-
Notifications
You must be signed in to change notification settings - Fork 68
Bugfix: updates processing Location to handle FriendlyName #294
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bugfix: updates processing Location to handle FriendlyName #294
Conversation
…contain this value instead of the CommonName Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
|
Hi there @inteon , This is not a bug. This behavior was desired as we wanted to enforce the best practice to make the ObjectName (object DN) be the same as the CommonName. That said, this is a enhancement we want to discuss within the team. Could you elaborate why you had the need of these changes? |
We want to provide the option to use a FriendlyName that differs from the CommonName, so users don't have certificates that collide due to them having the same CommonName (eg. loadbalancer1 could have certificate-lb1 as Friendlyname but share a CommonName with certificate-lb2). |
|
@inteon you are right, this is a bug. The description is misleading and made me think you were requesting this feature to be enabled. I found that the feature as described in current title "in case a FriendlyName value is provided, the object DN will contain this value instead of the CommonName" itself already is, that is, you can make a request with the FriendlyName and it will override the CommonName writting to TPP's object name for the Certificate; but you are right, this hasn't taken into account the Friendly when you process the Location option, which is a bug. I'll update the description and title accordingly |
Sorry for it not being clear right away. Thanks for updating the PR so it is more clear what the issue is. |
In TPP, the ObjectDN value is built using either the FriendlyName or the CommonName (if no FriendlyName is provided).
During processing Location, VCert logic incorrectly assumes that the object DN is always based on the CommonName.