weiguoqiang/cert-manager
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Default commonName to first altName if not specified

Browse Source
This commit is contained in:
James Munnelly 2017-10-13 12:35:25 +01:00
parent f8107e6fcc
commit 187e91f9ae
2 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/issuer/ca/issue.go
View File

@ -85,13 +85,15 @@ func (c *CA) obtainCertificate(crt *v1alpha1.Certificate, signeeKey interface{})
return crtPem, nil
}
func createCertificateTemplate(crt *v1alpha1.Certificate, publicKey interface{}) (*x509.Certificate, error) {
func createCertificateTemplate(publicKey interface{}, commonName string, altNames ...string) (*x509.Certificate, error) {
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
if err != nil {
return nil, fmt.Errorf("failed to generate serial number: %s", err.Error())
}
if len(commonName) == 0 && len(altNames) > 0 {
commonName = altNames[0]
}
cert := &x509.Certificate{
Version: 3,
BasicConstraintsValid: true,
@ -100,13 +102,13 @@ func createCertificateTemplate(crt *v1alpha1.Certificate, publicKey interface{})
PublicKey: publicKey,
Subject: pkix.Name{
Organization: []string{defaultOrganization},
CommonName: crt.Spec.CommonName,
CommonName: commonName,
},
NotBefore: time.Now(),
NotAfter: time.Now().Add(certificateDuration),
// see http://golang.org/pkg/crypto/x509/#KeyUsage
KeyUsage: x509.KeyUsageDigitalSignature,
DNSNames: crt.Spec.AltNames,
DNSNames: altNames,
}
return cert, nil
}
@ -116,7 +118,7 @@ func createCertificateTemplate(crt *v1alpha1.Certificate, publicKey interface{})
// publicKey is the public key of the signee, and signerKey is the private
// key of the signer.
func signCertificate(crt *v1alpha1.Certificate, issuerCert *x509.Certificate, publicKey interface{}, signerKey interface{}) ([]byte, *x509.Certificate, error) {
template, err := createCertificateTemplate(crt, publicKey)
template, err := createCertificateTemplate(publicKey, crt.Spec.CommonName, crt.Spec.AltNames...)
if err != nil {
return nil, nil, fmt.Errorf("error creating x509 certificate template: %s", err.Error())
}

3
pkg/util/pki/csr.go
View File

@ -6,6 +6,9 @@ import (
)
func GenerateCSR(commonName string, altNames ...string) *x509.CertificateRequest {
if commonName == "" && len(altNames) > 0 {
commonName = altNames[0]
}
template := x509.CertificateRequest{
Subject: pkix.Name{
CommonName: commonName,