Certificate Identity Settings

This page documents settings for authenticating clients with an X.509 client certificate. See AssumeRoleWithCertificate for the STS endpoint that uses them.

You can establish or modify settings by defining:

  • an environment variable on the host system prior to starting or restarting the AIStor Server.
  • a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO AIStor uses the environment variable value.

Settings

Enable

Required to use certificate identity

Set to on to accept AssumeRoleWithCertificate requests.

The certificate identity API is off until you set this environment variable. AIStor reads the other settings on this page only when this variable is set, so setting them alone has no effect.

Skip verify

Optional

Set to on to accept a client certificate without checking that a trusted certificate authority issued it.

Default value: off

Use this only when debugging
MinIO AIStor takes the policy name from the certificate’s SPIFFE workload path, or from its subject common name. With this check off, any client can present a self-signed certificate naming any policy, including an administrative one, and receive credentials for it.

SPIFFE multi-domain

Optional

Set to on to qualify the policy name from a SPIFFE identity with its trust domain, giving host/path rather than path.

Default value: off

Turn this on when you accept SVIDs from more than one trust domain, so that identical workload paths in different domains map to different policies.

Credential duration

Credentials from AssumeRoleWithCertificate use their own bounds rather than the STS settings:

Bound Value
Default 1 hour
Minimum 15 minutes
Maximum 365 days

AIStor also shortens credentials that would outlive the certificate, so they expire no later than the certificate does.