luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity
open-vault/changelog/16700.txt

4 lines
118 B
Plaintext
Raw Normal View History

Fix for duplicate SANs in signed certificates (#16700) * Fix for duplicate SANs in signed certificates when othernames are present in the CSR SAN extension and UseCSRValues is true. When UseCSRValues is true (as is the case on the sign-verbatim endpoint), all extensions including Subject Alternative Names are copied from the CSR to the final certificate. If the Subject Alternative Name in question contains any othernames (such as a Microsoft UPN) the SAN extension is added again as a workaround for an encoding issue (in function HandleOtherSANs). Having duplicate x509v3 extensions is invalid and is rejected by openssl on Ubuntu 20.04, and also by Go since https://github.com/golang/go/issues/50988 (including in Go 1.19). In this fix I do not add the extension from the CSR if it will be added during HandleOtherSANs. * Added unittest and changelog entry.
2022-10-07 16:19:08 +00:00
```release-note:bug
secrets/pki: Fixes duplicate otherName in certificates created by the sign-verbatim endpoint.
```