Allow multilevel DNS names in SAN #1503
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The Subject Alternative Name (SAN) environment variable is now split into multiple variables to prevent any type of glob based typing. Also allow defining multiple values within an SAN variable separated by ';'.
nichtsfrei
approved these changes
Apr 21, 2021
nichtsfrei
requested changes
Apr 21, 2021
lhannigbrinck
force-pushed
the
subject_alt_name_update
branch
from
8a820e8
to
303f1e1
Compare
nichtsfrei
approved these changes
Apr 21, 2021
2 tasks
timopollmeier
added a commit
that referenced
this pull request
Jun 3, 2021
…aster Allow multilevel DNS names in SAN (Backport #1503)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What:
Allow more detailed configuration of the subject alternative name (SAN) fields for certificates and certificate requests by adding more environment variables. Also allow multiple values in a single variable separated by
;for more SAN entries of a type.Why:
For example configuring a DNS name with two level of subdomains is currently not possible currently. This is because of the way the SAN values are split within the single env variable. Configuring a DNS name like
subdomainof.subdomain.example.comwould result in anip_address = "subdomainof.subdomain.example.com"entry in the template. This entry is then validated as ipv6 address instead of a DNS name and failscerttool. There may be other errors with the current approach.How did you test it:
I created multiple self signed certificates and some CSR with different SAN combinations and verified the created SAN values manually.
Checklist: