Adding client usage extension for server cert (#305)

Signed-off-by: mmerrill3 <[email protected]>
kopeio · Mar 18, 2020 · 2470811 · 2470811
1 parent cd09bd6
commit 2470811
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/pkg/etcd/pki.go b/pkg/etcd/pki.go
@@ -63,7 +63,7 @@ func (p *etcdProcess) createKeypairs(peersCA *pki.Keypair, clientsCA *pki.Keypai
 
 		certConfig := certutil.Config{
 			CommonName: me.Name,
-			Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+			Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
 		}
 
 		if err := addAltNames(&certConfig, me.ClientUrls); err != nil {

diff --git a/pkg/tlsconfig/options.go b/pkg/tlsconfig/options.go
@@ -48,7 +48,7 @@ func GRPCServerConfig(keypairs *pki.Keypairs, myPeerID string) (*tls.Config, err
 
 	config := certutil.Config{
 		CommonName: "etcd-manager-server-" + myPeerID,
-		Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
 	}
 
 	keypair, err := keypairs.EnsureKeypair("etcd-manager-server-"+myPeerID, config, ca)