From 8bc0447d8c40213462a0260ce1e871842d3a8a9c Mon Sep 17 00:00:00 2001 From: "Lubomir I. Ivanov" Date: Thu, 8 Nov 2018 01:16:33 +0200 Subject: [PATCH] kubeadm: use client-go's MakeCSRFromTemplate() in 'renew' Create CSR using the mentioned function which also encodes the type CertificateRequestBlockType. Without that 'certs renew' is failing with: 'PEM block type must be CERTIFICATE REQUEST' --- cmd/kubeadm/app/phases/certs/renewal/certsapi.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/cmd/kubeadm/app/phases/certs/renewal/certsapi.go b/cmd/kubeadm/app/phases/certs/renewal/certsapi.go index 949e17f3175..8303d91f37b 100644 --- a/cmd/kubeadm/app/phases/certs/renewal/certsapi.go +++ b/cmd/kubeadm/app/phases/certs/renewal/certsapi.go @@ -17,7 +17,6 @@ limitations under the License. package renewal import ( - "crypto/rand" "crypto/rsa" "crypto/x509" "crypto/x509/pkix" @@ -70,7 +69,7 @@ func (r *CertsAPIRenewal) Renew(cfg *certutil.Config) (*x509.Certificate, *rsa.P return nil, nil, errors.Wrap(err, "couldn't create new private key") } - csr, err := x509.CreateCertificateRequest(rand.Reader, reqTmp, key) + csr, err := certutil.MakeCSRFromTemplate(key, reqTmp) if err != nil { return nil, nil, errors.Wrap(err, "couldn't create certificate signing request") }