weiguoqiang/cert-manager
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Default commonName to first altName if not specified

Browse Source
This commit is contained in:
James Munnelly 2017-10-13 12:35:25 +01:00
parent f8107e6fcc
commit 187e91f9ae
2 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/issuer/ca/issue.go
View File

@ -85,13 +85,15 @@ func (c *CA) obtainCertificate(crt *v1alpha1.Certificate, signeeKey interface{})
return crtPem, nil return crtPem, nil
} }
func createCertificateTemplate(crt *v1alpha1.Certificate, publicKey interface{}) (*x509.Certificate, error) { func createCertificateTemplate(publicKey interface{}, commonName string, altNames ...string) (*x509.Certificate, error) {
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit) serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to generate serial number: %s", err.Error()) return nil, fmt.Errorf("failed to generate serial number: %s", err.Error())
} }
if len(commonName) == 0 && len(altNames) > 0 {
commonName = altNames[0]
}
cert := &x509.Certificate{ cert := &x509.Certificate{
Version: 3, Version: 3,
BasicConstraintsValid: true, BasicConstraintsValid: true,
@ -100,13 +102,13 @@ func createCertificateTemplate(crt *v1alpha1.Certificate, publicKey interface{})
PublicKey: publicKey, PublicKey: publicKey,
Subject: pkix.Name{ Subject: pkix.Name{
Organization: []string{defaultOrganization}, Organization: []string{defaultOrganization},
CommonName: crt.Spec.CommonName, CommonName: commonName,
}, },
NotBefore: time.Now(), NotBefore: time.Now(),
NotAfter: time.Now().Add(certificateDuration), NotAfter: time.Now().Add(certificateDuration),
// see http://golang.org/pkg/crypto/x509/#KeyUsage // see http://golang.org/pkg/crypto/x509/#KeyUsage
KeyUsage: x509.KeyUsageDigitalSignature, KeyUsage: x509.KeyUsageDigitalSignature,
DNSNames: crt.Spec.AltNames, DNSNames: altNames,
} }
return cert, nil return cert, nil
} }
@ -116,7 +118,7 @@ func createCertificateTemplate(crt *v1alpha1.Certificate, publicKey interface{})
// publicKey is the public key of the signee, and signerKey is the private // publicKey is the public key of the signee, and signerKey is the private
// key of the signer. // key of the signer.
func signCertificate(crt *v1alpha1.Certificate, issuerCert *x509.Certificate, publicKey interface{}, signerKey interface{}) ([]byte, *x509.Certificate, error) { func signCertificate(crt *v1alpha1.Certificate, issuerCert *x509.Certificate, publicKey interface{}, signerKey interface{}) ([]byte, *x509.Certificate, error) {
template, err := createCertificateTemplate(crt, publicKey) template, err := createCertificateTemplate(publicKey, crt.Spec.CommonName, crt.Spec.AltNames...)
if err != nil { if err != nil {
return nil, nil, fmt.Errorf("error creating x509 certificate template: %s", err.Error()) return nil, nil, fmt.Errorf("error creating x509 certificate template: %s", err.Error())
} }

3
pkg/util/pki/csr.go
View File

@ -6,6 +6,9 @@ import (
) )
func GenerateCSR(commonName string, altNames ...string) *x509.CertificateRequest { func GenerateCSR(commonName string, altNames ...string) *x509.CertificateRequest {
if commonName == "" && len(altNames) > 0 {
commonName = altNames[0]
}
template := x509.CertificateRequest{ template := x509.CertificateRequest{
Subject: pkix.Name{ Subject: pkix.Name{
CommonName: commonName, CommonName: commonName,