github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-09-18 07:34:12 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #73093 from ereslibre/verify-certificate-sans

Browse Source 
kubeadm: verify that present certificates contain at least the required SANs
This commit is contained in:
Kubernetes Prow Robot
2019-01-25 08:53:08 -08:00
committed by GitHub
parent 408d4c0cb8 f22f594d34
commit ce52bf1265
4 changed files with 73 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
cmd/kubeadm/app/util/certs/util.go
View File

@@ -145,17 +145,18 @@ func CreateCACert(t *testing.T) (*x509.Certificate, *rsa.PrivateKey) {
return cert, key
}
// CreateTestCert makes a generic certficate with the given CA.
func CreateTestCert(t *testing.T, caCert *x509.Certificate, caKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey) {
cert, key, err := pkiutil.NewCertAndKey(caCert, caKey,
&certutil.Config{
CommonName: "testCert",
Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
})
// CreateTestCert makes a generic certificate with the given CA and alternative names.
func CreateTestCert(t *testing.T, caCert *x509.Certificate, caKey *rsa.PrivateKey, altNames certutil.AltNames) (*x509.Certificate, *rsa.PrivateKey, *certutil.Config) {
config := &certutil.Config{
CommonName: "testCert",
Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
AltNames: altNames,
}
cert, key, err := pkiutil.NewCertAndKey(caCert, caKey, config)
if err != nil {
t.Fatalf("couldn't create test cert: %v", err)
}
return cert, key
return cert, key, config
}
// CertTestCase is a configuration of certificates and whether it's expected to work.
@@ -172,7 +173,7 @@ func GetSparseCertTestCases(t *testing.T) []CertTestCase {
fpCACert, fpCAKey := CreateCACert(t)
etcdCACert, etcdCAKey := CreateCACert(t)
fpCert, fpKey := CreateTestCert(t, fpCACert, fpCAKey)
fpCert, fpKey, _ := CreateTestCert(t, fpCACert, fpCAKey, certutil.AltNames{})
return []CertTestCase{
{