Repository navigation
nexus: /v1/system/certificates APIs - #11470
Merged
Merged
Conversation
Added the following system APIs to create, read, delete, and list
certificates.
```
system_certificate_create POST /v1/system/certificates
system_certificate_delete DELETE /v1/system/certificates/{certificate}
system_certificate_list GET /v1/system/certificates
system_certificate_view GET /v1/system/certificates/{certificate}
```
These APIs are mostly identical to the current `/v1/certificates` APIs,
with the difference that callers must now specify the silo. This allows
clients that authenticate to one silo to manage the certificates for
another silo. For example, platform engineering teams that operate
within a management silo to create silos for their users.
Relates to SSE-498.
Relates to oxidecomputer/terraform-provider-oxide#875.
sudomateo
force-pushed
the
sudomateo/nlxxovkkxnqt
branch
from
October 15, 2026 00:58
d4e46dc to
08d6ec7
Compare
sudomateo
marked this pull request as ready for review
October 15, 2026 00:58
Contributor
|
Made some changes:
|
Contributor
|
Tested by prototyping the console UI in oxidecomputer/console#3410. Just want to check a couple more things before I approve. 
|
Member
Author
I left this as-is because this is also true for the The rest of the feedback makes sense. |
david-crespo
approved these changes
Oct 15, 2026
david-crespo
added a commit
that referenced
this pull request
Nov 3, 2026
Closes #11272 Deleting a silo's only certificate leaves Nexus unable to serve TLS for the silo's domain, so nobody in the silo can reach the API to upload a replacement. #11470 mitigates this by making it so fleet admins can fix this from a different silo, but it can still be a problem if it happens to the fleet admins' own silo. This PR makes `certificate_delete` error out unless another certificate exists for the same silo. The check is an `EXISTS` subquery in the same `UPDATE` that sets `time_deleted`, avoiding a TOCTOU race that would let two concurrent deletes on the last two certs both succeed. (#11109 does the same thing for unassigning a service's last IP pool.) The error is a 400. 409 could make sense, but 400 is the convention for refusing to delete; it's what we do for non-empty projects and silos, VPCs with subnets, IP pools with ranges, attached floating IPs and disks, etc.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added the following system APIs to create, read, delete, and list certificates.
These APIs are mostly identical to the current
/v1/certificatesAPIs, with the difference that callers must now specify the silo. This allows clients that authenticate to one silo to manage the certificates for another silo. For example, platform engineering teams that operate within a management silo to create silos for their users.Relates to SSE-498.
Relates to oxidecomputer/terraform-provider-oxide#875.