acme/autocert: include the domain in the SAN of the CSR

More compliant with the spec and allows autocert to work with Pebble (see letsencrypt/pebble#304). Fixes golang/go#39746. Change-Id: I0f41d5b41800d57eb53055cad248e50573c6070f GitHub-Last-Rev: 777115c GitHub-Pull-Request: golang#143 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/294389 Reviewed-by: Filippo Valsorda <[email protected]> Run-TryBot: Filippo Valsorda <[email protected]> TryBot-Result: Go Bot <[email protected]> Trust: Dmitri Shuralyov <[email protected]>
BiiChris · Mar 22, 2021 · f5c9368 · f5c9368
1 parent 4845d1f
commit f5c9368
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/acme/autocert/autocert.go b/acme/autocert/autocert.go
@@ -1133,11 +1133,11 @@ func (s *certState) tlscert() (*tls.Certificate, error) {
 	}, nil
 }
 
-// certRequest generates a CSR for the given common name cn and optional SANs.
-func certRequest(key crypto.Signer, cn string, ext []pkix.Extension, san ...string) ([]byte, error) {
+// certRequest generates a CSR for the given common name.
+func certRequest(key crypto.Signer, name string, ext []pkix.Extension) ([]byte, error) {
 	req := &x509.CertificateRequest{
-		Subject:         pkix.Name{CommonName: cn},
-		DNSNames:        san,
+		Subject:         pkix.Name{CommonName: name},
+		DNSNames:        []string{name},
 		ExtraExtensions: ext,
 	}
 	return x509.CreateCertificateRequest(rand.Reader, req, key)

diff --git a/acme/autocert/autocert_test.go b/acme/autocert/autocert_test.go
@@ -1097,7 +1097,7 @@ func TestCertRequest(t *testing.T) {
 		Id:    asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 1},
 		Value: []byte("dummy"),
 	}
-	b, err := certRequest(key, "example.org", []pkix.Extension{ext}, "san.example.org")
+	b, err := certRequest(key, "example.org", []pkix.Extension{ext})
 	if err != nil {
 		t.Fatalf("certRequest: %v", err)
 	}