TLS: intermediate certificate verification fails with invalid dnsName

[dweomer]

I have Vault running under TLS provided by a certificate signed by an intermediate from a private PKI. When using 0.9.4 for the client and executing vault status I am seeing an error message that I did not expect:

Error checking seal status: Get https://vault.internal:8200/v1/sys/seal-status: tls: failed to parse certificate from server: x509: cannot parse dnsName "Super Private CA"

This appears to be due to a regression in Go. See golang/go#23995.

Environment:

• Vault Version: 0.9.4
• Operating System/Architecture: Linux/x86_64

Expected Behavior:

Key             Value
---             -----
Seal Type       shamir
Sealed          false
Total Shares    5
Threshold       3
Version         0.9.1
Cluster Name    vault-cluster-12345678
Cluster ID      12345678-1234-1234-1234-123456789abc
HA Enabled      true
HA Mode         active
HA Cluster      https://vault.internal:8201

Actual Behavior:

Error checking seal status: Get https://vault.internal:8200/v1/sys/seal-status: tls: failed to parse certificate from server: x509: cannot parse dnsName "Super Private CA"

Steps to Reproduce:

1. Create an intermediate CA with an "invalid" dnsName and use that to sign a certificate for Vault to serve TLS.
2. Configure Vault to use said signed certificate.
3. Attempt to communicate with said Vault, e.g. vault status

References:

• crypto/x509: verification fails with "cannot parse dnsName" in intermediate golang/go#23995

[dweomer]

I am not sure if there is anything that can be done about this (other than rebuilding Vault with Go 1.9.x instead of 1.10) but this regression renders unusable (for us) the latest (0.9.4) official Vault pre-build binaries (and hence the office image on Docker Hub).

Would it be possible to rebuild and re-issue the Vault 0.9.4 binaries with Go 1.9.x?

[jefferai]

No -- you'll need to either build Vault yourself with Go 1.9 (which will entail some backwards porting) or fix your certificates. The fact that non-DNS names were allowed previously was a bug in Go. Sorry, but we're not going to stay on Go 1.9 forever, so there's not much point in keeping it for this release...you'll have to address this issue one way or another at some point.