-
Notifications
You must be signed in to change notification settings - Fork 551
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add support for Fulcio username identity in SAN (#2291)
* Add support for Fulcio username identity in SAN We have changed the format of the username identity to not look like an email, and so we also needed to change which SAN the username was set in. Now using OtherName, I've added some custom unmarshalling to extract the OtherName SAN, because Go doesn't support this SAN type. Note in verify.go, I had to handle when the extension was critical. Since Go doesn't handle the extension, but it must be marked critical according to RFC5280, the cert will fail verification. We can simply remove the extension from the list of unhandled extensions before verifying. Signed-off-by: Hayden Blauzvern <[email protected]> * fix lint Signed-off-by: Hayden Blauzvern <[email protected]> * address comments Signed-off-by: Hayden Blauzvern <[email protected]> Signed-off-by: Hayden Blauzvern <[email protected]>
- Loading branch information
1 parent
727e3e1
commit 983c364
Showing
6 changed files
with
394 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.