Skip to content
This repository has been archived by the owner on Aug 25, 2021. It is now read-only.

Fix bug with quotes in the DNS SAN for server tls certs #538

Merged
merged 2 commits into from
Jul 10, 2020

Conversation

lkysow
Copy link
Member

@lkysow lkysow commented Jul 10, 2020

In order to use both * for the DNS name and also interpolate the
$NAMESPACE environment variable we need to disable globbing.

Adds set -o noglob to #536.

stokkie90 and others added 2 commits July 10, 2020 09:53
In order to use both * for the DNS name and also interpolate the
$NAMESPACE environment variable we need to disable globbing.
@lkysow
Copy link
Member Author

lkysow commented Jul 10, 2020

Tested by running an install with

global:
  tls:
    enabled: true
  acls:
    manageSystemACLs: true

The install succeeds.

The cert:

k get secret consul-consul-server-cert -o json|jq -r '.data["tls.crt"]'|base64 -D|openssl x509 -text  -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            24:43:b8:e8:31:0e:85:51:08:ef:95:93:f5:3f:19:e5
    Signature Algorithm: ecdsa-with-SHA256
        Issuer: C=US, ST=CA, L=San Francisco/street=101 Second Street/postalCode=94105, O=HashiCorp Inc., CN=Consul Agent CA 165445144223043724848113545314051398967
        Validity
            Not Before: Jul 10 16:57:19 2020 GMT
            Not After : Jul 10 16:57:19 2022 GMT
        Subject: CN=server.dc1.consul
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:57:26:47:d1:62:eb:59:15:94:5d:8c:1e:23:21:
                    82:80:5d:16:3d:2a:5b:3b:36:f5:a6:93:47:40:39:
                    a3:21:99:e2:86:d0:43:ad:50:ae:34:52:25:89:08:
                    a3:8e:6f:45:e1:aa:f9:f3:90:6a:a2:54:36:26:26:
                    64:36:95:69:79
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier:
                AB:D0:00:C1:43:BA:1E:7B:87:7D:68:1D:DE:41:7A:67:36:28:E7:FE:89:72:5D:97:2E:C9:F0:C4:1D:FB:C1:53
            X509v3 Authority Key Identifier:
                keyid:12:D9:4B:9E:08:CC:83:C1:11:90:50:CC:0D:40:AF:D3:1C:2E:02:0F:F0:0A:FA:CC:DE:B2:F2:9B:12:AB:28:AF

            X509v3 Subject Alternative Name:
                DNS:consul-consul-server, DNS:*.consul-consul-server, DNS:*.consul-consul-server.default, DNS:*.consul-consul-server.default.svc, DNS:*.server.dc1.consul, DNS:server.dc1.consul, DNS:localhost, IP Address:127.0.0.1
    Signature Algorithm: ecdsa-with-SHA256
         30:44:02:20:0a:50:49:20:86:8a:57:25:25:58:e1:9e:34:b6:
         a1:ad:c7:0c:08:16:86:44:c4:d8:61:09:be:3a:64:fe:63:b8:
         02:20:22:16:1d:59:02:66:b8:69:a8:3e:bb:15:5c:ac:c5:36:
         eb:31:97:61:53:78:21:74:03:64:05:40:2f:f9:94:b4

@lkysow lkysow requested review from a team, kschoche and ishustava and removed request for a team July 10, 2020 16:57
Copy link
Contributor

@kschoche kschoche left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great, bonus points for nice cleanup of the mixed " ' s

Copy link
Contributor

@ishustava ishustava left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've tested this out! looks great!

@lkysow lkysow merged commit 35d1973 into master Jul 10, 2020
@lkysow lkysow deleted the tls-init-quotes branch July 10, 2020 17:46
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants