/plugindata/{{pluginName}}</a> (or remove that entry)
	and reboot igor.</p>
	
	<h2>Root Certificate Chain</h2>
	
	<p>To trust certificates signed by this Igor CA, download the <a href="/plugin/{{pluginName}}/root">root certificate chain</a> and install in your browser or system.</p>
	
	<p>If available, the <a href="/static/crl.pem">Certificate Revocation List</a> can be downloaded too.</p>
	
	<h2>Listing all Certificates</h2>
	
	<p>To list certificates signed by this Igor CA, see the <a href="/plugin/{{pluginName}}/list">certificate listing</a>.</p>
	
	<p>Revocation user interface is not implemented yet.</p>
	
	<h2>Signing a certificate</h2>
	
	<p>Create a key and CSR (Certificate Signing Request) locally, possibly using the <i>igorCA csr</i> command (user interface not implemented yet).</p>
	
	<p>Enter the CSR in PEM for in the following field and submit:</p>
	
	<form action="/plugin/{{pluginName}}/sign">
		<textarea name="csr" rows="8" cols="60"></textarea>
		<br>
		<input type="submit" value="Sign CSR">
	</form>
	
	<p>The result is the (PEM-encoded) certificate you can use for your service (together with the key from the <i>igorCA csr</i> step).</p>

	<h2>Creating a key and certificate</h2>
	
	<p>You can also have the Igor CA module do all of the steps above for you: create a key, create a CSR and sign it. You will get
	the private key and certificate as a result (encoded in DER form and concatenated). </p>
	
	<p>Note that Igor does <i>not</i> keep a copy of the key, it is only returned to you (and used to sign the CSR). You must keep
	the key safe once you have received it.</p>
	
	<form action="/plugin/{{pluginName}}/generateKeyAndSign">
		Enter hostnames (canonical name first), one per line:<br>
		<textarea name="names" rows="4" cols="20"></textarea><br>
		Key size: 
		<select name="keysize">
			<option value="">default</option>
			<option value="2048">2048 bits (safe)</option>
			<option value="1024">1024 bits (less safe, practical for iotsa devices)</option>
			<option value="512">512 bits (considered unsafe)</option>
		</select>
		<input type="submit" value="Generate Key and Certificate">
	</form>
	
	<h2>Revoking a certificate</h2>
	
	<p>Look up the certificate sequence number (a hexadecimal string) in the <a href="/plugin/{{pluginName}}/list">certificate listing</a>.
	Enter the number in the form below to revoke it:</p>
	<form action="/plugin/{{pluginName}}/revoke">
		Certificate sequence number: <input name="number"></br>
		<input type="submit" value="Revoke Certificate">
	</form>
	<hr>
	<p><a href="/">Return to Igor homepage</a></p>
	{% if 'returnTo' in kwargs %}
		<p><a href="{{kwargs['returnTo']}}">Return to {{kwargs['returnTo']}}.</a></p>
	{% endif %}
</body>
</html>
