Jira (PUP-7474) PuppetCA should issue certs with Subject Alternative Name containing the CN for compliance with RFC 2818

[Andreas Ntaflos (JIRA)]

Title: Message Title

Andreas Ntaflos created an issue   Puppet / PUP-7474 PuppetCA should issue certs with Subject Alternative Name containing the CN for compliance with RFC 2818 Issue Type: Bug Affects Versions: PUP 4.10.0 Assignee: Unassigned Created: 2017/04/26 11:01 AM Priority: Normal Reporter: Andreas Ntaflos Recently Chrome 58 was released and https://www.chromestatus.com/feature/4981025180483584 states the following: RFC 2818 describes two methods to match a domain name against a certificate - using the available names within the subjectAlternativeName extension, or, in the absence of a SAN extension, falling back to the commonName. The fallback to the commonName was deprecated in RFC 2818 (published in 2000), but support still remains in a number of TLS clients, often incorrectly. Unfortunately this means that PuppetCA-issued certificates are considered invalid by Chrome 58, because by default they don't have the subjectAlternativeName extension and therefore don't include the certificate's common name (CN) as a SAN field. The implication is that many (usually internal) services that use PuppetCA-issued certificates as server certificates are now inaccessible with Chrome. Typical examples include Foreman, Puppetboard and other such services. I imagine this is also a problem for PE and its various web interfaces, but we are not PE users so I can't say for sure. In order for PuppetCA certificates to be compliant with RFC 2818 the SAN extension should always be added and it should contain at least one DNS: entry matching the certificate's common name (CN) when issuing a new certificate. This probably also means that the autosign restriction (which requires the --allow-dns-alt-names flag for puppet cert sign when SANs are present) should be relaxed and only apply when the more than one SAN is present that does not match the certificate's CN. Example certificate as it should look: Certificate: Data: Version: 3 (0x2) Serial Number: 6 (0x6) Signature Algorithm: sha256WithRSAEncryption Issuer: CN=Puppet CA: puppet.example.com ... Subject: CN=foo.example.com   ... X509v3 extensions: Netscape Comment: .(Puppet Ruby/OpenSSL Internal Certificate X509v3 Subject Alternative Name: DNS:foo.example.com ... Add Comment   This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.