Bug tls certs not created with correct SANs #16959
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tgross
requested changes
Apr 21, 2023
There was a problem hiding this comment.
Hi @lhaig! I've left comments on some areas that need work. Also, we have a bunch of TLS certs used for unit testing in helper/tlsutil/testdata. To really make sure this is all right, let's do the following:
- Regenerate all the certs in
helper/tlsutil/testdata - Make sure all the unit tests pass with those new certs
- Add a README.md to
helper/tlsutil/testdatathat describes the exact commands used to generate those certs.
Nomad requires there to be a `server.global.nomad` alternative name in the certificate when you enable TLS on a cluster.
Added logic to detect custom domain and region configuration. Ad tests for custom domains
Refactor record preparation to make things simpler
Fix lint errors
Fix Errors due to crypto/x509 verify being updated to require ServerName
Add a server certificate for testing the server.
Fix recordPreperation that was overwriting additional domains Improved tests as per suggestion from @tgross
schmichael
approved these changes
May 19, 2023
Co-authored-by: Tim Gross <[email protected]>
remove debug code Co-authored-by: Tim Gross <[email protected]>
Generated additional certificates for testing TLS misconfiguration. Removed last cfssl generated certificates. updated testdata readme with new instructions.
Added the Key usage to the cli certificate. Updated the tests to match Updated the cert-crete.mdx file added some notes to the upgrade-specific.mdx file for the deprecation
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The
nomad tls certcommand did not create certificates with the correct SANs for them to work with non default domain and region names.This PR updates the code to support non default domains and regions in the certificates.