Adding client usage extension for server cert (kopeio#305)

Signed-off-by: mmerrill3 <[email protected]>
mmerrill3 · Mar 27, 2020 · ade4983 · ade4983
1 parent cd09bd6
commit ade4983
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/pkg/etcd/pki.go b/pkg/etcd/pki.go
@@ -61,9 +61,11 @@ func (p *etcdProcess) createKeypairs(peersCA *pki.Keypair, clientsCA *pki.Keypai
 		keypairs := pki.Keypairs{Store: store}
 		keypairs.SetCA(clientsCA)
 
+		// The server cert is used by the gRPC library of etcd as a client cert for meta checks, like health
+		// See https://github.com/etcd-io/etcd/issues/9785
 		certConfig := certutil.Config{
 			CommonName: me.Name,
-			Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+			Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
 		}
 
 		if err := addAltNames(&certConfig, me.ClientUrls); err != nil {