certificate_complete_chain: handle duplicate intermediate subjects #403
Conversation
|
I guess one could also include a public key fingerprint into the key, but that's not always available in the intermediate / leaf certificate. The module doesn't do proper chain building (which would be required for validating a certificate) anyway, and will not properly handle cases such as multiple paths; it only does an approximation which allows to pick up the correct parts of a chain in the common case. (My personal case is: given a full chain, pick the root from the system's root store.) |
I was suggesting a fingerprint of the cert, but that's effectively the same thing as using the cert object as the key (at least with the current |
Backport to stable-1: 💚 backport PR created✅ Backport PR branch: Backported as #405 🤖 @patchback |
felixfontein
deleted the
certificate_complete_chain-intermediate-subject
branch
) * Allow multiple intermediate CAs to have same subject. * Add tests. * Fix test name. * Don't use CN for SAN. * Make a bit more compatible. * Include jinja2 compat for CentOS 6. (cherry picked from commit 11a1454)
|
@Ajpantuso thanks for reviewing this! |
) (#405) * Allow multiple intermediate CAs to have same subject. * Add tests. * Fix test name. * Don't use CN for SAN. * Make a bit more compatible. * Include jinja2 compat for CentOS 6. (cherry picked from commit 11a1454) Co-authored-by: Felix Fontein <[email protected]>
SUMMARY
Fixes #399.
ISSUE TYPE
COMPONENT NAME
certificate_complete_chain