PyADCS Connector is an ILM connector for Microsoft ADCS, called by ILM Core to issue, renew, revoke, and discover certificates over WinRM.
PyADCS Connector is the implementation of the following Function Groups and Kinds:
| Function Group | Kind |
|---|---|
Authority Provider |
PyADCS-WinRM |
Discovery Provider |
PyADCS-WinRM |
PyADCS Connector is the implementation of certificate management for Microsoft ADCS that is compatible with the v2 client operations interface. The Connector is currently developed to work with through the WinRM protocol.
It is expected that the SSH PowerShell will be supported in the future.
PyADCS Connector allows you to perform the following operations:
Authority Provider
- Issue certificate
- Renew certificate
- Revoke certificate
Discovery Provider
- Discover certificates
PyADCS Connector requires the PostgreSQL 14+ database version.
PyADCS Connector is provided as a Docker container. Pull the image with docker pull hub.omnitrustregistry.com/ilm/pyadcs-connector:tagname. It can be configured using the following environment variables:
| Variable | Description | Required | Default value |
|---|---|---|---|
DATABASE_HOST |
Database host |  |
localhost |
DATABASE_PORT |
Database port | |
5432 |
DATABASE_NAME |
PostgreSQL database name |  |
N/A |
DATABASE_USER |
Username to access the database | |
N/A |
DATABASE_PASSWORD |
Password to access the database | |
N/A |
DATABASE_SCHEMA |
Database schema to use | |
pyadcs |
LOG_LEVEL |
Logging level, allowed values are INFO, DEBUG, ERROR, WARN |
|
INFO |
ADCS_SEARCH_PAGE_SIZE |
Number of entries to return in one page | |
1000 |
ADCS_ISSUE_POLLING_INTERVAL |
Interval in milliseconds to poll for issued certificates | |
100 |
ADCS_ISSUE_POLLING_TIMEOUT |
Timeout in milliseconds to wait for issued certificates | |
3000 |
GUNICORN_WORKERS |
Number of Gunicorn worker processes | |
CPU count |
GUNICORN_THREADS |
Number of threads per Gunicorn worker | |
4 |
CERTIFICATE_CLEANUP_ENABLED |
Enables the scheduled orphaned-certificate cleanup | |
true |
CERTIFICATE_CLEANUP_INTERVAL_SECONDS |
Interval in seconds between orphaned-certificate cleanup runs | |
86400 |
CERTIFICATE_CLEANUP_BATCH_SIZE |
Certificates deleted per transaction by the cleanup | |
1000 |
PyADCS Connector runs a scheduled background task that removes orphaned certificate records left behind by interrupted or failed operations. It is controlled by three environment variables:
CERTIFICATE_CLEANUP_ENABLED— enables or disables the scheduled cleanup (defaulttrue).CERTIFICATE_CLEANUP_INTERVAL_SECONDS— interval, in seconds, between cleanup runs (default86400, i.e. once a day).CERTIFICATE_CLEANUP_BATCH_SIZE— how many certificates are removed per transaction (default1000). The cleanup deletes in batches and releases its lock between them, so a large backlog cannot hold up certificate discovery.
The cleanup runs in a background thread of the served application, at most once per interval across all workers. Two deployment notes: manage.py runserver also starts it (set CERTIFICATE_CLEANUP_ENABLED=false for local development if that is unwanted), and Gunicorn must not be run with --preload, which imports the application in the pre-fork master so the thread starts there and is not inherited by the workers, moving the cleanup outside the worker lifecycle.