This repository has been archived by the owner on Jan 4, 2021. It is now read-only.
(#550) intermediate certificate chains #552
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
vjanelle
force-pushed
the
support_intermediate_certs_and_san
branch
from
3418f3f
to
b2a3a45
Compare
ripienaar
reviewed
Dec 12, 2018
vjanelle
force-pushed
the
support_intermediate_certs_and_san
branch
2 times, most recently
from
d938068
to
6694922
Compare
|
@ripienaar tests added. Couldn't see that many spots where the difference was relevant. Trying to use Trying to batch them all up so that I could use SSL::StoreContext to verify didn't work either. |
vjanelle
force-pushed
the
support_intermediate_certs_and_san
branch
from
6694922
to
4614590
Compare
ripienaar
suggested changes
Dec 14, 2018
vjanelle
force-pushed
the
support_intermediate_certs_and_san
branch
from
4614590
to
d56fe2c
Compare
For bonus effort, this will also test SANs by moving the validation logic to openssl, instead of trying to parse the CN out of the subject. Contains ruby 2.4/2.5 compat for OpenSSL::SSL::Context depreciating the use of `extra_cert_chain` - the ruby shipped with puppet 5.X is behind a revision. Ruby's OpenSSL doesn't make this easy, which I suspect is more to do with OpenSSL than Ruby. There are alternatives which reduce some of this, like R509 but haven't investigated them yet. * Add intermediate certificate processing - hacky :( * Add intermediate chain certs * Add spec tests to validate intermediate chain handling * Add something to detect `/usr/bin/false` vs `/bin/false` because no one can agree where it goes.
vjanelle
force-pushed
the
support_intermediate_certs_and_san
branch
from
d56fe2c
to
2614283
Compare
|
@ripienaar done. |
ripienaar
approved these changes
Dec 16, 2018
|
nicely done thanks, will do some testing next week! |
|
Hmm, guess there’s no spec tests around show_config? |
|
nah for the applications i generally cant be bothered writing tests |
|
Looks like I broker security/choria.rb too (at least the tests) when using the ruby choria server. |
vjanelle
added a commit
to vjanelle/mcollective-choria
that referenced
this pull request
Dec 17, 2018
Changing the method in choria-legacy#552, didn't notice it was being used elsewhere (and hidden by mocking) - broke use of it downstream in the security provider and in `mco choria show_config`. Fix use of methods.
|
@ripienaar fixed in #554 |
vjanelle
added a commit
to vjanelle/mcollective-choria
that referenced
this pull request
Dec 17, 2018
Changing the method in choria-legacy#552, didn't notice it was being used elsewhere (and hidden by mocking) - broke use of it downstream in the security provider and in `mco choria show_config`. Fix use of methods.
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
For bonus effort, this will also test SANs by moving the validation
logic to openssl, instead of trying to parse the CN out of the subject.
Contains ruby 2.4/2.5 compat for OpenSSL::SSL::Context depreciating the
use of
extra_cert_chain- the ruby shipped with puppet 5.X is behinda revision.