Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[release-1.4] Fix check for self-signed certs in EncodeX509Chain #4238

Merged
merged 1 commit into from Jul 21, 2021
Merged

[release-1.4] Fix check for self-signed certs in EncodeX509Chain #4238

merged 1 commit into from Jul 21, 2021

Commits on Jul 21, 2021

  1. fix check for self-signed certs in EncodeX509Chain 

    see also cert-manager#4142

EncodeX509Chain checked for self-signed certs by comparing the subject
and issuer of the cert in question, which is invalid since it's
perfectly fine for those to match.

the correct behavior is to use cert.CheckSignatureFrom(cert). this bug
was exposed in 1.4 when ParseSingleCertificateChain started using
EncodeX509Chain in the critical path of several issuers; when end-users
had leaf certificates with subjects matching their issuer's subject, the
bug was triggered.

includes newly written tests for EncodeX509Chain and a test for
ParseSingleCertificateChain

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
    @SgtCoDFish
    SgtCoDFish authored and jetstack-bot committed Jul 21, 2021
    Copy the full SHA
    c686a2f View commit details
    Browse the repository at this point in the history