TrueCloudLab/certificates
17
0
Fork 2
Code Issues 1 Pull requests 1 Releases Activity Actions

Use a clientAuth only cert for device-attest-01

Browse source
This commit is contained in:
Mariano Cano 2022-08-30 16:09:44 -07:00
parent 6db631df51
commit 59b7603d1e
1 changed files with 8 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
acme/order.go
View file

@ -5,9 +5,7 @@ import (
"context" "context"
"crypto/x509" "crypto/x509"
"encoding/json" "encoding/json"
"encoding/pem"
"net" "net"
"os"
"sort" "sort"
"strings" "strings"
"time" "time"
@ -168,17 +166,20 @@ func (o *Order) Finalize(ctx context.Context, db DB, csr *x509.CertificateReques
} }
} }
var defaultTemplate string
if permanentIdentifier != "" { if permanentIdentifier != "" {
data.Set(x509util.SANsKey, []x509util.SubjectAlternativeName{ defaultTemplate = x509util.DefaultAttestedLeafTemplate
{Type: x509util.PermanentIdentifierType, Value: permanentIdentifier}, data.SetSubjectAlternativeNames(x509util.SubjectAlternativeName{
Type: x509util.PermanentIdentifierType,
Value: permanentIdentifier,
}) })
} else { } else {
// retrieve the requested SANs for the Order defaultTemplate = x509util.DefaultLeafTemplate
sans, err := o.sans(csr) sans, err := o.sans(csr)
if err != nil { if err != nil {
return err return err
} }
data.Set(x509util.SANsKey, sans) data.SetSubjectAlternativeNames(sans...)
} }
// Get authorizations from the ACME provisioner. // Get authorizations from the ACME provisioner.
@ -188,7 +189,7 @@ func (o *Order) Finalize(ctx context.Context, db DB, csr *x509.CertificateReques
return WrapErrorISE(err, "error retrieving authorization options from ACME provisioner") return WrapErrorISE(err, "error retrieving authorization options from ACME provisioner")
} }
templateOptions, err := provisioner.TemplateOptions(p.GetOptions(), data) templateOptions, err := provisioner.CustomTemplateOptions(p.GetOptions(), data, defaultTemplate)
if err != nil { if err != nil {
return WrapErrorISE(err, "error creating template options from ACME provisioner") return WrapErrorISE(err, "error creating template options from ACME provisioner")
} }
@ -212,11 +213,6 @@ func (o *Order) Finalize(ctx context.Context, db DB, csr *x509.CertificateReques
return WrapErrorISE(err, "error creating certificate for order %s", o.ID) return WrapErrorISE(err, "error creating certificate for order %s", o.ID)
} }
// TODO(mariano): debug - remove me
pem.Encode(os.Stderr, &pem.Block{
Type: "CERTIFICATE", Bytes: cert.Leaf.Raw,
})
o.CertificateID = cert.ID o.CertificateID = cert.ID
o.Status = StatusValid o.Status = StatusValid
if err = db.UpdateOrder(ctx, o); err != nil { if err = db.UpdateOrder(ctx, o); err != nil {