Jira (PUP-1387) CA generates subjectKeyIdentifier from issuer cert instead of cert itself

[Adrien Thebo (JIRA)]

Title: Message Title

Adrien Thebo commented on an issue   Re: CA generates subjectKeyIdentifier from issuer cert instead of cert itself It appears as if this occurred because the arguments to ExtensionFactory were transposed. The source for ExtensionFactory.new shows this as how the arguments to the function call are determined: rb_scan_args(argc, argv, "04", &issuer_cert, &subject_cert, &subject_req, &crl); It looks like this regressed as a result of the code compression in this diff: - def build_extensions - @ef = OpenSSL::X509::ExtensionFactory.new - - @ef.subject_certificate = @cert + def self.add_extensions_to(cert, csr, issuer, extensions) + ef = OpenSSL::X509::ExtensionFactory. + new(cert, issuer.is_a?(OpenSSL::X509::Request) ? cert : issuer) - if @issuer.is_a?(OpenSSL::X509::Request) # It's a self-signed cert - @ef.issuer_certificate = @cert - else - @ef.issuer_certificate = @issuer The original code explicitly set the issuer_certificate as expected but it looks like the code compression transposed the arguments of cert and issuer. In the case of the subjectKeyIdentifier, the the issuer public key will be hashed instead of the public key for the cert being generated. Fixing this should just be a matter of correcting the order of arguments. Add Comment   Puppet / PUP-1387 CA generates subjectKeyIdentifier from issuer cert instead of cert itself This regressed in commit 94345ebac6d79a890efc5f49e136c4f76ddda3ef This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/groups/opt_out.