cert_options

Key	Type	Default
cert_options.user.require_group	string	empty
cert_options.user.require.group	string	empty
cert_options.user.require.claim	string	empty
cert_options.user.require.at_least	number	0
cert_options.user.require.at_most	number	0
cert_options.user.require.exactly	number	0
cert_options.user.require.equals	string	empty
cert_options.user.require.one_of	list	empty
cert_options.user.require.contains	string	empty
cert_options.user.require.all_of	list	empty
cert_options.user.require.any_of	list	empty
cert_options.user.valid_duration	duration	30s
cert_options.user.extensions	list	permit-pty, permit-user-rc
cert_options.user.key_id_template	string	empty
cert_options.user.lifetime_policy.default_duration	duration	0
cert_options.user.lifetime_policy.on_absent_claim	string	empty
cert_options.user.lifetime_policy.default_extensions	list	empty
cert_options.user.lifetime_policy.default_enrollment_duration	duration	0
cert_options.user.lifetime_policy.tiers	list	empty
cert_options.user.lifetime_policy.tiers[].name	string	empty
cert_options.user.lifetime_policy.tiers[].when.group	string	empty
cert_options.user.lifetime_policy.tiers[].when.claim	string	empty
cert_options.user.lifetime_policy.tiers[].when.at_least	number	0
cert_options.user.lifetime_policy.tiers[].when.at_most	number	0
cert_options.user.lifetime_policy.tiers[].when.exactly	number	0
cert_options.user.lifetime_policy.tiers[].when.equals	string	empty
cert_options.user.lifetime_policy.tiers[].when.one_of	list	empty
cert_options.user.lifetime_policy.tiers[].when.contains	string	empty
cert_options.user.lifetime_policy.tiers[].when.all_of	list	empty
cert_options.user.lifetime_policy.tiers[].when.any_of	list	empty
cert_options.user.lifetime_policy.tiers[].max_duration	duration	0
cert_options.user.lifetime_policy.tiers[].grant_extensions	list	empty
cert_options.user.lifetime_policy.tiers[].max_enrollment_duration	duration	0
cert_options.user.lifetime_policy.source_policy	list	empty
cert_options.user.lifetime_policy.source_policy[].cidr	string	empty
cert_options.user.lifetime_policy.source_policy[].max_duration	duration	0
cert_options.user.lifetime_policy.source_policy[].extensions	list	empty
cert_options.user.lifetime_policy.source_policy[].removed_extensions	list	empty
cert_options.user.lifetime_policy.source_policy[].pin_source_address	bool	false
cert_options.service.require_group	string	empty
cert_options.service.require.group	string	empty
cert_options.service.require.claim	string	empty
cert_options.service.require.at_least	number	0
cert_options.service.require.at_most	number	0
cert_options.service.require.exactly	number	0
cert_options.service.require.equals	string	empty
cert_options.service.require.one_of	list	empty
cert_options.service.require.contains	string	empty
cert_options.service.require.all_of	list	empty
cert_options.service.require.any_of	list	empty
cert_options.service.allow_user_accounts	bool	false
cert_options.service.valid_duration	duration	8760h
cert_options.service.extensions	list	empty
cert_options.service.enrollment_duration	duration	8760h
cert_options.service.key_id_template	string	empty
cert_options.service.lifetime_policy.default_duration	duration	0
cert_options.service.lifetime_policy.on_absent_claim	string	empty
cert_options.service.lifetime_policy.default_extensions	list	empty
cert_options.service.lifetime_policy.default_enrollment_duration	duration	0
cert_options.service.lifetime_policy.tiers	list	empty
cert_options.service.lifetime_policy.tiers[].name	string	empty
cert_options.service.lifetime_policy.tiers[].when.group	string	empty
cert_options.service.lifetime_policy.tiers[].when.claim	string	empty
cert_options.service.lifetime_policy.tiers[].when.at_least	number	0
cert_options.service.lifetime_policy.tiers[].when.at_most	number	0
cert_options.service.lifetime_policy.tiers[].when.exactly	number	0
cert_options.service.lifetime_policy.tiers[].when.equals	string	empty
cert_options.service.lifetime_policy.tiers[].when.one_of	list	empty
cert_options.service.lifetime_policy.tiers[].when.contains	string	empty
cert_options.service.lifetime_policy.tiers[].when.all_of	list	empty
cert_options.service.lifetime_policy.tiers[].when.any_of	list	empty
cert_options.service.lifetime_policy.tiers[].max_duration	duration	0
cert_options.service.lifetime_policy.tiers[].grant_extensions	list	empty
cert_options.service.lifetime_policy.tiers[].max_enrollment_duration	duration	0
cert_options.service.lifetime_policy.source_policy	list	empty
cert_options.service.lifetime_policy.source_policy[].cidr	string	empty
cert_options.service.lifetime_policy.source_policy[].max_duration	duration	0
cert_options.service.lifetime_policy.source_policy[].extensions	list	empty
cert_options.service.lifetime_policy.source_policy[].removed_extensions	list	empty
cert_options.service.lifetime_policy.source_policy[].pin_source_address	bool	false
cert_options.pam.require_group	string	empty
cert_options.pam.require.group	string	empty
cert_options.pam.require.claim	string	empty
cert_options.pam.require.at_least	number	0
cert_options.pam.require.at_most	number	0
cert_options.pam.require.exactly	number	0
