You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Validate CN and/or SAN in certificate matches external dns zone during RSS. #4045
Looking a lil more, we should probably do this not just during RSS but at Silo & Certificate creation in general. You can easily run into this just by creating a silo and giving it a mismatched cert.
Activity
augustuswm commentedon Sep 7, 2023
This would be useful as another preflight tool that could be run once a cert has been uploaded and the
external_dns_zone_namevalue has been set.luqmana commentedon Sep 7, 2023
Yup, we already do some basic validation like making sure the cert and key match up. So good to catch this earlier as well.
leftwo commentedon Sep 7, 2023
Yeah, there is only so much we can do but any additional verification we can do before running RSS would be great.
jgallagher commentedon Sep 7, 2023
#3436 has a bunch of extra checks that we can do at wicketd-upload time, but it fell off my radar. I'll try to get back to it soon.
luqmana commentedon Sep 7, 2023
Looking a lil more, we should probably do this not just during RSS but at Silo & Certificate creation in general. You can easily run into this just by creating a silo and giving it a mismatched cert.
[wicket] Add hostname and purpose checks to uploaded SSL certs (#4086)
Add hostname validation to certs uploaded to nexus (#4100)