open-consul/.changelog/10424.txt at 0a6d683c841d1d9af255894e4ceafe0b755fdebd - luxolus/open-consul - Stateless Git Forge

luxolus/open-consul

R.B. Boyer c3d5a2a5ab

connect/ca: cease including the common name field in generated certs (#10424 )

As part of this change, we ensure that the SAN extensions are marked as
critical when the subject is empty so that AWS PCA tolerates the loss of
common names well and continues to function as a Connect CA provider.

Parts of this currently hack around a bug in crypto/x509 and can be
removed after https://go-review.googlesource.com/c/go/+/329129 lands in
a Go release.

Note: the AWS PCA tests do not run automatically, but the following
passed locally for me:

    ENABLE_AWS_PCA_TESTS=1 go test ./agent/connect/ca -run TestAWS

2021-06-25 13:00:00 -05:00

4 lines

120 B

Plaintext

Raw Blame History

	```release-note:improvement
	`connect/ca: cease including the common name field in generated x509 non-CA certificates`
	```