improve interoperability between self-signer in dev environments with openssl generated certs #2495
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
In a dev environment that is setup with our scripts, we using openssl to generate our self-signed server certs with the CA while the server is using the self signer library which uses BouncyCastle to sign the certificates.
During this process, openssl when it generates the server ca certs used in the trust store it uses DER PrintableString for the C component and UTF8String for all other components. BouncyCastle library, on the other hand, uses PrintableString for all the components.
Now, with curl, this is not a problem and curl determines that the server is accepting client connections from a given issuer. With Go, the tls module actually compares the DER encoding (RawIssuer field) and determines that the client certificate used in the TLSConfig object is not accepted by the server thus it ignores it.
Now, both BC library and openssl are using the same DER encoding and the self-signed certs work fine in a dev environment.
Contribution Checklist:
Attach Screenshots (Optional)