Have webhook certificates managed by keymaster

[mooreds]

Have webhook certificates managed by keymaster

Problem

Right now I can use client cert authentication in webhooks sent by FusionAuth by pasting in a .pem file. I'd like to manage my client certs in Key Master.

Solution

Allow me to use Key Master for my client certs. Note that I can do so with the generic connector, so I think the functionality is written, just a matter of connecting it up to that view (pure speculation on my part).

Alternatives/workarounds

Continue to paste my .pem files in.

Additional context

Generic connector (where you select from managed certs):

Webhook (where you paste in your cert):

Related

• [Category] Webhooks #1543

How to vote

Please give us a thumbs up or thumbs down as a reaction to help us prioritize this feature. Feel free to comment if you have a particular need or comment on how this feature should work.

Documentation

• Document specifying webhook certificates from Key Master fusionauth-site#2594
• Document webhook.sslCertificateKeyId field on API
• Describe behavior/interaction of sslCertificate and sslCertificateKeyId on API requests
• PATCH request behavior (pending review)
• Document new field in admin UI
• Document behavior based on the Manual certificate entry toggle (the field not displayed will be erased)
• Update screenshots for admin UI (wait for other webhook features to be merged)
• Document webhook.sslCertificate as deprecated

Release Notes

Support specifying webhook SSL certificates from Key Master. Prior to this enhancement, if you needed to specify an SSL certificate, it had to be added to the webhook in PEM format. You may now store this certificate in Key Master and then use this same certificate between webhooks.
+
This change is backwards compatible, but the ability to manually specify X.509 certificates in PEM format on the webhook configuration has been deprecated and may be removed in the future. See the link:/docs/v1/tech/apis/webhooks[Webhook] API sslCertificateKeyId field for for additional details.
+

[robotdan]

We mainly haven't done this due to compatibility issues. But perhaps we can migrate this to key master and still provide some backwards compatibility.

I think this is the last hold out to join key master... so it would be nice to get this one moved over as well.

[spwitt]

Internal

• https://github.com/FusionAuth/fusionauth-app/pull/323