connect/ca: cease including the common name field in generated certs #10424
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
theme/certificates
rboyer
commented
Jun 17, 2021
rboyer
commented
Jun 17, 2021
| @@ -0,0 +1,122 @@ | |||
| package connect | |||
There was a problem hiding this comment.
This can all go away with golang/go#46810
|
Parts of this can be cleaned up after golang/go#46810 (or something like it) lands. |
rboyer
commented
Jun 17, 2021
| @@ -487,8 +471,12 @@ func (c *ConsulProvider) SignIntermediate(csr *x509.CertificateRequest) (string, | |||
| effectiveNow := time.Now().Add(-1 * CertificateTimeDriftBuffer) | |||
| template := x509.Certificate{ | |||
There was a problem hiding this comment.
This blob threw me until I found it.
This spot in the code accepts a CSR but does not pass that CSR off to the crypto/x509 package or anything of the sort. The incoming CSR has select fields plucked out of it to assign to the newly generated intermediate cert.
I'd done an overmatch during cleanup and stripped the Subject: csr.Subject, line from this function which super broke intermediate certs (which only put data in the Subject/CN field). For now I modified this to handle this more like how a CSR should operate and copy the various SAN fields along with the Subject and any provided ExtraExtensions as-is.
We can discuss if the CA certs themselves should be using SAN fields, too, but the CN fields for those things are less awful to construct so it's fine to keep them for now.
There was a problem hiding this comment.
FWIW, if we're not going to use CN everywhere else, it probably makes sense to stop using it for the CA and reflect that in the TLS utilities. Is there a reason not to?
There was a problem hiding this comment.
AWS PCA requires a CN field to be populated in order to create the Root CA. From what I can tell you can't set SAN fields on the root CA.
There was a problem hiding this comment.
Interesting! Seems to align with that I'm finding in https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 and https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.4 where the Subject/CN is required.
It might be nice to document the reasoning for "CN only in the CA", just not sure where.
rboyer
commented
Jun 17, 2021
rboyer
commented
Jun 17, 2021
rboyer
commented
Jun 17, 2021
picatz
reviewed
Jun 18, 2021
| @@ -487,8 +471,12 @@ func (c *ConsulProvider) SignIntermediate(csr *x509.CertificateRequest) (string, | |||
| effectiveNow := time.Now().Add(-1 * CertificateTimeDriftBuffer) | |||
| template := x509.Certificate{ | |||
There was a problem hiding this comment.
FWIW, if we're not going to use CN everywhere else, it probably makes sense to stop using it for the CA and reflect that in the TLS utilities. Is there a reason not to?
rboyer
commented
Jun 18, 2021
rboyer
commented
Jun 18, 2021
dclaisse
added a commit
to dclaisse/consul
that referenced
this pull request
Oct 4, 2022
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
dclaisse
added a commit
to dclaisse/consul
that referenced
this pull request
Oct 4, 2022
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
dclaisse
added a commit
to dclaisse/consul
that referenced
this pull request
Oct 5, 2022
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
dclaisse
added a commit
to dclaisse/consul
that referenced
this pull request
Oct 5, 2022
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
dclaisse
added a commit
to dclaisse/consul
that referenced
this pull request
Oct 5, 2022
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
dclaisse
added a commit
to dclaisse/consul
that referenced
this pull request
Oct 5, 2022
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
dclaisse
added a commit
to criteo-forks/consul
that referenced
this pull request
Oct 5, 2022
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
dclaisse
added a commit
to criteo-forks/consul
that referenced
this pull request
Oct 7, 2022
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
dclaisse
added a commit
to criteo-forks/consul
that referenced
this pull request
Oct 10, 2022
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
dclaisse
added a commit
to criteo-forks/consul
that referenced
this pull request
Oct 18, 2022
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
dclaisse
added a commit
to criteo-forks/consul
that referenced
this pull request
Oct 24, 2022
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
dclaisse
added a commit
to criteo-forks/consul
that referenced
this pull request
Nov 15, 2022
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mbrulatout
pushed a commit
to criteo-forks/consul
that referenced
this pull request
Mar 31, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mbrulatout
pushed a commit
to criteo-forks/consul
that referenced
this pull request
Apr 3, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mbrulatout
pushed a commit
to criteo-forks/consul
that referenced
this pull request
Apr 3, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mbrulatout
pushed a commit
to criteo-forks/consul
that referenced
this pull request
Apr 18, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mbrulatout
pushed a commit
to criteo-forks/consul
that referenced
this pull request
May 23, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mbrulatout
pushed a commit
to criteo-forks/consul
that referenced
this pull request
May 26, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mougams
pushed a commit
to mougams/consul
that referenced
this pull request
Jun 7, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mougams
pushed a commit
to criteo-forks/consul
that referenced
this pull request
Jun 9, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mbrulatout
pushed a commit
to criteo-forks/consul
that referenced
this pull request
Jun 9, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mbrulatout
pushed a commit
to criteo-forks/consul
that referenced
this pull request
Jun 9, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mougams
pushed a commit
to mougams/consul
that referenced
this pull request
Jul 11, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mougams
pushed a commit
to mougams/consul
that referenced
this pull request
Jul 11, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mougams
pushed a commit
to criteo-forks/consul
that referenced
this pull request
Jul 11, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mbrulatout
pushed a commit
to criteo-forks/consul
that referenced
this pull request
Dec 12, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mbrulatout
pushed a commit
to criteo-forks/consul
that referenced
this pull request
Dec 28, 2023
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mbrulatout
pushed a commit
to criteo-forks/consul
that referenced
this pull request
Apr 23, 2024
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
mbrulatout
pushed a commit
to criteo-forks/consul
that referenced
this pull request
May 6, 2024
hashicorp#10424 introduced a regression, because it removed common name also for secondary CA intermediate certificate, which used the same code path. This violates RFC 5280, which mandates that Issuer CN must not be empty and equal to Subject CN of subordinate certificate. Partially revert this patch to fix consul provider, and add a test case to prevent future regressions.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
As part of this change, we ensure that the SAN extensions are marked as
critical when the subject is empty so that AWS PCA tolerates the loss of
common names well and continues to function as a Connect CA provider.
Parts of this currently hack around a bug in crypto/x509 and can be
removed after https://go-review.googlesource.com/c/go/+/329129 lands in
a Go release.
Note: the AWS PCA tests do not run automatically, but the following
passed locally for me:
The only remaining place that we use a CommonName in certs is for CA certs themselves, since they don't get SAN fields.