cert_options.pam.require.equals	string	empty
cert_options.pam.require.one_of	list	empty
cert_options.pam.require.contains	string	empty
cert_options.pam.require.all_of	list	empty
cert_options.pam.require.any_of	list	empty
cert_options.pam.valid_duration	duration	30s
cert_options.pam.extensions	list	empty
cert_options.pam.key_id_template	string	empty
cert_options.pam.lifetime_policy.default_duration	duration	0
cert_options.pam.lifetime_policy.on_absent_claim	string	empty
cert_options.pam.lifetime_policy.default_extensions	list	empty
cert_options.pam.lifetime_policy.default_enrollment_duration	duration	0
cert_options.pam.lifetime_policy.tiers	list	empty
cert_options.pam.lifetime_policy.tiers[].name	string	empty
cert_options.pam.lifetime_policy.tiers[].when.group	string	empty
cert_options.pam.lifetime_policy.tiers[].when.claim	string	empty
cert_options.pam.lifetime_policy.tiers[].when.at_least	number	0
cert_options.pam.lifetime_policy.tiers[].when.at_most	number	0
cert_options.pam.lifetime_policy.tiers[].when.exactly	number	0
cert_options.pam.lifetime_policy.tiers[].when.equals	string	empty
cert_options.pam.lifetime_policy.tiers[].when.one_of	list	empty
cert_options.pam.lifetime_policy.tiers[].when.contains	string	empty
cert_options.pam.lifetime_policy.tiers[].when.all_of	list	empty
cert_options.pam.lifetime_policy.tiers[].when.any_of	list	empty
cert_options.pam.lifetime_policy.tiers[].max_duration	duration	0
cert_options.pam.lifetime_policy.tiers[].grant_extensions	list	empty
cert_options.pam.lifetime_policy.tiers[].max_enrollment_duration	duration	0
cert_options.pam.lifetime_policy.source_policy	list	empty
cert_options.pam.lifetime_policy.source_policy[].cidr	string	empty
cert_options.pam.lifetime_policy.source_policy[].max_duration	duration	0
cert_options.pam.lifetime_policy.source_policy[].extensions	list	empty
cert_options.pam.lifetime_policy.source_policy[].removed_extensions	list	empty
cert_options.pam.lifetime_policy.source_policy[].pin_source_address	bool	false
cert_options.console.require.group	string	empty
cert_options.console.require.claim	string	empty
cert_options.console.require.at_least	number	0
cert_options.console.require.at_most	number	0
cert_options.console.require.exactly	number	0
cert_options.console.require.equals	string	empty
cert_options.console.require.one_of	list	empty
cert_options.console.require.contains	string	empty
cert_options.console.require.all_of	list	empty
cert_options.console.require.any_of	list	empty
cert_options.console.allowed_networks	list	empty
cert_options.console.client_timeout	duration	2m
cert_options.console.valid_duration	duration	30s
cert_options.console.extensions	list	empty
cert_options.console.key_id_template	string	empty
cert_options.console.lifetime_policy.default_duration	duration	0
cert_options.console.lifetime_policy.on_absent_claim	string	empty
cert_options.console.lifetime_policy.default_extensions	list	empty
cert_options.console.lifetime_policy.default_enrollment_duration	duration	0
cert_options.console.lifetime_policy.tiers	list	empty
cert_options.console.lifetime_policy.tiers[].name	string	empty
cert_options.console.lifetime_policy.tiers[].when.group	string	empty
cert_options.console.lifetime_policy.tiers[].when.claim	string	empty
cert_options.console.lifetime_policy.tiers[].when.at_least	number	0
cert_options.console.lifetime_policy.tiers[].when.at_most	number	0
cert_options.console.lifetime_policy.tiers[].when.exactly	number	0
cert_options.console.lifetime_policy.tiers[].when.equals	string	empty
cert_options.console.lifetime_policy.tiers[].when.one_of	list	empty
cert_options.console.lifetime_policy.tiers[].when.contains	string	empty
cert_options.console.lifetime_policy.tiers[].when.all_of	list	empty
cert_options.console.lifetime_policy.tiers[].when.any_of	list	empty
cert_options.console.lifetime_policy.tiers[].max_duration	duration	0
cert_options.console.lifetime_policy.tiers[].grant_extensions	list	empty
cert_options.console.lifetime_policy.tiers[].max_enrollment_duration	duration	0
cert_options.console.lifetime_policy.source_policy	list	empty
cert_options.console.lifetime_policy.source_policy[].cidr	string	empty
cert_options.console.lifetime_policy.source_policy[].max_duration	duration	0
cert_options.console.lifetime_policy.source_policy[].extensions	list	empty
cert_options.console.lifetime_policy.source_policy[].removed_extensions	list	empty
cert_options.console.lifetime_policy.source_policy[].pin_source_address	bool	false
cert_options.client_timeout	duration	5m

client_timeout

duration, default 5m

The whole budget: the longest a client waiting on a certificate request can go before the server hands it a terminal answer. Everything else about request timing is derived from it, by ApprovalTTL and SigningGrace below.

The server owns this deadline rather than the client, and measures it from the request’s creation (see the request’s creation), so a client reconnecting to its event stream re-attaches to the original deadline instead of extending it. If the client is gone for good, the approval and the signature it was waiting for are moot anyway.

cert_options:
  client_timeout: 5m