TLS cert soft failure

[benjaminleonard]

#2578 (comment)

Similar to the "soft-failures" we have on image import, we could probably decode the certificate and verify that either the the CN or SAN covers the computed silo url {silo}.sys.{domain}. Less useful for long term users, but likely nice for initial silo creation.

Seems like a quick win, design work is minimal since we can just reuse the pattern from image import. @augustuswm have you got a test cert you could send to play with.

[augustuswm]

Since we are only interested in verifying the name here (and maybe the expiration?) you can generate self-signed certificates for testing:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 3650 -nodes -subj "/C=XX/ST=StateName/L=CityName/O=CompanyName/OU=CompanySectionName/CN=<silo>.sys.<domain>" -addext "subjectAltName = DNS:<silo>.sys.<domain>"

You can then print the contents of the cert with:

openssl x509 -in cert.pem -text -noout

You can change the value of the subject CN by altering the CN=<silo.sys.<domain> part, and you can change the SAN entries by editing the DNS:<silo>.sys.<domain> part. I think for this initial check we can look so see if the silo is covered by either of those, including if one is specified as a wildcard (i.e. *.sys.<domain>)